Cybersecurity Frameworks: Which Standard to Choose According to Your Domain?

Too Many Standards, Not Enough Clarity

NIST, ISO 27001, CIS Controls, MITRE ATT&CK: every security team knows these names, but few know precisely which one to mobilize in the face of a given need. The result is often a stack of standards without coherence, or conversely an exclusive dependence on a single framework that does not cover all angles. This mapping across ten domains aims to correct this bias by associating each operational challenge with its reference standards.

Governance and Cyber Risk Management

The organizational foundation rests on four pillars recognized for risk management at the leadership level:

• NIST CSF 2.0 — generalist cybersecurity framework, revised in 2024 with the addition of the "Govern" function
• ISO/IEC 27001:2022 — certifiable standard for the information security management system (ISMS)
• CIS Controls 8.1 — set of prioritized controls, directly applicable without formal certification
• COBIT 2019 — IT governance focused on audit and business alignment

These four frameworks are not mutually exclusive: NIST CSF often serves as the backbone, while ISO 27001 brings the certifiable dimension expected by customers and partners.

Detailed Controls and Assurance Requirements

When it comes to descending into operational detail — hardening policy, access control, patch management — the following standards offer the necessary granularity:

• NIST 800-53 5.2.0 — exhaustive catalog of security controls, reference for U.S. federal agencies and many European enterprises
• ISO/IEC 27002:2022 — implementation guide for ISO 27001 controls
• CIS Benchmarks — hardening configurations by operating system, application, and cloud service
• CISA CPGs 2.0 — cybersecurity performance objectives published by the U.S. CISA agency
• PCI DSS 4.0.1 — mandatory standard for any payment card data processing environment

Cloud Security and Platforms

In a shared responsibility model — whether it's Azure, Microsoft 365, or any other hyperscaler — cloud governance requires adapted frameworks:

• CSA CCM 4.1 (Cloud Controls Matrix) — grid of cloud-specific controls published by the Cloud Security Alliance
• ISO 27017:2026 — extension of ISO 27002 for cloud services
• CSA STAR — assurance program based on CCM, with self-assessment and third-party certification levels
• CIS Benchmarks — again relevant here for Azure and M365 configurations

Application Security and DevSecOps

The OWASP ecosystem dominates this domain, with three complementary publications:

• OWASP ASVS 5.0 (Application Security Verification Standard) — testable security requirements for web applications
• OWASP Top 10:2025 — list of the ten most critical application risks, updated
• OWASP SAMM 2.0 (Software Assurance Maturity Model) — maturity model for integrating security into the development lifecycle
• NIST SSDF 1.1 Final (Secure Software Development Framework) — secure development practices recommended by NIST

Threat Detection and Adversary Mapping

For SOC (Security Operations Center) teams and detection architects, two frameworks structure the approach:

• MITRE ATT&CK v19.1 — knowledge base of adversary tactics, techniques, and procedures (TTPs), absolute reference for threat intelligence
• MITRE D3FEND — defensive counterpoint to ATT&CK, mapping countermeasures
• Sigma — generic detection rule language, compatible with most SIEMs
• CISA KEV (Known Exploited Vulnerabilities) — catalog of actively exploited vulnerabilities, regularly updated

Incident Response and Cyber Resilience

Crisis management and business continuity mobilize a set of complementary standards:

• NIST 800-61r3 — reference guide for managing information security incidents
• ISO/IEC 27035 (series) — incident management process according to ISO
• CISA Playbooks — operational guides published by CISA for common incidents (ransomware, phishing, etc.)
• ISO 22301:2019 — business continuity management system (BCMS) standard
• NIST CSF 2.0 — also relevant here through its "Recover" function

Identity, Access, and Zero Trust

Modern identity architectures — of which Microsoft Entra ID is today the pivot for most Microsoft 365 organizations — can rely on a well-established body of standards:

• NIST 800-207 — reference definition of Zero Trust architecture
• CISA ZTMM 2.0 (Zero Trust Maturity Model) — Zero Trust maturity model in five pillars
• NIST 800-63-4 — guidelines on digital identity and authentication
• FIDO2 — passwordless authentication standard, natively supported by Entra ID
• CIS Controls — controls relating to access management and privilege management

Software Supply Chain, OT, and Artificial Intelligence

Three specialized domains complete this mapping.

Software Supply Chain Security and SBOM

Software component traceability (SBOM — Software Bill of Materials) has become a regulatory requirement in several sectors:

• NIST 800-161r1 Upd.1 — ICT supply chain risk management
• NIST SSDF — secure development practices
• SLSA 1.2 (Supply-chain Levels for Software Artifacts) — integrity levels for software artifacts
• SPDX 3.0.1 and CycloneDX 1.7 — two standard formats for SBOM generation and exchange

OT and Industrial Environments

Industrial systems (OT — Operational Technology) have their own frameworks, distinct from classical IT standards:

• NIST 800-82r3 — security guide for industrial control systems
• ISA/IEC 62443 — series of reference standards for industrial cybersecurity
• CIS Controls v8.1 ICS Workbook — adaptation of CIS Controls to ICS environments
• MITRE ATT&CK for ICS — extension of ATT&CK specific to industrial systems

AI Security and Agentic Systems

This is the fastest-evolving domain. Several publications already structure this field:

• CSA AICM 1.1 (AI Controls Matrix) — grid of security controls for AI systems
• CSA AISMM (AI Safety Management Model) — AI safety management model
• OWASP LLMSVS 2.0 (LLM Security Verification Standard) — security requirements for applications based on large language models (LLM)
• NIST AI RMF 1.0 (AI Risk Management Framework) — framework for managing AI-related risks

Overview: Ten Domains, Their Key Standards

Key Takeaways

This mapping highlights several structuring trends:

• The specialization of frameworks is accelerating: there is no longer a universal standard, but an ecosystem of complementary standards.
• Cloud, software supply chain, and AI now have their own body of standards — a sign that these domains are mature enough to justify dedicated governance.
• For an organization operating on Microsoft 365 and Azure, the most natural entry points remain NIST CSF 2.0 for governance, CIS Benchmarks for operational hardening, and NIST 800-207 for the Zero Trust trajectory.
• OWASP LLMSVS 2.0 and NIST AI RMF 1.0 deserve particular attention as soon as the organization experiments with or deploys LLM-based solutions — including Copilot for Microsoft 365.

The next concrete step: map your current security initiatives against these ten domains, identify gaps, and prioritize based on your actual exposure.