Cybersecurity Frameworks List: 12 Frameworks Every Leader Should Know
There are dozens of cybersecurity frameworks, and every vendor, auditor, and consultant seems to have a favorite. That’s how organizations end up “aligned to” five of them and good at none.
Here are the 12 that actually come up in boardrooms, contracts, and audits, what each one is for, and how to pick the right one (or two) for your organization.
The 12 Frameworks at a Glance
| Framework | Type | Best for | Certifiable? |
|---|---|---|---|
| NIST Cybersecurity Framework (CSF) 2.0 | Voluntary framework | Any organization that needs a security plan and board-level language | No |
| ISO/IEC 27001:2022 | International standard | Proving security to customers worldwide | Yes |
| CIS Controls v8.1 | Prioritized control set | Small and mid-size teams that need a to-do list | No |
| NIST SP 800-53 Rev. 5 | Control catalog | Federal systems and highly regulated organizations | No (assessed, not certified) |
| NIST Risk Management Framework (RMF) | Process | Authorizing federal information systems | No |
| SOC 2 | Attestation (AICPA) | SaaS and service companies selling in North America | Report, not certificate |
| MITRE ATT&CK | Threat knowledge base | Detection, threat hunting, and red teaming | No |
| COBIT 2019 | IT governance framework | Boards, audit, and IT governance | Individual certs only |
| PCI DSS v4.0.1 | Industry standard | Anyone storing, processing, or transmitting payment card data | Yes (assessed compliance) |
| HIPAA Security Rule | U.S. regulation | Healthcare organizations and their business associates | No (compliance required) |
| CMMC | U.S. DoD program | Defense contractors handling FCI or CUI | Yes |
| Zero Trust (NIST SP 800-207) | Architecture principles | Modernizing access and network security | No |
Planning Frameworks: Where Most Organizations Start
1. NIST Cybersecurity Framework (CSF) 2.0
The most popular starting point in the U.S. CSF 2.0 (February 2024) organizes security into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It’s free, flexible, and written in language executives understand. Read our CSF 2.0 overview for the structure and our practical CSF guide for a rollout plan.
2. CIS Controls v8.1
If CSF is the “what,” the CIS Controls are the “what first.” 18 controls and 153 safeguards, grouped into three Implementation Groups. IG1 is the essential hygiene every organization should finish before anything fancier.
3. Zero Trust (NIST SP 800-207)
Less a checklist, more a design philosophy: never trust a user or device just because it’s on your network. Verify every request and grant the least access needed.
Certification and Compliance Frameworks: When Someone Asks for Proof
4. ISO/IEC 27001:2022
The international standard for an information security management system. An accredited body audits you and issues a certificate valid for three years. Its Annex A lists 93 controls in four themes. If you sell globally, this is often the one buyers ask for.
5. SOC 2
An AICPA attestation report, written by a CPA firm, on your controls against the Trust Services Criteria. Hugely common for SaaS companies selling to U.S. businesses. Type II, which covers a period of months, carries more weight than Type I.
6. PCI DSS v4.0.1
Mandatory for anyone who stores, processes, or transmits payment card data. Version 4.0.1 is the current and only active version, and its formerly future-dated requirements have applied since March 31, 2025.
7. HIPAA Security Rule
Not optional for U.S. healthcare organizations and their business associates. It requires administrative, physical, and technical safeguards for electronic protected health information. Many healthcare teams use NIST CSF to organize the work.
8. CMMC
The Cybersecurity Maturity Model Certification for U.S. Department of Defense contractors. It has three levels and is being phased into contracts. Phase 1 began November 10, 2025, and Phase 2, which requires third-party Level 2 certification at award where applicable, begins November 10, 2026. If you work in the defense supply chain, this one isn’t a choice.
Government and Control Catalogs
9. NIST SP 800-53 Rev. 5
A huge catalog of security and privacy controls used across the U.S. federal government. Most private companies use it as a reference rather than adopting it whole.
10. NIST Risk Management Framework (RMF)
The seven-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) federal agencies use to secure and authorize systems, drawing its controls from SP 800-53. Here’s our plain-English RMF guide.
Threat and Governance Frameworks
11. MITRE ATT&CK
A free knowledge base of real attacker tactics and techniques. Security teams use it to map detections, find coverage gaps, and plan exercises. See what MITRE ATT&CK is and how teams use it.
12. COBIT 2019
ISACA’s IT governance framework, with 40 governance and management objectives. Not a security framework on its own, but it’s how many boards and auditors frame accountability for technology, security included.
How to Choose (Without Collecting Them All)
- Start with what’s required. Card data means PCI DSS. Healthcare means HIPAA. Defense contracts mean CMMC. Those aren’t optional.
- Then add what buyers ask for. Check your last ten security questionnaires. They’ll tell you whether ISO 27001 or SOC 2 matters more.
- Use one planning framework to tie it all together. For most organizations that’s NIST CSF 2.0, with the CIS Controls as the task list underneath.
- Map once, comply many times. One well-documented control often satisfies several frameworks.
My take: a small or mid-size company should almost never start with more than one framework. Pick NIST CSF or CIS IG1, get a year of real progress, then add a certification only when the business needs one.
Want the short version? Grab our free one-page NIST CSF 2.0 cheat sheet, or browse the frameworks glossary for 100+ more.
FAQ
What is the most widely used cybersecurity framework?
In the U.S., the NIST Cybersecurity Framework is the most common starting point. Internationally, ISO/IEC 27001 is the most widely certified.
What is the difference between a framework and a standard?
A framework gives flexible guidance you adapt, like NIST CSF. A standard sets specific requirements you can be audited against, like ISO 27001.
Which cybersecurity framework is best for small businesses?
The CIS Controls Implementation Group 1 or a lightweight version of NIST CSF 2.0. Both are free and practical for small teams.
Do I need more than one cybersecurity framework?
Often, yes, but not at first. Most organizations use one planning framework and add certifications or regulations as customers and laws require.
Are cybersecurity frameworks mandatory?
Most are voluntary. Some, like PCI DSS, HIPAA, and CMMC, are required by contract, industry rules, or law for the organizations they cover.
Sources
- NIST Cybersecurity Framework
- CIS Controls
- ISO/IEC 27001:2022
- NIST SP 800-207: Zero Trust Architecture
- Cooley: DoD final CMMC contract rule
