Which cybersecurity control framework should you choose when no regulator dictates one?
If no regulator names a framework, pick the one that matches the proof you need to produce. For an outcome-based program with no certificate, NIST CSF 2.0 is the usual starting point: it has six Functions, including the Govern Function added in 2.0, and NIST states that it offers no certifications or conformity assessment, so you will never hold a badge from it. For a prioritized start with a small team, the CIS Controls v8.1 organize 153 Safeguards into Implementation Groups, with IG1 at 56 Safeguards as the essential cyber hygiene baseline. The CIS Controls content is free for your own use under its license, but commercial use needs CIS's prior approval, so check that before building paid services on it. Choose ISO/IEC 27001:2022 when customers or auditors ask for a certificate. Only an accredited certification body can issue it, and it expects a documented management system with an Annex A control set of 93 controls, so budget for the management system work, not just the controls. Choose NIST SP 800-53 Rev. 5 when you need federal-style control depth; its catalog is large, so confirm with your assessors which baseline applies. Choose the Essential Eight for Australian government-aligned work, since it is a set of mitigations assessed against a maturity model, with no certificate.
Doing two frameworks together makes sense when one supplies the structure and the other supplies the proof. A common pairing is CSF 2.0 as the management structure with the CIS Controls as the prioritized control list, since the CIS Navigator maps v8.1 to NIST CSF 2.0. Adding ISO 27001 later is reasonable when a customer demands a certificate, because the mappings let you reuse much of the evidence. Pairing two heavy catalogs at once, such as SP 800-53 and ISO 27001 in a small team, usually multiplies documentation without adding security. Treat any mapping as a starting point: NIST does not verify non-NIST mappings and ENISA notes that its mappings do not measure equivalence, so have your assessor confirm which evidence counts for each requirement.
How the five control frameworks differ on structure, licensing and proof
This table compares NIST CSF 2.0, CIS Controls v8.1, ISO/IEC 27001:2022, NIST SP 800-53 Rev. 5 and the Essential Eight on structure, prescriptiveness, the proof each produces, licensing and size fit. Read each row as a question to answer for your own program: the framework you pick should match the evidence your customers, auditors or board will ask you to show.
| Dimension | What it looks like | Proof it produces | Licensing and access |
|---|---|---|---|
| NIST CSF 2.0 structure | Six Functions (Govern, Identify, Protect, Detect, Respond, Recover), 22 Categories and 106 Subcategories in the Core, plus Tiers and Profiles | No certificate. NIST does not offer certification or a conformity assessment program | Public from NIST at no charge; mappings to other standards are published online |
| CIS Controls v8.1 structure | 18 Controls and 153 Safeguards, with Implementation Groups IG1 (56), IG2 (130 in total) and IG3 (all 153) | No certificate. CIS says the Controls do not replace any regulatory or compliance scheme | CC BY-NC-ND 4.0; commercial use needs CIS's prior approval, though free for internal improvement |
| ISO/IEC 27001:2022 structure | Management system clauses plus Annex A, which is normative and lists 93 controls in four themes | Third-party certificate issued by an accredited certification body after audit, renewed on a three-year cycle | Standard sold by ISO (the English PDF or ePub is listed at CHF 155); certification fees go to the certification body |
| NIST SP 800-53 Rev. 5 structure | 20 control families, 324 base controls (300 not withdrawn) and 872 control enhancements (714 not withdrawn) in release 5.2.0 | No certificate. Evidence is produced for federal authorization or chosen assessment | Public from NIST; catalog is available in machine-readable OSCAL form |
| Essential Eight structure | A set of mitigation strategies scored against a maturity model, with each strategy assessed for implementation and effectiveness | No ASD certificate. Maturity is evidenced through assessment against the model | Published by ASD on cyber.gov.au for public use |
| Prescriptiveness | CSF and Essential Eight describe outcomes or mitigations; CIS names specific Safeguards; ISO and SP 800-53 define controls with assessable attributes | Assessors look for the specific control or Safeguard in CIS and ISO, and for demonstrable outcomes in CSF and the Essential Eight | Confirm with your assessor which level of specificity they will test against before you write policies |
| Size fit | CIS IG1 (56 Safeguards) is the stated minimum for every enterprise; CSF 2.0 applies regardless of size; ISO and SP 800-53 assume a formal program | Small teams often start with IG1; regulated enterprises usually run ISO or SP 800-53 with CSF as a common language | Ask which Implementation Group or control scope your customers expect |
What each framework is built to do, and what it cannot prove
NIST CSF 2.0 is an outcome framework, not a certification. It organizes security work into six Functions (Govern, Identify, Protect, Detect, Respond and Recover), 22 Categories and 106 Subcategories in the Core, and NIST states that it does not offer certifications or endorsements and has no plans for a conformity assessment program. Version 2.0, published as NIST CSWP 29 on February 26, 2024, added the Govern Function to the five used before and widened the audience from critical infrastructure to all organizations, regardless of size, sector or maturity. Its Organizational Profiles (Current and Target) and four Tiers (Partial, Risk Informed, Repeatable and Adaptive) show where you are and where you want to be, but they produce an internal record, not external proof. If a customer asks for evidence, you will need an assessor's report or a certificate from another framework.
CIS Controls prioritizes work, and its Safeguards are the unit of measure. The v8.1 set contains 153 Safeguards in 18 Controls, grouped into Implementation Groups: IG1 (56 Safeguards) is essential cyber hygiene, IG2 brings the total to 130, and IG3 covers all 153. CIS says the Controls do not replace any regulatory, compliance or authorization scheme, so treat them as a prioritized engineering baseline rather than a substitute for an audit. ISO/IEC 27001 is the only framework here that a certification body can certify. Its Annex A lists 93 controls, and an accredited certification body audits your management system on a three-year cycle with at least one audit each calendar year. The certificate proves that an accredited body examined your system at a point in time, which is a different claim from proving each control works continuously.
NIST SP 800-53 is a control catalog that federal authorization draws on, and the Essential Eight is a set of mitigations. SP 800-53 Release 5.2.0 contains 20 control families, 324 base controls and 872 control enhancements; it becomes binding through authorization processes for federal systems rather than through a certificate you can hang on a wall. The Essential Eight has no ASD certificate. Maturity is evidenced by assessing how each strategy is implemented and how effective it is against the maturity model, so the proof is an assessment record. Before you commit, confirm with your own assessor which evidence format your customers, regulators or insurers accept, because none of these frameworks produces the same kind of proof.
Where the work overlaps across these frameworks
The frameworks in this comparison cover much of the same ground, so one set of controls can often serve several of them. Published mappings show where that overlap is, but they are starting points that your team has to test against its own systems, not proof that one framework satisfies another.
CIS Navigator mappings
The CIS Controls Navigator for v8.1 offers CIS mappings to 30 frameworks and versions, including NIST CSF 2.0, NIST SP 800-53 Rev. 5, ISO/IEC 27001:2022 and SOC 2. This helps when you already run CIS Safeguards and need to show where each one lands in another framework. Check that the mapping version matches the framework edition your auditor or regulator uses, since a Rev. 5 mapping does not cover a Rev. 4 requirement.
NIST CSF 2.0 reference tool
NIST's CSF 2.0 Reference Tool export lists 363 Implementation Examples and informative references to standards including SP 800-53 Rev. 5.2.0, ISO/IEC 27001:2022, SP 800-171 Rev. 3 and CIS Controls v8.1. The Implementation Examples give concrete actions for each Subcategory, which helps teams turn outcomes into tasks. Confirm which reference version your evidence set uses before you map a control to a Subcategory.
Non-NIST mappings are unverified
NIST notes that it does not check the correctness of non-NIST mappings and that listing a mapping does not imply endorsement. Mappings to CIS, ISO or commercial frameworks may be authored by those bodies or by third parties, so their accuracy depends on their authors. Before you cite one in an audit or customer response, have someone on your team read the mapped control text and confirm the evidence actually satisfies it.
Mappings are not equivalence
ENISA states that its mapping between standards is not a measure of equivalence and does not assess whether a standard fully covers a regulation's requirements. A control that maps to a regulatory article may cover only part of that article. Treat mappings as a guide to where evidence can be reused, and document the gaps you find for each regulator or assessor.
Shared controls, separate proof
A single control, such as multifactor authentication for administrative access, can appear in CSF, CIS, ISO 27001 and SP 800-53 at once. The evidence you collect can often be reused, but each framework produces different proof: an ISO certificate, a SOC 2 report, or a CSF self-assessment with no certification. Ask each assessor which artifacts they accept and what period they cover before you reuse one screenshot or log extract across all of them.
Map before you build
Start from the framework your customers, regulator or assessor will check, then map the other frameworks onto that baseline. This avoids a common failure where teams build separate control sets for each framework and maintain them in parallel. Confirm the baseline choice with the people who will receive the evidence, since a mapping built around the wrong baseline creates rework at audit time.
Who assesses each framework and what the output is
This table shows who assesses each framework, what the result looks like and how often it repeats. Read it to separate frameworks that end in a third-party certificate from those that end in an internal attestation, a federal authorization or no formal output at all.
| Framework | Who assesses | What is issued | Cycle |
|---|---|---|---|
| NIST CSF 2.0 | Your own team or a consultant you engage; NIST runs no conformity assessment program | No certificate. Outputs are your Organizational Profiles and tier decisions, which you document yourself | Set by you. NIST does not define a recertification cycle |
| ISO/IEC 27001:2022 | Accredited ISMS certification bodies, auditing to ISO/IEC 17021-1 and 27006-1 (not ISO itself) | Third-party certificate of conformity to the ISMS requirements, issued by the certification body | Three-year certification cycle with at least one audit in every calendar year |
| CIS Controls v8.1 | CIS Controls Accreditation (run with CREST) accredits service providers that deliver CIS Controls work, not your organization | No organizational certificate. Accredited providers receive accreditation; your program is evidenced through your own assessment | Set by you. CIS publishes assessment guidance per Safeguard in the CIS Controls Assessment Specification |
| NIST SP 800-53 Rev. 5 | Assessed inside federal authorization processes by agency assessors or the parties they designate | Authorization decisions and assessment evidence for a system, not a public certificate for an organization | Set by the authorizing agency and the system's authorization lifecycle |
| Essential Eight (ASD) | Assessors evaluate each strategy's implementation and effectiveness against the maturity model | No ASD certificate. Maturity is evidenced through assessment results you can show customers, auditors or regulators | Set by your assessment plan and the regulator or customer requesting it |
| DeployOpen | Not an assessor. DeployOpen prepares systems, controls and evidence for your assessment | No audit report, attestation or certification. Deliverables are documented controls, evidence packs and implementation records | Fixed scope agreed in writing before work starts, with ongoing support available as a retainer |
In what order should a team adopt these frameworks?
This sequence gives a team with no existing program a practical path: choose an operating model, fix the highest-priority controls first, map the evidence once, and add certification only when a customer or contract requires it.
Choose the operating model first
Decide whether the team will use the CSF 2.0 Core as the common language for governance and reporting, the CIS Safeguards as a prioritized backlog of technical work, or both. The CSF 2.0 Core is organized into six Functions, including Govern, which NIST added in CSF 2.0. The CIS Controls contain 153 Safeguards, and each one carries a security function mapping, so the two can be used together. The security lead, with the CIO or CISO, records the choice in a short written decision note. The step is done when leadership signs off on which framework sets the vocabulary and which sets the work queue.
Implement the IG1 Safeguards first
Start the technical backlog with the Implementation Group 1 Safeguards. CIS defines IG1 as essential cyber hygiene and a minimum standard for every enterprise, and it contains 56 Safeguards. Engineering and IT operations own the work, with a named owner for each Safeguard. Confirm each item against the CIS Controls Assessment Specification, which states what to measure for each Safeguard, so that every item has a defined check. The step is done when every IG1 Safeguard is either implemented with evidence or has a documented exception and a plan owner.
Build one control inventory and evidence store
Consolidate the work into a single inventory that lists each control, its owner, its implementation status and the evidence that proves it, such as configuration exports, tickets, logs or policy records. Keep one copy of each artifact and reference it from the inventory rather than copying it into separate frameworks. Compliance and security engineering share ownership. The step is done when a reviewer can trace any control to its current evidence without asking the owner.
Map evidence through published mappings
Use the published mappings to show how the same inventory satisfies other frameworks. The CIS Controls Navigator for v8.1 offers mappings to 30 frameworks and versions, including NIST CSF 2.0, NIST SP 800-53 Rev. 5 and ISO/IEC 27001:2022. NIST's CSF 2.0 Reference Tool lists informative references to SP 800-53 Rev. 5.2.0, ISO/IEC 27001:2022 and CIS Controls v8.1. Treat these as starting points: NIST does not check the correctness of non-NIST mappings, and listing a mapping does not imply endorsement. The step is done when each mapping row has been checked against the framework's own text by someone who owns that framework's obligations.
Extend to IG2 and IG3 by risk
Once IG1 is stable, add the IG2 Safeguards for enterprises with more operational complexity or sensitive information, then the remaining IG3 Safeguards where the organization has security specialists and sensitive assets facing targeted attacks. Prioritize by data sensitivity and exposure rather than by completing the list in order. Security leadership approves the scope of each increment. The step is done when the risk-based scope is documented, the added Safeguards have owners and evidence, and the exceptions register is current.
Add the Essential Eight if operating in Australia
Organizations in Australia should use the Essential Eight as a required reference point for their baseline. It is a set of mitigation strategies rather than a certification scheme, so there is no ASD certificate to obtain. Maturity is evidenced by assessing each strategy's implementation and effectiveness against the ASD maturity model. Map the existing inventory to the eight strategies, identify gaps against the maturity levels, and have the assessment performed by a suitably qualified assessor. The step is done when each strategy has a documented maturity assessment and a remediation plan.
Add ISO 27001 certification only when required
Pursue ISO/IEC 27001 certification only if customers, tenders or contracts require it. ISO does not certify organizations; accredited certification bodies do, and they audit against ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024. Ask each candidate certification body for its accreditation scope, its audit plan and its written quote before committing. Because the existing inventory already maps to Annex A, the management system work is the main addition. The step is done when the certification body issues a certificate, or when the team has documented a clear decision not to certify.
Maintain the inventory on a recurring cycle
Keep the inventory current as systems, suppliers and threats change. Revisit the CSF Profiles and the CIS Safeguard assessment at a set interval, refresh mappings when NIST or CIS publish new Quick-Start Guides or mapping revisions, and check Safeguard status against the latest CIS version. Confirm with each certification body or assessor how often they expect evidence refreshes. The step is done when the review schedule is documented, the last review is dated, and each change to the inventory has a recorded reason.
What the licenses and certification fees actually cost you
The license line is the smallest cost in this comparison, and for three of the five frameworks it is close to zero. NIST CSF 2.0 is published as a free framework document, and the CSF 2.0 Reference Tool export and Informative References are available online at no charge. NIST SP 800-53 Rev. 5 and the Essential Eight Maturity Model are also free to read and use. The CIS Controls are free for any organization to use to improve its own cybersecurity under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0, but commercial use requires CIS's prior approval, so a consultancy or vendor reselling CIS-based work needs to check that terms with CIS before signing. The one framework with a printed price is ISO/IEC 27001:2022, which ISO lists at CHF 155 for the English PDF or ePub as of October 2026. Confirm the current price on the ISO store, and budget separately for ISO/IEC 27002:2022, which the Annex A controls draw on for guidance. The costs that matter sit outside the license. The biggest recurring cost for ISO 27001 is the certification body, which is paid for an initial audit, surveillance audits and recertification over a three-year cycle, with at least one audit in every calendar year. No supplied fact gives certification body fees, so ask each accredited body for a written quote that lists stage 1 and stage 2 audit days, surveillance visits, travel, sampling assumptions and whether the fee covers the ISO/IEC 27006-1:2024 requirements that now apply to all clients. For every framework, internal effort is paid in staff time and usually recurs: evidence collection, control owner reviews, policy upkeep and internal audits. Remediation, meaning new tooling, network changes or staffing, is typically one-time but can be the largest line item, so scope it against your current gap assessment rather than the framework's text. If you buy outside help, the consultant or implementer is the cost that varies most. CIS Controls Accreditation fees are a provider-side cost, not something a client pays to use the Controls: CIS lists an application fee of $1,500 for CREST members and $2,500 for non-members for organizations that want to provide CIS Controls implementation, auditing or assessment services. When you request a quote from DeployOpen or any other firm, ask for a fixed-scope written statement that separates one-time work (gap assessment, mapping, design, documentation, first evidence set) from recurring work (retainers, periodic testing, upgrades), and ask which framework licenses, if any, are passed through to you.
Which framework fits small teams, regulated enterprises and Australian organizations
A small team with no regulator or customer naming a framework usually needs a short, prioritized list of safeguards it can run with limited staff. The CIS Controls fit this case well because CIS defines Implementation Group 1 as essential cyber hygiene and a minimum standard for every enterprise. IG1 contains 56 Safeguards, which gives a bounded starting backlog. The NIST CSF 2.0 is better used as an outline for organizing the program than as a checklist, because its Core has six Functions, 22 Categories and 106 Subcategories.
- Start with IG1: Map existing tools and practices to the 56 IG1 Safeguards and record the gaps. This is a one-time baseline that recurs as systems change.
- Use CSF 2.0 as the structure: Organize the program under Govern, Identify, Protect, Detect, Respond and Recover so that reporting to leadership stays consistent.
- Expect the Govern Function to be new work: CIS v8.1 maps its Safeguards to CSF 2.0, and 25 of the 153 Safeguards carry the Govern function, so policy and ownership gaps often surface first.
- Plan for licensing limits: CIS Controls content is licensed for use to improve your own security, but commercial use requires CIS's prior approval. Confirm this with CIS if you plan to resell the content or build a service on it.
- Avoid certificate expectations: Neither the CSF nor the CIS Controls issues a certificate, so the proof is internal evidence unless a customer asks for an attestation.
Before committing, confirm with your largest customers and any insurer whether they accept self-assessed evidence against IG1 or require a named framework or report.
A regulated enterprise usually has a regulator, a customer base or a contract that sets the depth of evidence required. The question is rarely which framework is best in the abstract, but which combination produces the proof each stakeholder accepts. CIS IG2 or IG3 adds Safeguards for organizations with more operational complexity, sensitive information and dedicated security staff. The CSF 2.0 Organizational Profiles (Current and Target) and four Tiers (Partial, Risk Informed, Repeatable and Adaptive) help the enterprise show progress to the board.
- Pick the implementation group by asset profile: IG2 suits enterprises with sensitive information and more complex operations, and IG3 targets regulated, sensitive assets facing sophisticated, targeted attacks. Confirm which group your regulator expects.
- Use Profiles and Tiers for reporting: Current and Target Profiles show the gap, while Tiers describe the maturity of risk management. Tiers are not a compliance score.
- Add ISO 27001 when certificates are demanded: Certification is issued by accredited certification bodies, not by ISO, and accredited bodies must apply ISO/IEC 27006-1:2024 to all clients by 31 March 2026. Ask customers whether a certificate or an audit report is the required proof.
- Use SP 800-53 where federal or contract depth applies: SP 800-53 Release 5.2.0 has 324 base controls and 872 enhancements, which is a deep catalog. Its depth is useful for federal systems and contracts that reference it.
- Use official mappings: CIS Navigator and NIST informative references map controls across frameworks, but NIST does not check non-NIST mappings, so validate them against your own control set.
Confirm with each regulator or major customer which framework, report type and cycle they accept before building the program around one.
Australian organizations often use the Essential Eight as the baseline because the Australian Signals Directorate (ASD) publishes it as a set of mitigation strategies with a maturity model. It is not a certification scheme, and there is no ASD certificate. Maturity is evidenced by assessing how each strategy is implemented and how effective it is against the model. This makes the Essential Eight a practical baseline for local government and business, while multinational operations often layer the CSF or ISO 27001 on top for their broader audiences.
- Use the Essential Eight as the baseline: Assess each strategy against the maturity model in the November 2023 edition and record the evidence for each level reached.
- Describe maturity as evidence, not a certificate: Customers and government stakeholders may ask for an assessment result. Do not present self-assessment as a certification.
- Layer CSF for multinational reporting: The CSF 2.0 Core maps to Govern, Identify, Protect, Detect, Respond and Recover, which helps teams report across jurisdictions that use it.
- Layer ISO 27001 for certificate demands: If a customer requires certification, accredited bodies certify the organization. Confirm the scope and the certification body's accreditation before scoping work.
- Confirm the mapping before relying on it: Official mappings are informative. Verify any overlap claim against the ASD publication and your own evidence.
Before choosing, confirm with the relevant Australian agency, sector regulator or contracting department which maturity level or framework they expect.
What do buyers ask before choosing and hiring help?
Is a free framework enough without certification?
Often yes, if the goal is a sound internal security program and no customer or regulator asks for a certificate. NIST CSF 2.0 is voluntary, and NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services. The CIS Controls are free for any organization to use to improve its own cybersecurity, but the content is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0, so commercial use requires CIS's prior approval. Confirm that position before you build paid services or client deliverables on the Controls text. ISO/IEC 27001 is the option when a certificate is required, since only accredited certification bodies issue one. The Essential Eight issues no certificate either, so its proof is an assessment of maturity.
How long does ISO 27001 certification last and what keeps it valid?
The supplied cycle rules set the rhythm of certification, but they do not give the length of your project. Under ISO/IEC 17021-1, a management system certification cycle lasts three years, with at least one audit in every calendar year, either surveillance or recertification. Accredited certification bodies apply ISO/IEC 27006-1:2024 to all clients from 31 March 2026, as required by IAF MD 29:2024. Certificates based on ISO/IEC 27001:2013 had to expire or be withdrawn by 31 October 2025, so a new program should target the 2022 edition. The time to first certification depends on your current controls, your scope and your internal capacity. Ask the certification body for its audit plan and scheduling lead time before you commit to a date. ISO's certification guidance explains how to check accredited certificates.
How much does ISO 27001 cost and what drives the price?
No price list is published here, and certification body fees are not included in the supplied facts, so confirm those figures directly with each body. The standard itself is a small purchase: ISO's store lists the English PDF and ePub of ISO/IEC 27001:2022 at CHF 155 as of October 2026. The recurring costs come from certification. The certification body charges for the initial audit, then for the annual audits within each three-year cycle and for recertification. Internal staff time, tooling and any readiness work make up the rest. Scope drives most of the variation: the number of sites, business units, systems and suppliers inside the scope, and how much evidence already exists. Ask for a quote that separates readiness work, tooling and certification body fees, and that marks which items are one-time and which recur.
Can a small team run CIS Controls without outside help?
Often yes for a first phase, if the team owns the work and someone can measure the results. CIS defines Implementation Group 1 as essential cyber hygiene and a minimum standard for every enterprise, and it covers 56 of the 153 Safeguards. IG2 adds 74 more for a total of 130, and IG3 adds the remaining 23. The CIS Controls Assessment Specification defines the inputs, operations, measures and metrics used to verify each Safeguard. CIS says it covers what to measure and leaves the how to the implementer. Your team must therefore design its own procedures, tooling and evidence collection. Plan for an asset inventory, named control owners and a way to show evidence over time. Bring in outside help when internal skills, time or independent review fall short, and set those boundaries in a written scope.
Does following a framework satisfy a regulator's requirements?
No. A framework is a set of controls, and following one does not replace a regulator's requirements or prove compliance on its own. HHS states that no HIPAA Security Rule standard requires certification, and that it does not endorse or recognize private certifications. The GDPR requires no audit, attestation or certificate, and its Article 42 certification is voluntary and does not reduce the responsibility of the controller or processor. NIS2 creates no certificate of compliance, and national authorities oversee it through inspections, audits, scans, information requests and fines. DORA sets no certification scheme either. CIS states that its Controls do not replace any regulatory, compliance or authorization scheme. Mappings can support evidence reuse, but ENISA states that its own mapping is not a measure of equivalence. Confirm each obligation with the regulator or counsel before you choose a framework.
Can one control set be mapped to several frameworks?
Yes, and the published mappings are a useful starting point, with clear limits. The CIS Controls Navigator for v8.1 offers CIS mappings to 30 frameworks and versions, including NIST CSF 2.0, NIST SP 800-53 Rev. 5, ISO/IEC 27001:2022, SOC 2, PCI DSS v4.0, DORA and NIS2. NIST's CSF 2.0 Reference Tool export lists 363 Implementation Examples and informative references to standards that include SP 800-53 Rev. 5.2.0 and ISO/IEC 27001:2022. Two cautions apply. NIST does not check the correctness of non-NIST mappings, and listing a mapping does not imply endorsement. For PCI DSS, a QSA may reuse SOC 2 evidence only after independently reviewing it. Keep one control inventory, tag each control with every framework it serves, and assign an owner to review each mapping before an auditor relies on it. The CIS Controls Navigator is the place to start.
How do I request a fixed-scope quote from DeployOpen?
Send a written description of the scope, and DeployOpen will prepare a quote from it. DeployOpen does not publish a price list, and most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Useful inputs include the framework or frameworks you are choosing between, the systems, cloud accounts, sites and suppliers in scope, the evidence that already exists and the people who will own each control. State whether you need implementation only, ongoing support or continuous testing, since upgrades, support and testing are available as retainers. Be clear about the proof you need. DeployOpen prepares systems, controls and evidence for compliance assessments, while independent auditors and certification bodies issue audit reports and certificates.
How DeployOpen scopes and delivers readiness for these frameworks
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For control framework work, we prepare the systems, controls and evidence that an independent assessor or certification body would review, without issuing any audit report, attestation or certification ourselves.
How we scope
- Engagements are fixed-scope, with the framework chosen, systems in scope and deliverables agreed in writing before work starts.
- The written scope names which control set applies, such as NIST CSF 2.0, CIS Controls v8.1 or Annex A of ISO/IEC 27001:2022.
- Quotes follow from the written scope, so ask us to list the systems, environments and evidence sources each quote covers.
How we build
- We map existing platform controls to the chosen framework and record gaps against each Safeguard, Subcategory or control.
- Security testing of applications, APIs, cloud and infrastructure can be scoped to produce evidence for the controls in question.
- Hardening and configuration changes are made inside your own cloud accounts, data centers or air-gapped networks.
How we hand over
- Deliverables include control mappings, configuration records, policies and evidence packs organized for your assessor or auditor.
- Documentation covers how each control is operated and where its evidence is kept, so your team can run it after handover.
- We state what remains for your certification body, attestation firm or internal governance to confirm, since DeployOpen does not issue those outcomes.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial scope is delivered.
- Backup, upgrade and patching routines can be documented so that control evidence stays current between assessments.
- Ask us to confirm retainer scope, response expectations and what the retainer excludes before you sign.
Sources and further reading
- NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 ↗
- CIS Critical Security Controls Implementation Groups ↗
- ISO/IEC 27001:2022 (ISO) ↗
- NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations ↗
- Essential Eight maturity model, ASD cyber.gov.au ↗
- NIST CSF 2.0 Reference Tool export: Core, Implementation Examples and Informative References ↗
