NIST CSF 2.0 guide
NIST CSF vs ISO 27001: framework or certificate, and when you need both
NIST CSF 2.0 gives you Profiles your leadership steers; ISO/IEC 27001 gives you a certificate an accredited body issues. This guide compares scope, assessment, outputs and cycle, shows which fits your situation and explains how to run both from one system.
Key points
- NIST CSF 2.0 is voluntary guidance that describes cybersecurity outcomes; nobody certifies against it. ISO/IEC 27001 is a requirements standard, and an accredited certification body can audit your ISMS against it and issue a certificate.
- Pick by the evidence your audience expects: a Profile that leadership steers, or a certificate that a third party can check on a register.
- The two sit comfortably together. NIST's Informative Reference catalogue lists a mapping between ISO/IEC 27001:2022 and CSF 2.0, so one set of controls and records can serve both.
- Many organisations use the CSF to govern and report, and ISO/IEC 27001 to run and prove the system underneath.
NIST CSF vs ISO 27001: the short answer
The difference is in what you end up holding. With the NIST Cybersecurity Framework you end up with a Current Profile, a Target Profile and an action plan: a picture of your cybersecurity posture that your own leadership owns and reviews. With ISO/IEC 27001 you end up with a certificate, issued after an independent audit, that states the scope of a management system someone outside the organisation has examined.
So the question behind the comparison is rarely which framework is better. It is who needs to be convinced, and what kind of proof they will accept. A board that wants to understand exposure is well served by a Profile. A customer, tender panel or partner who wants proof from someone other than you usually asks for a certificate. When both audiences exist, the answer is both, built once.
What each one actually is
NIST CSF 2.0: a taxonomy of outcomes
The US National Institute of Standards and Technology published CSF 2.0 on 26 February 2024, replacing version 1.1 of April 2018. It remains the current version on nist.gov. Its Core sorts cybersecurity outcomes into six Functions (Govern, Identify, Protect, Detect, Respond and Recover), broken down into 22 Categories and 106 Subcategories. Organisations select the outcomes that matter to them, record how far each is achieved in a Current Profile, choose priorities in a Target Profile and work the gap. Four Tiers, from Partial to Adaptive, describe how rigorously risk is governed; NIST says they are not maturity levels.
NIST does not tell you how to reach an outcome. That is deliberate: the framework points to other standards and control catalogues through its Informative References, and leaves the method to you.
ISO/IEC 27001: requirements for a management system
ISO/IEC 27001:2022, amended in 2024 to add climate considerations to the context clauses, sets out what an information security management system must do. Clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement, and none of them may be excluded if you claim conformity. Risk treatment decides the controls; you compare them with the 93 controls in Annex A, grouped into organisational, people, physical and technological themes, and record the outcome in a Statement of Applicability.
A certification body accredited to ISO/IEC 17021-1, with the ISMS rules of ISO/IEC 27006-1, audits the system in two stages. Accreditation bodies are recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA on 1 January 2026.
Side by side: scope, assessment, output and cycle
The table sets the two against the questions buyers raise most often when choosing.
| Question | NIST CSF 2.0 | ISO/IEC 27001:2022 |
|---|---|---|
| Nature | Voluntary framework of outcomes | Requirements standard for an ISMS |
| Published by | NIST, a US government agency | ISO and IEC, international standards bodies |
| Structure | Six Functions, 22 Categories, 106 Subcategories; Profiles and Tiers | Clauses 4 to 10 plus Annex A (93 controls in four themes) |
| What you choose | Which outcomes to target and at what priority | The scope and the controls risk treatment calls for; the clauses are fixed |
| Who assesses | Your leadership and internal audit, plus an independent assessor if you commission one | An accredited certification body, in Stage 1 and Stage 2 |
| Output | Current and Target Profiles and an action plan | A certificate with a stated scope, listed by the body |
| Ongoing cycle | Set by you; the Profile is updated as risks and actions change | Surveillance audits each year and recertification on a three-year cycle |
| What moves the effort | Maturity today, outcomes selected, entities and suppliers in scope | Scope, sites, headcount, risk treatment and the audit days the body sets |
Two lines matter most. The CSF lets you decide how far to go; ISO/IEC 27001 does not let you skip a clause. And the CSF produces something you steer, whereas ISO/IEC 27001 produces something others verify.
Which one fits your situation
Start from the request in front of you, not from the reputation of either framework. Pull the exact wording from recent customer questionnaires, contracts, tenders and board papers; the choice usually becomes obvious once it is written down.
| Situation | Recommendation | Why |
|---|---|---|
| A tender or contract asks for a valid certificate | ISO/IEC 27001 | Only a certificate from an accredited body satisfies that wording; a Profile cannot be verified on a register |
| A questionnaire asks whether you are aligned with NIST | NIST CSF 2.0 Profile | Alignment is shown by a scoped Profile with evidence, not by a badge |
| The board wants to understand and steer cyber risk | NIST CSF 2.0 | The Govern Function and the Profiles are written for executives, not only for security teams |
| You hold an ISO/IEC 27001 certificate and are now asked about NIST | Add a CSF Profile over the ISMS | Existing controls and records become evidence for many outcomes; the work is mostly mapping and governance |
| You have neither and customers in several regions | Both, planned as one programme | One risk assessment, one control set and one evidence base can answer both audiences |
If the question is whether to certify at all, or when, the ISO/IEC 27001 decision guide covers the triggers and the timing in depth.
Running both from one system
The most efficient arrangement puts each framework where it is strongest. ISO/IEC 27001 supplies the management system: scope, risk assessment and treatment, internal audit, management review and corrective action, all tested by an outside body. CSF 2.0 supplies the language leadership uses to set priorities and report progress, through the Target Profile and the Govern outcomes.
How the pieces connect
- One risk process. The ISMS risk assessment feeds the gaps between Current and Target Profile, so priorities are ranked by real exposure.
- One control set. Controls chosen through risk treatment are traced to CSF outcomes using the ISO/IEC 27001:2022 mapping listed in NIST's catalogue, then checked by hand, because a mapping shows relationships, not equivalence.
- One evidence base. The records the certification body samples are the same records that show an outcome is achieved.
- One review rhythm. The management review required by the standard is a natural moment to update the Profile and confirm the Target.
Where SOC 2 or the CIS Controls are also in play, the hub's wider guide, NIST CSF 2.0 vs ISO/IEC 27001, SOC 2 and the CIS Controls, sets out how all four fit together. For building the Profiles themselves, see Current and Target Profiles: a practical guide.
How Sterling helps
One programme, two kinds of proof
Our expert and experienced consultants begin with a gap analysis that records your Current Profile and your ISMS position in the same exercise, then agree the Target Profile and the certificate scope with your leadership. You choose Design™, where we guide your team, or Drive™, where we manage the work; they are alternative routes, not stages. Effivity, used in 50+ countries and included with the engagement at no additional cost, holds the Profile, risks, controls and evidence in one place. Where the certificate is part of the plan, we ensure successful certification for our clients; where the CSF is the goal, we stay until the Profile runs as a management routine. Sterling does not certify: an accredited certification body issues the ISO/IEC 27001 certificate, and NIST certifies no one.
Book a free discovery callWhere organisations go wrong
- Treating a CSF Profile as a certificate. A "NIST certified" badge has no issuing authority behind it. If a customer needs third-party proof, the Profile alone will not satisfy them.
- Treating a certificate as full CSF alignment. An ISO/IEC 27001 certificate covers a stated scope. Outcomes outside it, or Govern outcomes nobody owns, still need attention before you claim alignment.
- Building two parallel projects. Separate teams, separate risk registers and separate evidence folders double the work and produce answers that disagree.
- Copying a mapping without judgement. A listed relationship between a control and an outcome is a starting point. Whether your control actually achieves the outcome is a question of evidence.
- Setting every outcome as a priority. A Target Profile with everything at the top tells leadership nothing and stalls the action plan.
NIST CSF vs ISO 27001: questions buyers ask
Is NIST CSF easier to implement than ISO 27001?
Not necessarily easier, but more flexible: the CSF lets you choose which outcomes to target and how far to go, whereas ISO/IEC 27001 requires every clause from 4 to 10. The effort for either depends mostly on your starting point and scope.
Does an ISO 27001 certificate prove we are aligned with NIST CSF 2.0?
No, not on its own. It shows an audited ISMS within a stated scope, which is strong evidence for many CSF outcomes, but alignment is demonstrated through a Profile that records each selected outcome and its evidence.
Should an organisation outside the United States choose NIST CSF or ISO 27001?
Follow the request, not the geography: if customers or tenders ask for a certificate, ISO/IEC 27001 is the route, and the CSF can still serve as the board's reporting framework. The CSF is published by a US agency but written for organisations anywhere.
Can one gap analysis cover both NIST CSF and ISO 27001?
Yes, and it should. Sterling's gap analysis records how far each selected outcome is achieved and how the ISMS stands against the standard in one exercise, so the action plan closes gaps for both at once.
What should we tell a customer who asks if we are NIST compliant?
Say that you have aligned your programme with NIST CSF 2.0 and offer to share a summary of your Profile and the evidence behind it. There is no NIST certificate, so avoid any wording that suggests one.
If we start with the CSF, can we certify to ISO 27001 later?
Yes. The asset inventory, risk register, policies and incident records built for the Profile carry straight into an ISMS; the work still to do is typically the management-system elements such as the Statement of Applicability, internal audit and management review.
More NIST CSF 2.0 guides
Every guide in the NIST CSF 2.0 series is written for one question and links back to the hub for the whole picture.
Keep exploring
Explore more about NIST CSF 2.0
Watch a video on how to implement NIST CSF here.
Watch a video on NIST CSF 2.0 explained here.
Talk to a consultant
Plan NIST CSF 2.0 and ISO/IEC 27001 as one programme.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice