When developing information security, organizations often run into the same questions right from the start: what exactly should we take into account, what should we do, and in what order? Different information security frameworks help prepare for this. They bring together best practices in a ready-made structure that an organization can use as the foundation for building its information security work.
In this blog post, I go through the most common information security frameworks and explain why they are important for organizations, especially today.
What is an information security framework?
An information security framework is a structured collection of requirements, controls, and practices that help an organization identify its risks, protect its most important information and systems, and demonstrate that its operations are adequate. Some frameworks are voluntary standards or recommendations, while others are based on legislation and are mandatory for organizations within their scope.
A framework does not protect anything by itself, but it allows an organization to view information security as a managed whole. Without a framework to follow, information security work easily becomes a set of disconnected technical measures whose coverage or effectiveness is almost impossible to assess.
The most common information security frameworks
There are dozens of frameworks, and many of them overlap to some extent in content. From the perspective of a Finnish organization, the following are the most common.
ISO/IEC 27001
ISO 27001 is the world’s best-known information security standard. It defines the requirements for an Information Security Management System (ISMS) – that is, for how an organization leads, plans, implements, monitors, and continuously improves its information security. Today, Annex A of the standard contains 93 controls, divided into organizational, people, physical, and technological categories.
For many organizations, ISO 27001 certification is the clearest way to demonstrate that information security is managed and implemented systematically. However, certification is not the only reason to use the standard, as its structure also works excellently as a framework without a formal audit.
The Cybersecurity Act and the NIS2 Directive
The Cybersecurity Act entered into force in Finland in April 2025, incorporating the requirements of the EU’s NIS2 Directive into national legislation. Organizations within its scope must manage their cybersecurity risks, report significant incidents to the authorities, and ensure, for example, the security and continuity of their supply chain as well as staff training. Responsibility lies explicitly with the organization’s management.
Even if an organization is not itself within the scope of the law, the requirements often trickle down the supply chain. A customer that falls under the law’s scope will typically also require evidence of an adequate level of information security from its suppliers.
NIST Cybersecurity Framework (CSF 2.0)
The cybersecurity framework developed by the US-based NIST is also widely used in Europe. Version 2.0, published in 2024, structures cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The framework’s strength lies in its clarity, helping organizations assess whether their information security work is balanced or overly focused on, for example, protection.
CIS Controls
CIS Controls is a prioritized list of 18 security control categories based on real-world attacks. The Implementation Groups (IG1–IG3) indicate where an organization should start, based on its size and resources. For SMEs, IG1 is a good baseline checklist: device and software inventory, access management, updates, backups, and security awareness. Unlike ISO 27001 or NIST CSF, CIS Controls is not an administrative information security framework. It does not describe how to manage information security, but rather what concrete protective measures should be implemented. That’s why it works best alongside an administrative framework, as support for practical implementation.
GDPR
The EU’s General Data Protection Regulation is not an information security framework as such, but it requires appropriate technical and organizational safeguards for the processing of personal data. In practice, data protection and information security go largely hand in hand. The same controls serve both.
Why are frameworks important for organizations?
Many organizations find frameworks heavy and bureaucratic. I see it the other way around: a well-chosen framework saves time and money, because it helps direct resources to the right things.
The benefits of a framework in a nutshell:
- A comprehensive view of risks. A framework helps identify blind spots that individual technical solutions cannot reveal on their own.
- Prioritization. Not everything needs to be done at once. A framework helps distinguish critical matters from those that can wait for a later review.
- Clear responsibilities. When tasks and owners are defined, information security doesn’t rest on the shoulders of a single person.
- Demonstrating compliance. Customers, partners, insurance companies, and authorities are increasingly asking for evidence of an organization’s level of information security. Documented, framework-based operations answer these questions.
- Manageability for leadership. A framework gives management the understanding and metrics needed to monitor information security as part of overall business risk management. Ultimately, the organization’s management is always responsible for information security.
- Continuous improvement. Information security is not a project that gets finished within a set time. Developing and maintaining information security is an ongoing process.
Digiturvamalli as an ISMS system
Choosing a framework is just the beginning. The biggest challenge is turning requirements into practical action and keeping information security work up to date year after year. Documentation scattered across spreadsheets and folders quickly becomes outdated, and no one may even know which version is actually valid. To meet these needs, information security management systems – ISMS tools – have been developed.
One example, used by us and our customers, is Digiturvamalli, an information security management system delivered as a SaaS service. Digiturvamalli’s requirement library includes more than 80 requirement frameworks, including ISO 27001, NIS2 and the Cybersecurity Act, GDPR, NIST CSF, CIS Controls, the Information Management Act, and Julkri. The organization selects the frameworks relevant to it, and Digiturvamalli breaks down their requirements into concrete tasks, instructions, and work items.
Summary
Information security frameworks describe what information security should include, and make it possible to demonstrate your own organization’s level of information security. ISO 27001, the Cybersecurity Act, NIST CSF, CIS Controls, and other frameworks do not compete with each other – they complement one another. What matters is choosing the framework or frameworks suited to your organization and embedding the requirements into everyday operations.
Not sure which framework would suit your organization, or how to even get started? Let’s have a quick chat and take a look at your situation together. Book a time that suits you in my calendar!
Mika Hakkarainen
CTO, co-founder & consigliere
Mika Hakkarainen is Above IT’s CTO, co-founder, and IT management advisor. He has nearly 30 years of experience in the IT industry across various organizations in Finland and abroad. Mika helps customers improve both technical and administrative information security.
