Map everyday security controls to the six NIST Cybersecurity Framework functions and the CIS Critical Security Controls.
Why it matters
Individual controls are easy to list. The hard questions are: are we covering everything that matters, and what should we do next? Security frameworks answer those questions with a shared structure. When a manager asks "how mature is our security?", or an auditor asks "how do you detect incidents?", a framework lets you answer in terms everyone recognises. Two of the most widely used are the NIST Cybersecurity Framework (CSF) and the CIS Critical Security Controls.
NIST Cybersecurity Framework 2.0
The US National Institute of Standards and Technology (NIST) published CSF 2.0 in 2024. It is voluntary, free, and used by organisations of all sizes around the world, not only in the US. Official site: nist.gov/cyberframework. Checked on 2026-10-23.
CSF organises security outcomes into six functions:
| Function | Question it answers | Example outcomes |
|---|---|---|
| Govern (GV) | How do we set direction and accountability? | Risk strategy, roles and responsibilities, policy, supply-chain risk management |
| Identify (ID) | What do we have and what are the risks? | Asset inventory, risk assessment, improvement plans |
| Protect (PR) | How do we safeguard it? | Identity and access management, training, data security, platform hardening |
| Detect (DE) | How do we find attacks and anomalies? | Continuous monitoring, analysis of suspicious events |
| Respond (RS) | What do we do during an incident? | Incident management, analysis, reporting, containment |
| Recover (RC) | How do we restore normal operations? | Executing recovery plans, communicating during recovery |
Govern was added in version 2.0. It sits at the centre because the other five depend on leadership decisions: who owns risk, how much risk is acceptable, and how security is funded.
Each function is divided into categories and subcategories (specific outcomes). CSF tells you what to achieve, not exactly how: it points to other standards for detailed controls. Organisations use it to build a current profile (where we are) and a target profile (where we want to be), then plan the gap.
CIS Critical Security Controls
The Center for Internet Security (CIS) publishes the CIS Controls: a prioritised list of 18 practical safeguard areas, written by practitioners based on how real attacks succeed. Official site: cisecurity.org/controls. Checked on 2026-10-23.
The first few controls show the thinking: you cannot protect what you do not know about.
- Inventory and control of enterprise assets
- Inventory and control of software assets
- Data protection
- Secure configuration of enterprise assets and software
- Account management
- Access control management
- Continuous vulnerability management
- Audit log management
Later controls cover email and browser protections, malware defences, data recovery, network infrastructure, security awareness training, service providers, application software security, incident response and penetration testing.
Each control contains specific safeguards, grouped into three Implementation Groups:
- IG1 ("essential cyber hygiene"): the minimum every organisation should do, sized for small teams with limited IT staff.
- IG2: adds safeguards for organisations with more complex environments and sensitive data.
- IG3: everything, for organisations facing skilled, targeted attackers.
How they fit together
CSF is the map: it tells you which outcomes matter and lets you describe maturity to leadership. The CIS Controls are a to-do list: specific, prioritised safeguards you can implement. CIS publishes mappings from its safeguards to CSF, so many teams use CSF for reporting and CIS IG1 as the starting work plan.
Worked example: mapping controls to CSF functions
A small company lists what it already does. Mapping each control to a CSF function shows where the gaps are:
| Control | CSF function |
|---|---|
| Board-approved security policy naming the IT manager as owner | Govern |
| Spreadsheet listing every laptop, server and cloud account | Identify |
| Yearly risk assessment of the customer database | Identify |
| MFA on email and the cloud console | Protect |
| Automatic OS and browser updates | Protect |
| Phishing awareness training | Protect |
| Alerts on logins from new countries | Detect |
| Written incident response plan with phone numbers | Respond |
| Offline backups tested by a quarterly restore | Recover |
Reading the table, Protect is strong but Detect has only one item, and nothing covers reviewing logs for unusual activity. That points to the next investment: centralised logging and alert review (CIS Control 8, audit log management). This is exactly how frameworks are used day to day.
Common mistakes
- Treating a framework as a certificate. CSF is not something you "pass"; it is a way to measure and plan.
- Implementing everything at once. Start with the essentials (asset inventory, MFA, patching, backups, logging) and grow.
- Skipping Govern. Without clear owners and agreed risk tolerance, controls get bought but not maintained.
- Copying another organisation's profile. Your target depends on your own risks, data and resources.
Quick recap
- NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern is new in 2.0.
- CSF describes outcomes (what), not specific controls (how); profiles compare where you are with where you want to be.
- CIS Controls are 18 prioritised, practical control areas with safeguards in three Implementation Groups; IG1 is essential hygiene.
- Use CSF to find and explain gaps, and CIS safeguards to close them.