A manufacturer wins a contract with a hospital chain, and the contract requires the manufacturer to be certified against a recognized information security standard. The security lead now has to choose: ISO/IEC 27001, which the customer named, or something lighter. She also has a separate problem the customer didn't mention: a European subsidiary processes personal data of EU residents, which brings its own legal duties. One organization, several different rulebooks.
Sorting out which rulebook applies, and how to prove the controls actually work, is the subject of this lesson. On the CompTIA Security+ SY0-801 exam this sits under objective 5.5, which lists frameworks and standards, and functional and behavioral testing, among audit and assessment concepts. This lesson covers industry-based, international and region-specific standards, the NIST Cybersecurity Framework as a widely used framework, and the difference between functional and behavioral testing. The governance documents that implement these inside an organization, policies, standards and procedures, are covered in the governance section.
A framework organizes a whole program; a standard sets requirements
The two words are used loosely in the field, but keeping them apart helps on the exam.
A framework is a high-level structure for organizing and improving a security program. It groups activities into categories and often supports maturity levels, but it usually doesn't hand you a certifiable checklist of controls. The NIST Cybersecurity Framework is the clearest example: it tells you what to organize your program around, not a pass-or-fail list.
A standard is a defined set of requirements an organization can be measured, and sometimes certified, against. PCI DSS and ISO/IEC 27001 are standards: each states specific requirements, and an assessor can judge conformance to them.
A regulation is a standard with the force of law, issued by a government and enforced with penalties. The important consequence is that you can choose whether to adopt a voluntary framework, but you do not get to choose whether a regulation applies to you. If you process the data it covers, in the place it covers, it binds you.
Organizations usually mix all three. A company might organize its program with the NIST CSF, certify its management system against ISO/IEC 27001, meet PCI DSS because it takes card payments, and comply with privacy regulations because of where its customers live. These overlap heavily, so work done for one often satisfies parts of another.
Industry-based standards apply to a specific sector or data type
Industry-based standards are written for a particular industry or a particular kind of data, by the bodies that govern that industry. They tend to be prescriptive and are often enforced by contract rather than by law.
The headline example is PCI DSS, the Payment Card Industry Data Security Standard. The major card brands created it, and it applies to any organization that stores, processes or transmits cardholder data. It is detailed and specific, covering network segmentation of the cardholder data environment, encryption of card data in transit and at rest, access control, logging and regular testing. PCI DSS is contractual: the penalty for failing it is fines passed down through the acquiring bank and, in the worst case, losing the ability to accept cards.
Other sectors have their own. In the United States, the electric utility sector follows the NERC CIP standards for the bulk power system, written by the industry's reliability organization and enforced by federal regulators. Healthcare's HIPAA Security Rule plays a similar role, though it is a federal regulation rather than an industry standard. The pattern is the same: requirements tailored to one industry or data type, and often mandatory for organizations in it.
On the exam, a scenario that names a specific industry or data type, cardholder data, health records, the power grid, is usually pointing you at the matching industry standard rather than at a general framework.