ISO 27001 / NIST CSF

ISO/IEC 27001:2022, published in October 2022 by ISO and the International Electrotechnical Commission, is the third edition of the reference standard for information security management systems (ISMS), after those of 2005 and 2013. It sets out what an organization must do to establish, implement, maintain and improve a structured set of policies, procedures and technical controls that protect the confidentiality, integrity and availability of information. The standard starts from risk: the organization identifies its information assets, assesses the threats and vulnerabilities attached to them, then picks controls from an annex of 93 measures grouped into four themes (organizational, people, physical and technological). ISO 27001 certification is issued by an accredited third-party body after an audit. Cyber underwriters use it today to gauge the insured's maturity, and it can justify a premium reduction or access to higher limits. The NIST Cybersecurity Framework (CSF) was developed by the US National Institute of Standards and Technology and revised as version 2.0 in 2024. It certifies nothing, but it is very widely adopted. It sorts cybersecurity capabilities into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is valued for getting management and technical teams to talk in the same terms, and many underwriting questionnaires refer to it. The two frameworks complement each other: ISO 27001 structures management and enables certification, while the NIST CSF supplies an operational vocabulary and a way to assess maturity.