Cybersecurity frameworks, control catalogues and government schemes that set baseline defences: NIST CSF, NIST SP 800-53 and 800-171, CIS Controls, CMMC and more.
Cybersecurity frameworks describe what a reasonable defence looks like: which assets to know about, which controls to run, how to detect and respond to incidents and how to recover. Most are voluntary. They become binding when a government or a customer writes them into a contract, which is common for suppliers to US federal and defence agencies, and increasingly for suppliers in the UK, Australia and the EU.
Frameworks, catalogues and certification schemes
A framework (the NIST Cybersecurity Framework) gives you outcomes to aim for and a way to describe your current and target state. A control catalogue (NIST SP 800-53, CIS Controls) gives you specific safeguards. A certification scheme (CMMC, Cyber Essentials) checks a defined set of controls and issues a result that buyers can rely on. They fit together: many organisations use the CSF to set direction, a catalogue to choose controls and a scheme where a contract demands one.
Where they are mandatory
US federal agencies must follow FISMA, which points to NIST SP 800-53. Defence contractors that handle Controlled Unclassified Information must protect it to NIST SP 800-171 and, as the CMMC program phases in, show it through self-assessment or third-party certification. Some UK government contracts ask for Cyber Essentials, and many Australian Commonwealth entities must implement the Essential Eight. Outside those settings, these frameworks are voluntary good practice.
Where to start
For a small or mid-sized IT company with no government contracts, the CIS Controls Implementation Group 1 and the NIST CSF are practical starting points. If you sell to the US government, start with the guide for the program in your contract. The individual guides map each framework to ISO/IEC 27001 so that work done for one counts toward the others.
Australia. Mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework; widely used voluntarily by Australian businesses and their suppliers.
Australian Signals Directorate (ASD) and its Australian Cyber Security Centre (ACSC)
European Union member states, through national laws transposing the directive. Non-EU providers of certain digital services offering them in the EU must designate a representative.
European Parliament and Council; enforced by national competent authorities and CSIRTs, coordinated by the NIS Cooperation Group and ENISA
The CIS Critical Security Controls are a prioritised set of 18 controls and 153 specific safeguards that defend against the most common cyber attacks. Published by the non-profit Center for Internet Security, version 8.1 groups safeguards into three Implementation Groups, starting with IG1, a basic set for organisations with limited security expertise. They are voluntary, practical and mapped to the NIST CSF, ISO/IEC 27001 and other frameworks, which makes them a common starting point for small and mid-sized IT companies.
Cybersecurity Maturity Model Certification program (32 CFR Part 170 and DFARS 252.204-7021)
CMMC is the US Department of Defense program to verify that contractors protect federal contract information and Controlled Unclassified Information. It defines three levels, from basic safeguarding with annual self-assessment to certification against NIST SP 800-171 and enhanced requirements. The rules took effect in 2024 and 2025 with a phased rollout, but in July 2026 the department suspended Phase 2 and launched a review. Self-assessments, SPRS scores and DFARS 7012 duties still apply.
Cyber Essentials and Cyber Essentials Plus, the UK government-backed certification scheme (Requirements for IT Infrastructure v3.3)
Cyber Essentials is the UK government-backed certification that shows an organisation has five basic technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. It is required for many UK government contracts and is common in supply chains. The April 2026 version 3.3 confirmed that cloud services can never be excluded from scope and that cloud logins must use MFA. Cyber Essentials Plus adds independent technical testing.
Australian Signals Directorate (ASD) Essential Eight mitigation strategies and Essential Eight Maturity Model
The Essential Eight is the Australian Signals Directorate's set of eight prioritised mitigation strategies against common cyber attacks: application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. The Maturity Model defines levels one to three for each strategy. It is mandatory for many Australian government entities and widely required of suppliers, and ASD began consulting in 2026 on a broader successor series.
Federal Information Security Modernization Act of 2014 (44 U.S.C. 3551 and following)
FISMA is the US federal law that requires every federal agency to run an agency-wide information security programme, protect its information systems according to NIST standards, report incidents to CISA, and be evaluated annually by its inspector general. The 2014 modernisation clarified the roles of OMB and the Department of Homeland Security and strengthened incident reporting. It applies to agencies directly and reaches IT contractors and cloud providers through contracts and programs such as FedRAMP.
The NIST Cybersecurity Framework is voluntary guidance for managing cybersecurity risk, organised as six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0, published in 2024, added the Govern function and widened the audience from critical infrastructure to every organisation. It describes outcomes rather than prescribing controls, and uses profiles and tiers to compare current and target states. It is not certifiable, but it is one of the most widely used ways to structure a security programme.
NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations
NIST SP 800-53 is the US government's catalogue of security and privacy controls, organised in 20 families from access control to supply chain risk management. Revision 5 made the controls outcome-based and usable by any organisation, and Release 5.2.0 in 2025 added software update and patch integrity controls. Federal systems must select controls from baselines in SP 800-53B, and programs such as FedRAMP use them, so vendors selling to the US government meet this catalogue directly.
NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
NIST SP 800-171 sets security requirements for protecting Controlled Unclassified Information (CUI) in contractor and other nonfederal systems. DoD contractors must implement it under DFARS 252.204-7012 and report a self-assessment score, and the CMMC program verifies it. NIST published Revision 3 in 2024 with 97 requirements in 17 families, but DoD contracts still require Revision 2 with its 110 requirements under a class deviation. Software and IT firms in the defence supply chain must meet it.
CERT-In Cyber Security Directions No. 20(3)/2022-CERT-In of 28 April 2022 under section 70B(6) of the IT Act, 2000
The CERT-In Directions of 28 April 2022 are binding cyber security directions issued by India's national computer emergency response team under section 70B(6) of the IT Act. They require service providers, intermediaries, data centres, body corporates and government organisations to report 20 types of cyber incidents to CERT-In within six hours of noticing them, keep logs of all ICT systems for 180 days within Indian jurisdiction, synchronise clocks to national time servers, and name a point of contact. Cloud, data centre and VPN providers have extra customer record duties.
Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)
The Cyber Resilience Act is the EU law that makes cybersecurity a legal requirement for hardware and software products sold in the EU. Manufacturers must design products to essential security requirements, handle vulnerabilities throughout a support period, provide security updates, keep a software bill of materials, carry out conformity assessment and apply CE marking. From 11 September 2026 they must report actively exploited vulnerabilities and severe incidents within 24 hours, and most other duties apply from December 2027.
IRDAI Information and Cyber Security Guidelines, 2026 (revising the 2023 Guidelines on Information and Cyber Security for Regulated Entities)
IRDAI's Information and Cyber Security Guidelines set minimum security standards and governance for insurers and insurance intermediaries in India. The 2026 revision, issued on 6 April 2026 and applicable from the 2026-27 financial year, keeps the 2023 structure but strengthens governance: quarterly security committee meetings, a new IT Steering Committee, an independent and technically qualified CISO, risk-based budgets, independent experts on the risk committee, and remediation of audit gaps within 12 months.
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2)
NIS2 is the EU directive that sets cybersecurity risk-management, incident reporting and governance duties for medium and large organisations in a long list of sectors, including digital infrastructure, managed IT and security service providers, cloud and data centre services, and online platforms. It replaced the 2016 NIS Directive, applies through national laws from October 2024, holds management bodies accountable, requires a 24-hour early warning for significant incidents, and allows fines up to 10 million euros or 2 percent of turnover.
NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
The NIST Risk Management Framework is the US government's process for managing security and privacy risk across a system's life cycle. Defined in SP 800-37 Rev. 2, it has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. Agencies use it to categorise systems by impact, choose and implement NIST SP 800-53 controls, assess them, decide whether to authorise operation, and monitor continuously. It underpins FedRAMP, FISMA compliance and many contractor requirements.
OWASP Top 10:2025, the ten most critical web application security risks
The OWASP Top 10 is the best-known list of critical web application security risks, published by the OWASP Foundation from data on millions of tested applications and a community survey. The 2025 edition, the eighth, ranks broken access control first and adds two categories: software supply chain failures and mishandling of exceptional conditions. It is an awareness document rather than a standard, but secure coding policies, PCI DSS assessments, penetration tests and customer contracts routinely use it as a baseline.
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, circular of 20 August 2024 as clarified
SEBI's Cybersecurity and Cyber Resilience Framework sets one cyber standard for stock exchanges, depositories, brokers, mutual funds, portfolio managers, investment advisers and other SEBI-regulated entities. It grades entities into five categories, then sets proportionate requirements for governance, a CISO, security operations, VAPT, cyber audits, a Cyber Capability Index, incident handling, recovery within two hours for critical systems and cloud adoption with data and keys in India.
SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules (Form 8-K Item 1.05 and Regulation S-K Item 106)
The SEC's cybersecurity disclosure rules require US public companies to disclose material cybersecurity incidents on Form 8-K Item 1.05 within four business days of determining materiality, and to describe their cybersecurity risk management, strategy and governance annually in Form 10-K under Regulation S-K Item 106. The rules, in force since December 2023, raise expectations on incident response, board oversight and third-party risk. Industry groups have asked the SEC to rescind the incident rule, but it remained in force as of October 2026.
Supply-chain Levels for Software Artifacts (SLSA), an OpenSSF specification
SLSA is an open specification for protecting software from tampering between source code and the package users install. It defines tracks with increasing levels: the Build track, from provenance that describes how an artifact was built up to hardened, isolated builds with signed provenance, and the Source track, from version control up to enforced controls and two-party review. Producers generate attestations, and consumers verify them before trusting an artifact.
SWIFT Customer Security Programme (CSP) and Customer Security Controls Framework (CSCF)
The SWIFT Customer Security Programme requires every bank and institution connected to the SWIFT network to secure its local SWIFT environment against cyber attacks. Its Customer Security Controls Framework sets mandatory and advisory controls under three objectives: secure your environment, know and limit access, and detect and respond. Users attest compliance annually, supported by independent assessment, and counterparties can view attestations. CSCF v2026 made back office data flow security mandatory and extended scope to customer connectors.
Not for private companies in general. It is voluntary guidance, although US federal agencies are expected to use it and some contracts and regulators reference it.
What is the difference between NIST CSF and NIST SP 800-53?
The CSF describes outcomes at a high level. SP 800-53 is a detailed catalogue of security and privacy controls. Organisations often use the CSF to plan and SP 800-53 to choose specific controls.
Which framework suits a small software company?
The CIS Controls Implementation Group 1 is designed as a basic set for organisations with limited security staff. It maps to the NIST CSF and to ISO/IEC 27001 if you later need certification.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
