The NIST Cybersecurity Framework organizes security by function and helps measure and communicate maturity. ISO 27001 defines a certifiable management system and demonstrates compliance to third parties. CIS Controls lists prioritized technical actions and indicates where to start. The three complement one another, and many mature companies use all three, each for a different purpose.
The choice depends on the question the company needs to answer: measuring and communicating, demonstrating compliance to a third party, or defining the next technical action.
NIST CSF 2.0: the foundation for measurement and communication
Maintained by the US standards institute and updated to version 2.0 in 2024, the NIST CSF organizes security into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It includes 22 categories and 106 subcategories. Govern was the main addition in version 2.0, which also expanded the audience to organizations of every size and industry.
NIST does not certify organizations against the CSF. Its strength lies in language executives can understand and the ability to compare companies, making it a common basis for maturity assessments. In Vultus's 2026 Cyber Risk Landscape, a study of 132 organizations, the Protect (1.94) and Detect (1.82) functions led, with Recover and Govern trailing.
ISO 27001: when a third party needs proof
ISO/IEC 27001 does not specify which technical controls to use. It requires a management system with a policy, risk analysis, justified control selection, internal auditing, management review, and continuous improvement, attested by a certification body. In the 2022 version, Annex A contains 93 controls across four themes: organizational, people, physical, and technological.
The most common reason to seek certification is external: a customer requirement, a tender, or an international partner. Certification demonstrates that the management system exists and works, but it does not replace penetration testing: certified companies also have exploitable flaws.
CIS Controls: where to start
The CIS Controls framework is the most practical of the three. Version 8 has 18 controls, from asset inventory to penetration testing, each with specific safeguards organized into implementation groups. The first group covers essential cyber hygiene for companies of any size.
CIS aligns with what tests uncover. In the Landscape study, 38.1% of organizations had a cloud environment without multifactor authentication, and in 35.7%, trying predictable passwords at scale succeeded. Account and access management are among the basic controls.
Data from ENISA, the European Union's cybersecurity agency, show why the basics come first: phishing accounted for around 60% of initial intrusions analyzed in Europe between July 2024 and June 2025, followed by vulnerability exploitation at 21.3%.
How to combine all three
A combination that works for many midsize and large companies:
- NIST CSF 2.0 as the foundation: to measure maturity, set goals, and report to the board.
- CIS Controls as an execution checklist: to translate NIST gaps into prioritized technical actions.
- ISO 27001 when there is an external requirement: to formalize and certify the management system.
All three map to one another, so work done in one can be reused in the others. Specific standards apply as needed: ISO 22301 for business continuity, PCI DSS for card processors, Central Bank resolutions for authorized institutions, and Brazil's General Data Protection Law (LGPD) for organizations processing personal data.
Frameworks in Vultus's assessment
In maturity assessments and master plans, Vultus uses NIST as the measurement framework and ISO and CIS as control references. Read about cybersecurity maturity and explore Vultus maturity assessment.
