NIST CSF vs ISO 27001

NIST CSF vs ISO 27001: which one does a customer contract actually need?

When a customer or contract asks for NIST CSF or ISO 27001, the first thing to establish is that the two are not interchangeable. NIST CSF 2.0 has no certification: NIST does not certify or endorse CSF implementations and has no plans for a conformity assessment program. ISO/IEC 27001:2022 is certified by accredited certification bodies, which audit an organization's information security management system and issue a certificate if it passes. Any request for a 'NIST CSF certificate' should prompt a question about what the buyer actually expects to receive.

The right answer depends on the wording of the requirement. Read the clause in the contract or questionnaire and sort it into one of two cases. If it asks for a certificate or an accredited certification, the only route is ISO/IEC 27001 (or another scheme the buyer names), and the certificate must come from an accredited body. If it asks you to align with NIST CSF, show alignment, or describe your cybersecurity program using the CSF Functions, the buyer is asking for a self-declared or independently assessed statement that maps your controls to the CSF Subcategories. Many contracts ask for both, and some ask for ISO 27001 while using CSF language in their questionnaires. Check where the requirement sits: the CSF Subcategory GV.OC-03 is where legal, regulatory and contractual requirements are tracked in the framework, so it is a useful place to record exactly what the contract asks for.

Once the case is clear, confirm three things with the buyer in writing: whether a certificate or an alignment statement is accepted, which scope the evidence must cover, and who may issue the assurance. For ISO 27001, ask which certification body they recognize and whether they expect a current certificate or a transition status. For NIST CSF, ask whether they want a self-assessment, a Current Profile with gap analysis, or an independent review. NIST's own cross-reference lists ISO/IEC 27001:2022 as an informative reference to the CSF, so an existing ISO 27001 management system can support much of a CSF statement, but that mapping is not a certificate and it does not cover every Subcategory equally. Treat the overlap as a way to reuse evidence, and confirm with the buyer whether reused evidence is enough for their assessors.

How the two frameworks differ on the points buyers check

This table compares NIST CSF 2.0 and ISO/IEC 27001:2022 on ownership, certification, formal results, structure and revision status. Read it as a list of questions a contract or customer review is likely to ask, then check which answer your customer actually expects.

Point buyers check	NIST CSF 2.0	ISO/IEC 27001:2022
Type of document	Voluntary outcome framework with no required controls or implementation steps	Certifiable management system standard with requirements and an Annex A reference set of controls
Certification available	No. NIST does not certify or endorse CSF implementations and has no plans for a conformity assessment program	Yes. Accredited certification bodies assess and certify conformance
Who issues a formal result	No formal NIST result exists. Any assessment is the organization's own or one it commissions from an independent party	Accredited certification bodies issue the certificate after audit
Structure and counts	6 Functions, 22 Categories and 106 Subcategories describing outcomes	93 Annex A controls grouped in four clauses, down from 114 controls in 14 clauses in the 2013 edition
Revision status	CSWP 29 published February 26, 2024 as the 2.0 update to Version 1.1 (April 16, 2018). No revision of the Core since	ISO/IEC 27001:2022 published October 25, 2022. The IAF transition for 2013 certifications ended October 31, 2025
Role of Profiles and Tiers	Current and Target Organizational Profiles and four Tiers describe maturity and priorities. They are not a certification scope	Scope of the certified Information Security Management System is defined by the organization and stated on the certificate
Formal mapping between them	NIST publishes informative references, including ISO/IEC 27001:2022, in its online catalog	Mapped by NIST, with 99 of 106 CSF Subcategories linked to at least one Annex A control in the Reference Tool export
Where a customer requirement is tracked	Under GV.OC-03, for legal, regulatory and contractual requirements	Under the management system scope and the certification requirements the customer names in the contract

What NIST's official ISO 27001 mapping does and does not prove

NIST's official mapping is a cross-reference, not a finding of equivalence. NIST posted the final ISO/IEC 27001:2022 to CSF 2.0 informative reference mapping in its Online Informative References (OLIR) catalog on May 30, 2025. In NIST's Reference Tool export, 99 of the 106 CSF 2.0 Subcategories map to at least one Annex A control, and each of the 93 Annex A controls maps to at least one Subcategory. That coverage tells you where the two documents address the same ground. It does not tell you that passing one assessment satisfies the other, and it does not tell you that the controls behind each mapped line are implemented the same way.

The mapping is also narrower in what it guarantees than its tidy look suggests. NIST notes that informative references are developed by NIST and non-NIST entities, that it does not check the correctness of non-NIST mappings, and that listing a mapping does not imply endorsement. Governance outcomes show this clearly. In the Reference Tool's ISO/IEC 27001:2022 references, GV.RM-01 maps to clauses 6.1.1 and 6.1.2, and ID.IM-01 maps to clauses 9.2, 10.1 and 10.2. These are management system clauses about risk processes, internal audit, nonconformity and improvement, which an ISO auditor tests as part of the management system rather than as Annex A controls. An illustrative reader might find that a CSF improvement program has no documented internal audit cycle behind it, and the mapping would not reveal that gap.

Before you rely on the mapping in a customer or board discussion, run three checks. First, open the OLIR entries for the Subcategories your contract depends on, such as GV.OC-03, where legal, regulatory and contractual requirements are tracked, and confirm the mapped ISO references match the control wording in your own copy of ISO/IEC 27001:2022. Second, record which mapping you used and its date, since NIST's updates archive shows mappings are added over time. Third, keep certification claims separate from alignment claims. For the mechanics of the mapping itself, the next read is the NIST Informative References page.

Which path fits: CSF alignment, ISO certification or both

An organization that adopts NIST CSF 2.0 by choice, with no customer or regulator asking for proof, owns the whole program. NIST describes the CSF as voluntary guidance and states that it does not certify or endorse implementations or services, and it has no plans for a conformity assessment program. The organization therefore decides its Organizational Profiles, target Tiers and the evidence it keeps. Its outputs are internal: a Current Profile, a gap analysis against a Target Profile and an action plan that leaders can review. No outside body issues a CSF certificate, so any independent review is a voluntary assessment the organization commissions for its own assurance.

What the organization owns: the Profiles, the Tier choice, risk decisions and the policies that Govern expects.
What it can show: a dated Current Profile, Subcategory-level status notes and a prioritized roadmap tied to the Function outcomes.
What needs an independent body: nothing is required. An independent assessment is optional and produces an opinion or report, not a NIST certificate.
What to watch: the vendor or consultant who offers a "NIST CSF certification" is describing a service, not a recognized certificate from NIST.

Before engaging anyone, confirm with the requesting party exactly what evidence they expect, since a voluntary program can end at an internal Profile.

What changes the effort when you run both

Running NIST CSF 2.0 and ISO/IEC 27001:2022 together is mostly a question of how much of each program can be shared. The factors below decide whether one body of evidence serves both frameworks or whether the work splits into two parallel efforts.

Scope of systems

The ISO/IEC 27001 scope is a defined boundary of the information security management system, while a CSF Organizational Profile can cover the whole enterprise or a single business unit. If the two boundaries differ, the same server may sit inside one assessment and outside the other. Before any mapping work starts, write down which systems, locations and services each framework covers, and record every place where those lists disagree.

Certificate scope coverage

An existing ISO/IEC 27001 certificate covers only the systems inside its certified scope, so CSF outcomes for systems outside that scope need separate evidence. Ask the certification body or your internal audit team which controls were sampled in the last surveillance audit. Those sampled controls are the strongest starting point for CSF evidence, and the unsampled areas show where the CSF work will need new collection.

Governance and management system clauses

Most CSF Govern outcomes correspond to the management system clauses of ISO/IEC 27001, such as context, risk assessment, leadership commitment and performance evaluation. NIST's Reference Tool maps GV.RM-01 to clauses 6.1.1 and 6.1.2, and ID.IM-01 to clauses 9.2, 10.1 and 10.2. Because the policy, objectives and review cycle are often the same documents, one governance record can answer both frameworks. Confirm that each mapped clause has an owner-approved document behind it.

Shared evidence store

Both frameworks depend on the same kinds of evidence, including access reviews, vulnerability scan results, backup restore tests and incident records. Store each artifact once with a control or outcome identifier from each framework, instead of collecting it twice for two audiences. Decide where the repository lives, who can edit it and how long records are retained, and confirm that the auditor accepts an evidence location outside the certification body's own tools.

Ownership of the risk register

ISO/IEC 27001 requires a documented risk assessment and risk treatment process, and CSF GV.RM and ID.RA describe risk management strategy and risk assessment. When both frameworks draw from one register, someone must own its content, scoring method and approval. Name a single accountable owner, usually in the security or risk function, and confirm whether the board or a risk committee signs off on accepted risks. Two registers with different scoring scales are a common source of conflicting findings.

Review cadence of each framework

ISO/IEC 27001 is maintained through an internal audit program, a management review and periodic surveillance audits by the certification body. A CSF profile is updated whenever the organization decides, and NIST does not set a review schedule. Agree on one combined review calendar so that profile updates, management reviews and internal audits feed the same findings log. Note which activities the certification body will expect to see in its next visit.

Questions buyers ask before choosing one or both

Can NIST CSF 2.0 be certified?

No. NIST CSF 2.0 is voluntary guidance, and NIST does not certify or endorse CSF implementations, products or services. It has also said it has no plans to develop a conformity assessment program. Any organization that claims a NIST CSF "certification" is using the word loosely. What an organization can do is assess its program against the CSF Core, record a Current Profile and show the gap to a Target Profile. An independent assessor can test that work and write a report, but that report is an assessment, not a NIST certificate. Ask any provider to name the document they will issue and who issues it.

Does an ISO 27001 certificate satisfy a customer's NIST CSF request?

Not automatically. An ISO/IEC 27001 certificate is issued by an accredited certification body after an audit of an information security management system, and it covers the scope the certification body accepted. A customer asking for NIST CSF 2.0 alignment is asking for evidence against the CSF Core outcomes. The certificate can be strong supporting evidence, especially where NIST's mapping links Subcategories to Annex A controls. Still, the customer may need a Current Profile, a view of the outcomes outside the ISO scope, and an explanation of how the certificate's scope maps to the organization's systems. Read the contract clause, then agree in writing which evidence counts.

What does the work need from internal staff?

Internal staff own the decisions and the evidence, whichever framework or partner is involved. Expect time from the people who run identity, asset inventory, incident response, supplier management and HR, because the CSF Govern outcomes depend on leadership and policy decisions that only the organization can make. Someone must own the Organizational Profile, approve risk tolerance and sign off on the Target Profile. For ISO 27001, the same people usually provide the management review, internal audit and risk treatment records. The effort depends on scope, number of systems and how many policies already exist. Ask any partner to list which tasks require named internal owners before work starts.

Can the NIST to ISO mapping be used as an audit shortcut?

No. NIST's informative references are a reading aid, and NIST does not check the correctness of non-NIST mappings or imply endorsement by listing one. The ISO/IEC 27001:2022 mapping in NIST's Online Informative References catalog was posted on May 30, 2025. In the Reference Tool export, 99 of the 106 CSF 2.0 Subcategories map to at least one Annex A control, and each of the 93 Annex A controls maps to at least one Subcategory. These links show where related work sits, but they do not reduce the audit. An ISO certification body tests the management system against the standard's requirements and its own sampling method. Use the mapping to plan evidence reuse, then have the auditor confirm what it accepts.

How are the two frameworks revised, and what happens to existing work?

The two frameworks follow different revision paths. NIST published CSF 2.0 on February 26, 2024, succeeding Version 1.1 of April 16, 2018. Its Core has had no revision since, but NIST publishes Quick-Start Guides, Community Profiles and informative reference mappings online and updates them more often. ISO/IEC 27001:2022 was published on October 25, 2022. Certification bodies moved accredited certificates from the 2013 edition under IAF MD 26, with the three-year transition ending on October 31, 2025. Ask your certification body and your evidence owners to track both sources, since online mappings can change while the core documents do not.

What does an implementation partner do, and what does it not do?

An implementation partner prepares systems, controls and evidence. DeployOpen, for example, plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and prepares evidence for assessments. It does not own the controls, decide risk tolerance or issue audit reports, attestations or certifications. Those belong to the organization and to an independent auditor or certification body. Engagements are typically fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ask any partner to state in the statement of work which outputs it produces and which the organization or an independent assessor must sign.

Is a self-assessment enough for a NIST CSF request?

It depends on what the requester asked for. NIST describes self-assessment as a way to measure a program against the CSF, and it provides free resources to support that work. A self-assessment is often sufficient for internal planning and for an initial answer to a customer questionnaire. A customer that needs independent confidence may ask for a third-party assessment, which an independent assessor performs and reports on. An ISO 27001 request is different, because only an accredited certification body can issue the certificate. Confirm in writing whether the customer accepts an internal Current Profile, an independent review, or an ISO certificate, and what sampling or independence it expects.

What drives the cost of running both frameworks?

The main cost is internal and external effort, because NIST CSF 2.0 has no certification fee and NIST's materials are free. For ISO 27001, the certification body is paid for the audit, and the organization pays for its internal audit, management review and any partner work. Costs rise with the number of in-scope systems, the number of sites, the maturity of existing policies and the number of Subcategories in the target profile. Costs can fall when one evidence set serves both frameworks. Ask each provider for a quote that separates one-time setup from recurring audit, monitoring and reporting work.

How to choose a partner for CSF and ISO readiness

Readiness support for NIST CSF 2.0 and ISO/IEC 27001 touches the same systems and evidence, so one partner can prepare both. The checks below separate who prepares your evidence from who judges it. Only accredited certification bodies issue ISO certificates, and no partner can guarantee the result.

Confirm the certification body is accredited

Only an accredited certification body can issue an ISO/IEC 27001 certificate, and the accreditation must cover the scope you need. Ask the body for its accreditation certificate and check it against the accreditation body's public register before you sign anything. NIST does not certify CSF implementations, so a CSF report from any provider is a self-assessment or independent assessment, not a certificate. Ask every provider which of these two things they are offering.

Keep the auditor independent of the partner

The firm that prepares your systems and evidence should not also perform the audit or assessment of the same scope. Ask whether the partner has any role in the certification body or assessor you plan to use, and whether any staff move between the two. Independence protects the credibility of the report your customers and regulators will read.

Check experience with both frameworks

Ask for examples of CSF 2.0 Profiles and ISO/IEC 27001:2022 Annex A evidence delivered in the same program, described without client names. Good work maps the CSF Subcategories to your ISO controls and to the informative reference mappings NIST publishes, so one set of evidence serves both. Be wary of a partner who only knows one framework or who cannot explain where the two differ.

Require a written fixed scope

A written scope should name the business units, systems, locations and suppliers covered, the Functions or Annex A controls in play, the deliverables and the dates. Most engagements are fixed-scope, so ask what changes the price or timeline, and how scope changes are approved. A vague scope usually produces vague evidence, and the cost of rework lands on your team.

Agree what evidence you receive

Ask for a list of the artifacts you will own at the end: policies, the statement of applicability, risk register, asset inventory, configuration baselines, access reviews, test reports and the CSF Current Profile. Confirm that you hold the source files and that they live in your environment, not only in the partner's tools. Evidence you cannot export or reproduce will be hard to defend at audit or at a customer review.

Ask these questions before signing

Ask who will do the work, whether the accredited body or assessor has been named, how the partner handles findings that fall outside scope, and what happens if the audit does not pass. Ask the partner to state in writing that it does not guarantee certification or an assessment outcome. Keep these answers in the contract file alongside the written scope.

How DeployOpen prepares systems and evidence for both frameworks

DeployOpen works on NIST CSF vs ISO 27001 as an implementation partner. We prepare the systems, controls and evidence inside your own infrastructure, while your organization owns its controls and an independent auditor or certification body issues any report or certificate.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope states which CSF Functions or ISO/IEC 27001:2022 Annex A controls the work covers, and which are excluded.
Scope also records which systems, cloud accounts or networks hold the evidence, and who on your side owns each control.

How we build

We deploy and configure self-hosted open-source platforms inside your cloud accounts, data centers or air-gapped networks.
Controls are mapped to shared evidence sources so one log, inventory or policy can support both frameworks where it applies.
Security testing of the built systems runs alongside configuration, so gaps are found before the assessor arrives.

How we hand over

You receive documentation of configurations, control records, evidence locations and the mapping we used.
Evidence is organized so your auditor or assessor can trace each claim to a system output or a dated record.
Your staff are trained to operate, review and refresh the evidence once the engagement closes.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers keep the evidence current as your environment changes and as you prepare for a later assessment.
Confirm with us in writing which support terms and assessment preparation tasks sit inside your quoted scope.