NIST vs. ISO: Understanding the Difference

Summary: As a business, you need to have benchmarks to work against in all facets of your work. That's especially true when it comes to cybersecurity. In this area, there are two main groups that offer guidelines: The National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO). What's the difference between the two, and which one should you follow? Here's what you need to know. 

What Is the NIST Cybersecurity Framework?

Let's start with the NIST Cybersecurity Framework (CSF) and see how this works. The CSF was designed by the National Institute of Standards and Technology, which is a US non-regulatory governmental agency. They're housed under the Department of Commerce, and the CSF is designed to help companies develop and manage their cybersecurity frameworks. 

As such, right now, the CSF is used for everything from nanotechnology to cybersecurity, giving it a good amount of range. It was first developed in 2013 and has been regularly updated in line with advances in technology ever since. 

How NIST CSF Is Used

So how is CSF used when it comes to cybersecurity? There are three major components to the system, and that helps you understand the risk level of your system and identify any underlying problems. As such, you can prioritize any issues and take action sooner rather than later. The three components are as follows:

Framework Core

This is the baseline of the CSF and what everything else is built on. There are five functions that make up this core: Identify, Protect, Detect, Respond, and Recover. While they do apply to cybersecurity in this instance, they can work to identify and manage any risk management issues. 

When you dig deeper, you'll see that these functions are divided further into 23 categories, which give you everything you need regarding the basics of setting up a good cybersecurity system. 

Implementation Tiers

Next are the implementation tiers, which are used in each of the five functions. There's a ranking scale of 0 – 4, which gives you a final number that establishes a benchmark for your level of risk maturity. 

Profiles

A profile in each tier allows you to understand your current level of risk and figure out what steps to take next to tighten security. You can set up extra profiles, which give you targets to aim for and improve security as a whole online. 

What Is ISO 27001?

Now let's look at the NIST CSF's counterpart, the ISO 27001. The ISO is another non-governmental body, this time located in Geneva, Switzerland. It has been in service since 1954, and they set standards for a huge variety of industries, including cybersecurity. 

They have a family of standards referred to as the 27000 standards, and these are the ones that concern IT and security risk management. This was first released in 2005 and again has been updated over time to keep up with advancements in technology. ISO 27001, in particular, focuses on a framework for developing and implementing IT security systems. 

How ISO 27001 Is Used

So how does ISO 27001 work? The standards here are meant to help businesses systemize their cybersecurity, growing a system that was put into place to cover certain issues into a full IT management system. You can get certification for compliance with ISO 27001, whether that's through the ISO themselves or a third-party auditor. 

With ISO 27001, the scope can be limited to just one aspect of the company, rather than the company as a whole. 

When getting certified, you'll have to go through two stages. The first stage is a “documentation review,” where your documents on processes, policies, and procedures will be audited. They will be looked at to ensure that they meet ISO standards. 

Then you'll go through a stage 2 audit, called the Certification Audit. This will involve an auditor doing a full and thorough on-site assessment to ensure that your systems comply with ISO 27001 fully. If they do, then you'll be able to get the certification. This is valid for three years before you have to go through a re-certification audit. 

The Difference between NIST and ISO

Now that you know the basics of NIST and ISO, if you want to improve and certify your cybersecurity systems, which one should you follow? Both of them are highly useful, and it just depends on what you need from them as a company. Here are some of the key differences between them. 

Risk maturity

The age and maturity of your business's security system will play a large part in helping you choose here. If you're new or you're in the beginning stages of creating a security system, then getting a NIST CSF system is going to be the better choice here. For those that have a more mature system in place and need certification, ISO 27001 is going to be the way to go. This is because it's better at helping businesses mitigate issues such as data breaches. 

Certification

If you want to get your cybersecurity system certified, then you'll want to choose the ISO 27001 framework. There are multiple ways you can obtain certification, and there are lots of reasons why you may want to do so. It does eat into your budget, but it's a good investment as it shows stakeholders that you're taking your cybersecurity seriously. With NIST CSF, they don't offer certification, so that's not a benefit you can get through them. 

Cost

This is something that you will want to consider, especially if you are a brand new company or start-up. NIST CSF is free of charge, so new companies can use their framework to get set up and running. ISO 27001, on the other hand, will charge you to access their documentation. That can start to get costly, so you may want to start with NIST and then move up to ISO when you're able to do so. 

Overlap between NIST and ISO

What many people don't realize is that a lot of systems out there have a lot of overlap. That's especially true for NIST CSF and ISO 27001. They cover a lot of the same ground, such as identifying risks, implementing controls to reduce risk, and performance monitoring. 

For this reason, many companies will want to ensure they're only using one or the other. For example, if you complete ISO 27001, you're actually 60% of the way towards completing NIST CSF. If you don't know that and try to use both, you can be spending a lot of money needlessly. As such, be aware of the overlap when you're looking to implement security systems. 

Using the Frameworks Together

While there are a lot of reasons why you'd want to pick one or the other when it comes to frameworks, sometimes it can work well to use them together. The key is to understand why you may want to do that.  

“As a new business, using NIST CSF won't cost you anything as it's a voluntary system,” says Graham Moyles, a tech blogger at PhD Kingdom. “As such, what you can do is use that first to get a system up and running, and then consider moving on to ISO 27001.”

This is something that a lot of new companies do. They can get up and running first with NIST, and that allows them to have a robust system in place without costing them any money to do so. However, they may want to then look at ISO 27001, as it's an international standard that's widely recognized. 

If they do decide to move on, then they'll have less work to do for certification as they'll have done most of it during the NIST CSF implementation. You can find systems and services online that create frameworks for you for this reason. These will show you what you need to do to get certification and where the overlap lies. 

While there are a lot of benefits to choosing one or the other, you can also benefit from using both, too. You'll have to decide as a company which will suit you better and choose carefully so you can get the best security possible. 

Which Option Is Right for You?

Now that you know most of the basics around ISO 27001 and NIST CSF, you'll need to consider which one you want to use for your business. A lot of this decision will hinge on the age of your business and the budget you have. If you're a new business or looking to improve security on a lower budget, then NIST will be the option for you. If you're looking to get certified and verify a mature risk reduction system, ISO will be the right way to go. 

You're not locked into one system or the other, and that's important to know. You can always start with NIST and then upgrade to ISO as time goes on. Either way, it's highly beneficial to use one of these systems to improve cybersecurity.