2.2.2. Governance Frameworks and Standards
💡 First Principle: A framework is a shared vocabulary and structure for organizing security decisions — it tells you how to organize the conversation, but the organization still has to supply its own answers about risk appetite and priority.
Adopting COBIT, ISO/IEC 27001, or the NIST Cybersecurity Framework (CSF) is often mistaken for having completed the strategic work, when it has really only provided the scaffolding the strategic work will hang on. Two organizations can both adopt ISO/IEC 27001 and end up with completely different actual security postures, because the standard specifies a management system for deciding on and reviewing controls — it does not make the risk appetite decisions for you.
| Framework | Primary Focus | Structure | Certifiable? |
|---|---|---|---|
| COBIT | IT governance and management, linking IT goals to enterprise goals | Governance/management objectives across domains | No (guidance framework) |
| ISO/IEC 27001 | Information security management system (ISMS) | Management system requirements + Annex A control set | Yes (formal certification) |
| NIST CSF | Cybersecurity outcomes organized by function | Govern, Identify, Protect, Detect, Respond, Recover | No (voluntary framework) |
Choosing among them is itself a strategic decision that should reflect the organization's context: a publicly traded company facing customer security questionnaires may need the third-party credibility of ISO/IEC 27001 certification, while an organization more focused on IT-business alignment across a complex enterprise may lean on COBIT, and many organizations use NIST CSF as a common outcomes-based language layered over whichever underlying standard they've certified against.
⚠️ Exam Trap: A scenario may describe an organization that adopted a well-known framework and ask whether its security program is now adequate. The correct reasoning recognizes that framework adoption alone answers "how is this organized," not "is this organization's specific risk being adequately addressed" — that second question still requires the organization's own strategic judgment.
Reflection Question: Two organizations both hold ISO/IEC 27001 certification. Why might one still have meaningfully weaker security than the other, despite both meeting the same standard?
