Last updated: 8 November 2026
Quick answer: NIST CSF 2.0 is a voluntary, outcome-based framework for managing cybersecurity risk, with six functions and no certification. ISO/IEC 27001:2022 is an international standard for an information security management system (ISMS) that can be independently certified. Many organisations use CSF to set and communicate targets and ISO 27001 to prove to customers that controls work.
The NIST CSF 2.0 vs ISO 27001 decision is one of the most common questions security leaders face when they build or mature a programme. Both are respected worldwide, both are risk-based, and they overlap heavily. They were designed for different jobs, though.
This guide compares the two on structure, scope, certification, cost drivers and regional expectations in the US and EU. It ends with a decision table and a practical plan for running both from one control set.
NIST CSF 2.0 vs ISO 27001: what is the core difference?
The core difference is purpose. NIST CSF 2.0 is a taxonomy of cybersecurity outcomes that helps you understand, assess, prioritise and communicate risk. ISO/IEC 27001 is a management system standard with mandatory requirements that an accredited certification body can audit.
In short, CSF describes what good looks like and lets you choose how to get there. ISO 27001 tells you what management system you must operate and gives you a certificate when you do.
| Aspect | NIST CSF 2.0 | ISO/IEC 27001:2022 |
|---|---|---|
| Publisher | US National Institute of Standards and Technology | ISO and IEC |
| Current version | 2.0, released 26 February 2024 | Third edition, October 2022, plus Amendment 1:2024 |
| Nature | Voluntary framework of outcomes | Requirements standard for an ISMS |
| Structure | 6 functions, 22 categories, subcategories, Profiles and Tiers | Clauses 4 to 10 plus Annex A with 93 controls in four themes |
| Certification | None; self-assessment or third-party assessment against Profiles | Accredited third-party certification |
| Cost to access | Free to download | Standard must be purchased |
| Main strength | Board communication, prioritisation, flexibility | External assurance, customer and tender acceptance |
| Typical recognition | Strong in the US, including government and critical infrastructure | Global, especially strong in the EU, UK, Middle East and Asia |
How is NIST CSF 2.0 structured?
CSF 2.0 organises cybersecurity outcomes into a Core of six functions, supported by Organisational Profiles and Tiers. NIST released version 2.0 on 26 February 2024, adding a new Govern function and broadening the audience from critical infrastructure to all organisations in any sector.
The six functions
According to the CSF 2.0 publication (NIST CSWP 29), the Core contains 22 categories across six functions:
- Govern (GV): 6 categories, including organisational context, risk management strategy, roles, policy, oversight and cybersecurity supply chain risk management
- Identify (ID): 3 categories covering asset management, risk assessment and improvement
- Protect (PR): 5 categories, including identity management and access control, awareness and training, data security, platform security and infrastructure resilience
- Detect (DE): 2 categories covering continuous monitoring and adverse event analysis
- Respond (RS): 4 categories covering incident management, analysis, reporting and communication, and mitigation
- Recover (RC): 2 categories covering recovery plan execution and communication
Profiles and Tiers
A Current Profile describes the outcomes you achieve today; a Target Profile describes the outcomes you have chosen to prioritise. The gap between them becomes your roadmap. Tiers, from Tier 1 (Partial) to Tier 4 (Adaptive), describe the rigour of your risk governance and management practices.
NIST is explicit that the outcomes “are not a checklist of actions to perform”. That flexibility is a strength for prioritisation, but it means CSF on its own does not give an auditor a pass or fail test.
For more on the new governance function, see our post on mastering NIST CSF 2.0 governance.
How is ISO 27001 structured?
ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an ISMS. The current third edition was published in October 2022, with an amendment on climate action added in 2024.
Clauses 4 to 10
The mandatory clauses cover context of the organisation, leadership, planning (including risk assessment and treatment), support, operation, performance evaluation (including internal audit and management review) and improvement. You cannot exclude any of these clauses.
Annex A controls
Annex A lists 93 reference controls in four themes: organisational (37), people (8), physical (14) and technological (34). You select controls through your risk treatment process and justify inclusions and exclusions in a Statement of Applicability. Our Statement of Applicability guide explains how.
Certification and transition
Certification is carried out by accredited certification bodies, usually on a three-year cycle with surveillance audits in between. The transition from the 2013 edition has finished: under IAF MD 26, the transition period ended on 31 October 2025, and all certifications to ISO/IEC 27001:2013 expired or were withdrawn at that point.
Common mistake: Treating Annex A as the whole standard. Auditors spend as much time on clauses 4 to 10, such as risk methodology, internal audit and management review, as on individual controls.
Where do NIST CSF and ISO 27001 overlap?
They overlap substantially, because both are risk-based and cover the same security domains. NIST’s OLIR catalogue lists an ISO/IEC 27001:2022 to CSF 2.0 informative reference, which you can use as a starting crosswalk.
| CSF 2.0 function | Closest ISO/IEC 27001:2022 areas |
|---|---|
| Govern | Clauses 4 (context), 5 (leadership), 6 (planning); Annex A organisational controls on policies, roles and supplier relationships |
| Identify | Clause 6.1 risk assessment; asset inventory and classification controls; Clause 10 improvement |
| Protect | Access control, identity, awareness training, cryptography, secure configuration and backup controls |
| Detect | Logging, monitoring activities and event reporting controls |
| Respond | Incident management planning, assessment, response and learning controls |
| Recover | ICT readiness for business continuity and information security during disruption controls |
In practice: Treat any crosswalk as a starting point, not a verdict. Relationships between a CSF subcategory and an ISO control are often partial, so record how each piece of evidence satisfies each side.
What are the main differences in practice?
The biggest practical differences are assurance, prescriptiveness and the audience you are trying to convince.
Assurance
ISO 27001 produces a certificate from an accredited body that customers and procurement teams recognise. CSF has no certification scheme, so you demonstrate alignment through self-assessment, an independent assessment against your Profile, or by mapping to other attestations such as SOC 2.
Prescriptiveness
ISO 27001 mandates specific management system activities, such as a documented risk assessment process, internal audits and management reviews. CSF describes outcomes and leaves the method to you. Organisations that need structure often find ISO easier to operationalise; those with mature programmes often find CSF better for prioritisation.
Communication
CSF’s six functions and Profiles are easy to explain to a board. ISO 27001 reporting tends to focus on ISMS performance, nonconformities and audit results. Many CISOs report to the board using CSF language while running the ISMS underneath.
Cost drivers
CSF is free to use; your costs are internal effort and any external assessment. ISO 27001 adds the purchase of the standard, certification audit fees and the effort to maintain the ISMS for surveillance and recertification audits. We have not included figures because costs depend heavily on scope and provider.
Which framework matters more in the US and the EU?
In the US, NIST CSF is the common language for cybersecurity risk; in the EU and UK, ISO 27001 certification is usually the expected proof of security maturity.
| Region | Typical expectation | Why |
|---|---|---|
| US | CSF alignment, often with SOC 2 for customer assurance | CSF is widely used by US government, critical infrastructure and regulators as a reference |
| EU | ISO 27001 certification, with mapping to NIS2 and DORA | Certification is widely requested in procurement, and ISO controls map well to NIS2 risk-management measures |
| UK | ISO 27001, often alongside Cyber Essentials | Customer and public sector procurement recognise both |
| Multinational | Both | ISO for external assurance, CSF for internal prioritisation and US stakeholders |
If you are in scope for NIS2, an existing ISO 27001 ISMS gives you a strong base for the Article 21 risk-management measures.
Should you choose NIST CSF, ISO 27001 or both?
Choose based on what you need to prove and to whom. Use this decision table as a starting point.
| Your situation | Recommended starting point |
|---|---|
| Customers or tenders ask for a certificate | ISO 27001 |
| You sell mainly to US enterprises that ask for SOC 2 | SOC 2, using CSF to structure the programme |
| You need a board-friendly view of cyber risk and priorities | NIST CSF 2.0 Profiles |
| You are subject to NIS2 or DORA in the EU | ISO 27001 as the backbone, mapped to the regulation |
| You are early in maturity and need structure | ISO 27001 clauses as the operating model, CSF for gap analysis |
| You operate in the US and EU | Both, from one mapped control set |
For comparison with the US attestation route, see our post on SOC 2 vs ISO 27001.
If you want to see how one control set can report against both frameworks, you can start your 14-day free trial and load NIST CSF 2.0 and ISO 27001 side by side.
How do you run NIST CSF and ISO 27001 together?
Run them together by building one control library, one risk register and one evidence set, then reporting against each framework. A practical sequence:
- Define scope once. Use the ISO 27001 clause 4 scope statement and reuse it as the scope of your CSF Profile.
- Run one risk assessment. Use a method that satisfies ISO clause 6.1 and informs your CSF Target Profile. A shared risk management process avoids two registers.
- Build a unified control set. Start from Annex A, map each control to CSF subcategories using the NIST reference, and add any CSF outcomes that have no ISO equivalent.
- Write policies once. Tag each policy with both ISO clauses and CSF categories.
- Collect evidence once. Link each artefact, such as an access review or incident test, to every control it supports.
- Report twice. Produce a Statement of Applicability and audit pack for ISO, and Current and Target Profiles for CSF.
A cross-framework control mapping tool automates much of steps three to five. Framework pages for NIST CSF and ISO 27001 show what each covers.
Key takeaways
- NIST CSF 2.0 is a free, voluntary outcome framework with six functions and 22 categories; it has no certification.
- ISO/IEC 27001:2022 is a certifiable ISMS standard with mandatory clauses 4 to 10 and 93 Annex A controls.
- The ISO 27001:2013 transition ended on 31 October 2025, so all current certificates are to the 2022 edition.
- CSF is strongest for prioritisation and board communication; ISO 27001 is strongest for external assurance.
- Running both from one mapped control set avoids duplicate work.
Frequently asked questions
Can you get certified against NIST CSF 2.0?
No. NIST does not operate a certification scheme for the Cybersecurity Framework, and the framework states it is adopted voluntarily. You can commission an independent assessment of your Current Profile against a Target Profile, but that is an assessment report, not an accredited certificate like ISO 27001.
Is NIST CSF easier than ISO 27001?
It is more flexible, which can make it easier to start, because you choose which outcomes to prioritise and how to achieve them. ISO 27001 is more demanding to operate because it requires a full management system, internal audits, management reviews and external audits, but that rigour is what produces a recognised certificate.
Does ISO 27001 cover the NIST CSF Govern function?
Largely, yes. ISO 27001 clauses on context, leadership and planning, and Annex A controls on policies, roles and supplier relationships, address most Govern outcomes. Check areas such as cybersecurity supply chain risk management and organisational risk strategy against the NIST informative reference, as some mappings are only partial.
Should a US company pursue ISO 27001?
If it sells to EU, UK, Middle East or Asian customers, or bids for international tenders, ISO 27001 certification is often expected. US-only companies are more commonly asked for SOC 2. Many US organisations align internally to NIST CSF and then add ISO 27001 or SOC 2 for external assurance.
What changed in NIST CSF 2.0?
Released on 26 February 2024, CSF 2.0 added a sixth function, Govern, which covers organisational context, risk strategy, roles, policy, oversight and supply chain risk. It also broadened the audience beyond critical infrastructure to all organisations and added resources such as quick-start guides, implementation examples and an online reference tool.
Making the choice
The NIST CSF 2.0 vs ISO 27001 choice is rarely either-or for organisations that operate across the US and EU. Use ISO 27001 when you need a certificate, CSF when you need a clear picture of priorities, and one mapped control set so that evidence collected once serves both.
Enactia’s AI-powered GRC platform cross-maps controls, risks and evidence across NIST CSF 2.0, ISO 27001 and 50+ other frameworks. To see it on your own scope, contact us or book a demo or start your 14-day free trial.
