{"id":14221,"date":"2026-11-10T09:54:46","date_gmt":"2026-11-10T06:54:46","guid":{"rendered":"https:\/\/aboveit.fi\/?p=14221"},"modified":"2026-11-10T10:07:43","modified_gmt":"2026-11-10T07:07:43","slug":"microsoft-365-tutorial-video-passkey-in-microsoft-365-how-to-enable-it","status":"publish","type":"post","link":"https:\/\/aboveit.fi\/en\/microsoft-365-tutorial-video-passkey-in-microsoft-365-how-to-enable-it\/","title":{"rendered":"Managing information security with frameworks"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

When developing information security, organizations often run into the same questions right from the start: what exactly should we take into account, what should we do, and in what order? Different information security frameworks help prepare for this. They bring together best practices in a ready-made structure that an organization can use as the foundation for building its information security work.<\/em><\/p>

In this blog post, I go through the most common information security frameworks and explain why they are important for organizations, especially today.<\/em><\/p> \t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What is an information security framework? <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

An information security framework is a structured collection of requirements, controls, and practices that help an organization identify its risks, protect its most important information and systems, and demonstrate that its operations are adequate. Some frameworks are voluntary standards or recommendations, while others are based on legislation and are mandatory for organizations within their scope.<\/p>\n

A framework does not protect anything by itself, but it allows an organization to view information security as a managed whole. Without a framework to follow, information security work easily becomes a set of disconnected technical measures whose coverage or effectiveness is almost impossible to assess.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The most common information security frameworks <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

There are dozens of frameworks, and many of them overlap to some extent in content. From the perspective of a Finnish organization, the following are the most common.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
ISO\/IEC 27001<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

ISO 27001 is the world’s best-known information security standard. It defines the requirements for an Information Security Management System (ISMS) – that is, for how an organization leads, plans, implements, monitors, and continuously improves its information security. Today, Annex A of the standard contains 93 controls, divided into organizational, people, physical, and technological categories.<\/p>

For many organizations, ISO 27001 certification is the clearest way to demonstrate that information security is managed and implemented systematically. However, certification is not the only reason to use the standard, as its structure also works excellently as a framework without a formal audit.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
The Cybersecurity Act and the NIS2 Directive<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Cybersecurity Act entered into force in Finland in April 2025, incorporating the requirements of the EU’s NIS2 Directive into national legislation. Organizations within its scope must manage their cybersecurity risks, report significant incidents to the authorities, and ensure, for example, the security and continuity of their supply chain as well as staff training. Responsibility lies explicitly with the organization’s management.<\/p>

Even if an organization is not itself within the scope of the law, the requirements often trickle down the supply chain. A customer that falls under the law’s scope will typically also require evidence of an adequate level of information security from its suppliers.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
NIST Cybersecurity Framework (CSF 2.0)<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The cybersecurity framework developed by the US-based NIST is also widely used in Europe. Version 2.0, published in 2024, structures cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The framework’s strength lies in its clarity, helping organizations assess whether their information security work is balanced or overly focused on, for example, protection.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
CIS Controls<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

CIS Controls is a prioritized list of 18 security control categories based on real-world attacks. The Implementation Groups (IG1\u2013IG3) indicate where an organization should start, based on its size and resources. For SMEs, IG1 is a good baseline checklist: device and software inventory, access management, updates, backups, and security awareness. Unlike ISO 27001 or NIST CSF, CIS Controls is not an administrative information security framework. It does not describe how to manage information security, but rather what concrete protective measures should be implemented. That’s why it works best alongside an administrative framework, as support for practical implementation.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
GDPR<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The EU’s General Data Protection Regulation is not an information security framework as such, but it requires appropriate technical and organizational safeguards for the processing of personal data. In practice, data protection and information security go largely hand in hand. The same controls serve both.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Why are frameworks important for organizations? <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Many organizations find frameworks heavy and bureaucratic. I see it the other way around: a well-chosen framework saves time and money, because it helps direct resources to the right things.<\/p>

The benefits of a framework in a nutshell:<\/p>