Security Controls, Frameworks and ISMS

Introduction

Cybersecurity is not achieved by purchasing isolated technologies. It requires a coherent system of governance, risk assessment, control selection, implementation, monitoring and continual improvement. Security controls are the safeguards used to reduce the likelihood or impact of unwanted events. Frameworks provide structured ways to describe, prioritise and assess those controls, while an information-security management system (ISMS) integrates them into organisational management.

This chapter examines ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27005, the NIST Cybersecurity Framework (CSF) and Risk Management Framework (RMF), CIS Controls and COBIT. These instruments overlap, but they are not interchangeable. ISO/IEC 27001 specifies requirements for an ISMS and supports certification; ISO/IEC 27002 provides control guidance; ISO/IEC 27005 supports information-security risk management; NIST frameworks provide flexible risk-management and security implementation approaches; CIS Controls offer prioritised technical and operational safeguards; and COBIT focuses on governance and management of enterprise information and technology.

A capable practitioner must therefore map and tailor controls rather than copy a framework mechanically. Tailoring means selecting controls that are justified by risk, legal obligations, business context and technology architecture.

Learning objectives

By the end of this chapter, students should be able to:

• distinguish controls, control objectives, standards, frameworks and procedures;
• explain the purposes and relationships of ISO/IEC 27001, 27002 and 27005;
• compare NIST CSF, NIST RMF, CIS Controls and COBIT;
• perform basic control mapping and tailoring;
• describe certification, statements of applicability and audit evidence;
• explain maturity models and the ISMS lifecycle; and
• recommend practical governance and improvement actions.

1. Controls and control objectives

A security control is a measure that modifies information-security risk. It may be administrative, technical, physical, preventive, detective, corrective or deterrent. Examples include access reviews, multifactor authentication, secure configuration, backup restoration tests, visitor controls and incident-response exercises.

A control objective states what a control or group of controls is intended to achieve. For example, “only authorised users access sensitive payroll data” is an objective. A password policy, identity lifecycle process and access-review procedure may collectively support it. The objective expresses the desired condition; the control describes how the condition is achieved and evidenced.

Controls should be assessed against several properties:

1. Design adequacy: whether the control, if performed as designed, addresses the risk.
2. Implementation: whether the control exists and is deployed in the relevant environment.
3. Operating effectiveness: whether it operates consistently over time.
4. Coverage: which systems, users, locations and information assets are included.
5. Evidence quality: whether reliable records demonstrate performance.
6. Residual risk: the risk remaining after the control is applied.

A control can be technically sophisticated yet ineffective if its scope is incomplete, exceptions are unmanaged or evidence is unavailable. Conversely, a simple manual control may be effective where the risk, transaction volume and operating environment permit it.

Control categories

Controls are also described as people, process and technology controls. Effective security normally requires all three. For example, phishing resistance may require trained employees, a reporting process and email protection technology.

2. The major frameworks and standards

ISO/IEC 27001: the ISMS requirements standard

ISO/IEC 27001 defines requirements for establishing, implementing, maintaining and continually improving an ISMS. It is risk-based and applies to organisations of different sizes and sectors. The organisation defines the ISMS scope, understands interested-party and legal requirements, assesses risks, selects treatment options, establishes objectives, monitors performance and conducts management review.

A central document is the Statement of Applicability (SoA). It records the controls selected, the justification for inclusion or exclusion, implementation status and relevant control references. Controls are not excluded merely because they are inconvenient; exclusion should be justified by the organisation’s risk and scope.

ISO/IEC 27001 certification is certification of the defined ISMS scope by an independent certification body. It is not a guarantee that every system is secure, nor does it mean that zero incidents can occur. Certification normally involves an initial review of documented arrangements and a more detailed assessment of implementation and effectiveness, followed by surveillance and recertification activities.

ISO/IEC 27002: control guidance

ISO/IEC 27002 provides guidance and reference controls for information security. It supports control design and implementation but is not, by itself, the certification standard. Its controls are organised around themes such as organisational, people, physical and technological security. Organisations should interpret the guidance in context rather than treating every recommendation as universally mandatory.

A control catalogue can be adapted by adding implementation guidance, responsible owners, systems in scope, evidence requirements, testing frequency and links to risks. This produces an operational control library rather than a static checklist.

ISO/IEC 27005: risk-management guidance

ISO/IEC 27005 supports information-security risk management. Its logic is iterative: establish context, assess risk, treat risk, communicate and consult, monitor and review, and record results. Risk assessment considers assets or business processes, threats, vulnerabilities, consequences and likelihood. Risk treatment can include modifying, retaining, avoiding or sharing risk.

A qualitative assessment may use categories such as low, medium and high. A quantitative assessment may estimate expected annual loss, but numerical precision should not be confused with certainty. A commonly used model is:

Here, ALE is annualised loss expectancy in currency per year, SLE is single-loss expectancy in currency per event, and ARO is the estimated annual rate of occurrence. The model assumes that loss magnitude and event frequency can be estimated consistently; it is unsuitable when estimates are unreliable or when risks are strongly interdependent. It should support, not replace, professional judgement.

NIST Cybersecurity Framework

The NIST CSF is a flexible framework for managing cybersecurity risk. Its widely used core functions are Identify, Protect, Detect, Respond and Recover. The framework also uses categories and subcategories to express outcomes. Organisations can create a Current Profile, describing present outcomes, and a Target Profile, describing desired outcomes. The gap between them supports prioritised improvement planning.

The CSF is outcome-oriented. It does not prescribe one product or one architecture. A small organisation may meet an outcome through a managed service, while a large enterprise may implement a complex internal capability.

NIST Risk Management Framework

NIST RMF provides a structured process for managing security and privacy risk in information systems. Its steps are commonly described as Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. The RMF links enterprise risk decisions with system-level controls and authorisation decisions.

The authorizing official accepts or rejects system risk on behalf of the organisation. The system security plan describes controls and implementation; assessment reports describe testing results and deficiencies; and plans of action and milestones track remediation. RMF is particularly influential in government and regulated environments, although its principles are applicable more broadly.

CIS Controls

CIS Controls are prioritised safeguards intended to reduce common cyber risk. They emphasise practical actions such as asset inventory, software inventory, data protection, secure configuration, account management, vulnerability management, audit logging, email and browser protections, malware defences, recovery and security awareness. Implementation Groups help organisations select a feasible starting point according to risk, resources and organisational complexity.

CIS Controls are useful for engineering teams because they translate broad security outcomes into actionable safeguards. They should nevertheless be integrated with governance, risk acceptance and legal requirements.

COBIT

COBIT is an enterprise governance and management framework for information and technology. It distinguishes governance—evaluating, directing and monitoring—from management—planning, building, operating and monitoring activities. COBIT helps boards and executives align technology objectives with enterprise goals, assign accountability and assess process capability.

COBIT is not primarily a catalogue of technical safeguards. It complements ISO, NIST and CIS by addressing decision rights, performance, assurance, accountability and alignment with business objectives.

3. Comparing and combining frameworks

These frameworks can be layered. COBIT can define governance and accountability; ISO/IEC 27001 can provide the ISMS; ISO/IEC 27005 can structure risk assessment; NIST CSF can communicate current and target outcomes; CIS Controls can help engineers implement priorities; and NIST RMF can support system authorisation. Mapping must preserve meaning. Similar words do not necessarily indicate equivalent requirements.

4. Control mapping and tailoring

Control mapping relates requirements or outcomes from one source to controls in another. Mapping reduces duplication and helps demonstrate coverage. A mapping statement should identify the source requirement, target control, implementation owner, evidence and any gap.

A useful mapping record includes:

Tailoring modifies control selection or implementation to reflect risk, mission, technology, legal obligations and available resources. It may involve selecting a subset, adding controls, defining parameters, assigning inheritance from shared services or specifying stronger implementation for high-impact assets.

Tailoring should follow a defensible sequence:

1. Define organisational and system scope.
2. Identify information, business processes and dependencies.
3. Determine legal, contractual and regulatory obligations.
4. Assess threats, vulnerabilities, impacts and likelihood.
5. Select baseline controls and identify additional safeguards.
6. Define implementation parameters and control owners.
7. Document rationale in the SoA, security plan or control register.
8. Validate through assessment, testing and management approval.
9. Monitor changes and retest after significant environmental change.

A control should not be removed simply because it is difficult. If it is not applicable, the organisation should explain why; if it is applicable but not implemented, it is a gap requiring treatment or formal risk acceptance.

5. The ISMS lifecycle

An ISMS is a management system, not a folder of policies. It operates as a continual cycle:

Figure: A simplified ISMS continual-improvement cycle.

The lifecycle begins with leadership commitment, scope and policy. Risk assessment then informs objectives and treatment. Controls are implemented with assigned responsibilities and resources. Performance is monitored through indicators, incidents, audit results and management reviews. Corrective actions address nonconformities, and lessons from incidents or business change feed the next cycle.

Important ISMS artefacts include the scope statement, information-security policy, risk methodology, risk register, risk-treatment plan, SoA, control procedures, competence records, incident records, audit programme, management-review records and corrective-action log.

6. Certification, assessment and evidence

Certification is an external conformity assessment against a specified standard and scope. Internal audits are management tools and should be independent of the activity being audited where practicable. A certification audit examines whether the ISMS is established and whether controls are implemented and effective within scope.

Evidence should be relevant, reliable, sufficient and protected against unauthorised alteration. Examples include access-review records, vulnerability reports, configuration baselines, training completion, backup restoration results, incident tickets, supplier assessments and meeting minutes. A policy alone demonstrates intent, not operating effectiveness.

Common audit findings include an undefined scope, inconsistent asset inventory, overdue access reviews, unsupported risk acceptance, incomplete supplier oversight, ineffective corrective action and controls that operate but generate no reliable evidence. Management should distinguish isolated incidents from systemic failures and address root causes rather than merely correcting an individual record.

7. Maturity and capability

A maturity model describes how consistently and effectively a process is performed. A simple five-level model is:

1. Initial: ad hoc and dependent on individuals.
2. Repeatable: some recurring practices exist but are inconsistent.
3. Defined: documented, standardised and communicated.
4. Measured: performance and effectiveness are monitored.
5. Optimised: practices continually improve using evidence and adaptation.

Maturity is not identical to compliance. A mature process may still have an unsuitable control objective, and a compliant organisation may satisfy documented requirements without strong operational resilience. Assessment should consider design, coverage, consistency, measurement and outcomes.

Useful indicators include the proportion of privileged accounts reviewed on time, mean time to remediate critical vulnerabilities, percentage of critical assets with tested recovery procedures, incident-reporting timeliness and closure of audit actions. Metrics require definitions, ownership, population, frequency and thresholds. A metric that rewards closing tickets without measuring risk reduction can create perverse incentives.

8. Applied case: Northbridge Health Services

Background. Northbridge Health Services, an illustrative regional healthcare provider, operates clinics, a patient portal and a cloud-hosted electronic health-record system. It wants ISO/IEC 27001 certification and must also satisfy contractual privacy requirements.

Problem. A preliminary review found incomplete asset inventories, excessive dormant accounts, inconsistent supplier assessments and backups that had not been restored in testing. Executives initially proposed implementing every control in a large catalogue.

Analysis. The security team defined the ISMS scope around patient-record processing, the portal, supporting identity services and critical suppliers. A risk assessment identified unauthorised disclosure, ransomware disruption, compromised supplier access and failure to recover clinical data as priority risks. Legal and contractual obligations were recorded as mandatory requirements, independent of estimated likelihood.

Approach. The team used ISO/IEC 27001 to establish governance and the SoA, ISO/IEC 27005 to document risk assessment and treatment, NIST CSF to create a current and target profile, and CIS Controls to prioritise technical work. COBIT practices helped clarify board oversight, management accountability and performance reporting. Controls were tailored: privileged access required stronger authentication and frequent review; suppliers handling patient data required contractual security clauses and evidence; recovery controls required scheduled restoration tests rather than merely successful backup jobs.

Outcome. Within six months, Northbridge had a reconciled asset inventory, automated joiner–mover–leaver workflows, quarterly privileged-access reviews, tested restoration procedures and a supplier-risk register. Internal audit identified two nonconformities: delayed review of one supplier and incomplete evidence for a training exception. Management assigned corrective actions and retained documented risk acceptance for a low-impact legacy application.

Learning points. The case demonstrates that frameworks should be combined by purpose, not treated as competing checklists. Scope determines the meaning of certification; risk determines prioritisation; control owners determine execution; and evidence determines whether implementation can be demonstrated.

9. Challenges, ethics and contemporary developments

Framework implementation faces several challenges. Organisations may create excessive documentation, confuse control presence with effectiveness, duplicate assessments, or select controls without understanding dependencies. Cloud and outsourced services complicate responsibility: the provider may operate infrastructure controls, but the customer remains responsible for configuration, identity, data classification and appropriate oversight. Shared responsibility must be documented contractually and technically.

Artificial intelligence introduces additional governance questions. AI systems may process confidential data, produce unreliable outputs, amplify bias or create new attack surfaces such as prompt injection and model-data leakage. An ISMS should identify AI assets and suppliers, classify data, restrict access, log significant use, validate outputs where consequences are material and define human accountability. AI should improve risk analysis only when its assumptions, data quality and limitations are understood.

Ethically, security controls should be proportionate and respectful of privacy. Monitoring employees or customers requires a legitimate purpose, transparency, access restrictions, retention limits and compliance with applicable law. Security teams should avoid discriminatory profiling and should provide channels for reporting mistakes or misuse. Risk acceptance is an accountable decision, not a means of concealing known harm.

Best practice is to begin with scope and business outcomes, maintain a single authoritative risk and control register, map controls carefully, assign accountable owners, automate evidence where appropriate, test recovery rather than assuming it, review suppliers and inherited controls, and use management review to fund remediation. Frameworks should be treated as decision-support instruments within governance, not as substitutes for judgement.

Chapter Summary

Security controls reduce information-security risk, while control objectives describe the conditions those safeguards must achieve. ISO/IEC 27001 establishes requirements for a certifiable ISMS; ISO/IEC 27002 provides control guidance; and ISO/IEC 27005 supports risk assessment and treatment. NIST CSF communicates cybersecurity outcomes through profiles and functions, while NIST RMF provides a system lifecycle linking categorisation, control selection, assessment and authorisation. CIS Controls prioritise practical safeguards, and COBIT addresses enterprise governance, accountability and performance.

Effective programmes map and tailor controls according to scope, risk, law, technology and organisational capability. They document rationale, assign owners, collect reliable evidence and measure effectiveness. Maturity models help organisations move from ad hoc practices toward measured and optimised processes, but maturity does not automatically equal security or compliance. An ISMS is a continual cycle of context, risk treatment, implementation, monitoring, audit, management review and improvement.

Key Terms

Control: A safeguard that modifies information-security risk.

Control objective: The intended result that a control or group of controls must achieve.

ISMS: A management system for establishing, operating and continually improving information security.

ISO/IEC 27001: Standard specifying requirements for an information-security management system.

ISO/IEC 27002: Guidance and reference controls for information security.

ISO/IEC 27005: Guidance for information-security risk management.

Statement of Applicability: Documented justification for selected, excluded and implemented controls.

NIST CSF: Framework for communicating and managing cybersecurity outcomes.

NIST RMF: Lifecycle process for managing system security and privacy risk.

CIS Controls: Prioritised safeguards for reducing common cyber risks.

COBIT: Framework for governance and management of enterprise information and technology.

Control mapping: Relating requirements or outcomes from one source to controls in another.

Tailoring: Adapting control selection or implementation to organisational context and risk.

Residual risk: Risk remaining after safeguards are applied.

Risk acceptance: A formally accountable decision to retain a specified risk.

Maturity: The degree to which a process is defined, consistently performed, measured and improved.

Authorizing official: Person accountable for accepting system risk in the NIST RMF.

Evidence: Reliable information demonstrating that a control exists and operates.

Review Questions

Short Answer Questions

1. What is the difference between a control and a control objective?
2. Why is ISO/IEC 27001 different from ISO/IEC 27002?
3. What is the purpose of a Statement of Applicability?
4. Name the five commonly used functions of the NIST CSF.
5. Why does a policy alone not prove operating effectiveness?

Long Answer Questions

1. Explain how ISO/IEC 27001, ISO/IEC 27005 and ISO/IEC 27002 can operate together in an ISMS.
2. Compare NIST CSF, NIST RMF, CIS Controls and COBIT in terms of purpose and users.
3. Describe a defensible process for mapping and tailoring controls.
4. Explain the ISMS continual-improvement lifecycle and the evidence required at major stages.
5. Discuss why certification does not guarantee that an organisation will never suffer a security incident.

Analytical / Application Questions

1. A college has limited resources, an online examination system and sensitive student records. Propose a tailored combination of ISO, NIST and CIS practices, explaining your priorities.
2. An organisation has complete security policies but recurring failed access reviews and untested backups. Analyse its likely maturity and recommend corrective actions.
3. A cloud supplier claims that its ISO/IEC 27001 certificate proves the customer needs no further assessment. Evaluate this claim and identify the customer’s remaining responsibilities.

Multiple Choice Questions with Answers

Question 1

Which standard specifies requirements for establishing and certifying an ISMS?

A. ISO/IEC 27001

B. ISO/IEC 27002

C. CIS Controls

D. COBIT

Correct Answer: A. ISO/IEC 27001

Question 2

What is the primary purpose of a Statement of Applicability?

A. To list all security incidents

B. To justify selected and excluded controls

C. To replace the risk register

D. To certify a cloud provider

Correct Answer: B. To justify selected and excluded controls

Question 3

Which NIST CSF function focuses on restoring capabilities after an incident?

A. Identify

B. Protect

C. Respond

D. Recover

Correct Answer: D. Recover

Question 4

Which framework is most directly focused on enterprise governance of information and technology?

A. COBIT

B. CIS Controls

C. NIST CSF

D. ISO/IEC 27005

Correct Answer: A. COBIT

Question 5

In the formula ALE = SLE × ARO, what does ARO represent?

A. Annual recovery expense

B. Annual rate of occurrence

C. Asset replacement outcome

D. Average risk exposure

Correct Answer: B. Annual rate of occurrence

Question 6

Which activity best demonstrates operating effectiveness?

A. Approving a security policy

B. Naming a control owner

C. Reviewing records showing the control operated consistently

D. Purchasing security software

Correct Answer: C. Reviewing records showing the control operated consistently

Question 7

What is the main purpose of control tailoring?

A. To remove all expensive controls

B. To adapt controls to context, risk and obligations

C. To ensure every framework has identical wording

D. To avoid management approval

Correct Answer: B. To adapt controls to context, risk and obligations

Question 8

Which NIST RMF step includes an explicit decision to accept system risk?

A. Authorize

B. Categorize

C. Prepare

D. Implement

Correct Answer: A. Authorize

Question 9

Which statement about ISO/IEC 27002 is correct?

A. It is primarily control implementation guidance

B. It is a mandatory law in all countries

C. It replaces organisational risk assessment

D. It certifies individual employees

Correct Answer: A. It is primarily control implementation guidance

Question 10

Which practice is most appropriate for validating recoverability of backups?

A. Checking that backup software is installed

B. Counting the number of backup policies

C. Performing and documenting restoration tests

D. Increasing password length

Correct Answer: C. Performing and documenting restoration tests