Introduction

To successfully achieve the objectives of implementing cybersecurity at different levels, a range of procedures and standards should be followed. Cybersecurity standards determine the requirements that an organization should follow to achieve cybersecurity objectives and facilitate against cybercrimes [1] and ensure the ongoing management of information security controls.

Additionally, the framework establishes a common language for defining a cybersecurity program, enabling organizations to set risk-based cybersecurity goals at the executive level that can be translated to the operations team [2].

These frameworks are a blueprint for managing and reducing organizational risk. Information security professionals use frameworks to define and prioritize the tasks required to manage the organization's security program. Frameworks are also used to help prepare for compliance and other IT and security audits. When you are choosing from the number of leading information security frameworks, you would primarily assess the number of unique information security controls (requirements) in each of them [3][4][5]. The volume of these controls directly impacts the number of domains covered by that framework. The lesser number of controls in a framework might make it easier to implement, but it also might not provide the necessary coverage that your organization needs from the perspective of administrative, technical, and physical information security practices [6].

This is where defining the applicable and relevant framework is primarily a business decision [7], based on your organization's context and risk profile, which needs to consider applicable laws and regulations, that are required to support existing or planned business processes.

Commonly, this selection process generally leads to adopting one of the following frameworks:  ISO 27001/002 [8,9]  NIST Special Publication 800-53 [10]  NIST Cybersecurity Framework [11]  PCI DSS [12]  CIS Controls [13,14]  HITRUST Common Security Framework [15]  HIPAA [16]  CSA CCM [17]  GDPR [18]  ISO 27701 [19]  AICPA Trust Services Criteria (SOC 2) [20]  COBIT [21] Each information security framework has its own unique specialization and depth of coverage. However, understanding this can help you make an informed decision on the most appropriate framework for your needs. [22,23] You may even find you need to leverage a metaframework (e.g., the framework of frameworks) to address more complex compliance requirements (e.g., when the organization is holding the personal data of EU citizens and process cardholder data, it should comply with both GDPR and PCI DSS requirements).

A key consideration for choosing an information security framework would be understanding the level of content and robustness each framework offers. This will directly impact the available information security controls within each framework [24].

Overview and Comparison between NIST SP 800-53 and ISO/IEC 27001:2013

The Special Publication (SP) 800-53 Security and Privacy Controls for Information Systems and Organizations from the National Institute of Standards and Technology (NIST) is currently in its 5th revision (rev5) dated September 2020. It was initially designed to protect the US federal government, but quickly gained popularity among private industry and now is considered as one of the most popular and respectable information security frameworks in the world. It was partially caused due to the significant outsourcing to private companies that do business with the US federal government.

According to the official web page of the standard "This publication [Special Publication (SP) 800-53] provides a catalog of security and privacy controls for information systems and SO 27001 is a well-respected international information security standard that outlines the key processes and approaches a business needs to manage information security risk in a practical way [26]. ISO 27001 consists of the main part and Annex A, that contains the basic overview of the security controls needed to build an Information Security Management System (ISMS). Additionally, there is a separate standard ISO 27002 that provides a detailed description of the specific controls that are necessary to actually implement ISO 27001 (essentially, you can't meet ISO 27001 without implementing ISO 27002). [27,28]. The important thing about ISO is that it provides the companies with the possibility to undergo an external audit and get certified against ISO 27001. As may be seen from the table there is an overlapping between the controls from ISO and NIST frameworks. But the most important specifics of these frameworks is that NIST 800-53 can be considered a super-set of ISO 27001. In particular, all the controls from ISO 27001 can be covered by NIST 800-53. However, ISO 27001 does not cover all of the areas of NIST 800-53. From the coverage perspective, NIST 800-53 is more comprehensive and contains much more areas and controls than ISO 27001. While the detailed analysis of the missing controls is out of the scope of this investigation let's take a look at a few examples which would show in which areas NIST, in contrast to ISO, provide more comprehensive coverage of the security-related areas.

Detailed Mapping of Controls

[AT-4 Training Records], [AT-6 Training

Feedback]. These two controls require the organization to document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, retain individual training records, and gather feedback on organizational training results [10]. These could be important indicators of the awareness process effectiveness in the organization. These controls very often are audited by auditors during the ISO 27001 certification process; however, they are not explicitly mentioned in ISO 27001.

[CM-2 Baseline Configuration], [CM-6 Configuration Settings]. These controls force organizations to develop, document, and maintain under configuration control, a current baseline configuration of the system, and configuration settings for components. Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture [10]. These controls are important for maintaining the integrity of the security configurations for the systems and components and ensuring the standard configuration for the infrastructure systems and components. Again, these aspects are not explicitly highlighted in the ISO 27001 but commonly are checked during the ISO certification process.

[PE-6 Monitoring Physical Access], [PE-8 Visitor Access Records]. NIST 800-53 requires from organizations to monitor physical access to the facility where the system resides to detect and respond to physical security incidents and to maintain and periodically review visitor access records to the facility where the system resides [10]. These are other examples of controls that are extremely relevant for the protection of the organization's assets. They are especially important for small representative offices that often are lacking baseline security controls established within headquarters and are also quite often emphasized during the ISO certification audits. Nevertheless, they have been overlooked for a quite long time until the issue of the revised version of the ISO 27002 earlier this year (so they should appear in the new version of the ISO 27001 as well).

[RA-10 Threat Hunting]. Threat hunting is an active means of cyber defense in contrast to traditional protection measures, such as firewalls, intrusion detection and prevention systems, quarantining malicious code in sandboxes, and Security Information and Event Management technologies and systems. Cyber threat hunting involves proactively searching organizational systems, networks, and infrastructure for advanced threats. The objective is to track and disrupt cyber adversaries as early as possible in the attack sequence and to measurably improve the speed and accuracy of organizational responses. [10]. Likewise the previous controls, this one has been also overlooked by the ISO 27001 publications, despite its extreme importance and relevance for the organizations. This inconsistency should be partially eliminated with the new version of the ISO 27001 standard -this year's revised version of ISO 27002 already contains a new control defining requirements for threat intelligence which is an integral part of the threat hunting process.

[

PM-18 Privacy Program Plan], [PT-1 Personally Identifiable Information Processing and Transparency Policy and Procedures], [PT-2 Authority to Process Personally Identifiable Information], [PT-4 Consent], [PT-5

Privacy Notice] and other controls related to the protection of personally identifiable information (PII) processing. The defining characteristic of the NIST 800-53 is that it contains a set of controls to address privacy requirements for the processing of PII while ISO 27001 does not specifically address privacy beyond the inherent benefits provided by maintaining the security of PII, therefore we can assume that the ISO 27001 controls do not satisfy privacy requirements with respect to PII processing [29]. From this perspective, NIST has an advantage over ISO 27001 in regard to the protection of the PII processing and may be considered a good basis for GDPR compliance.

Conclusion

Understanding both the differences and similarities between these two the most known and adopted security frameworks-ISO 27001 and NIST 800-53 is crucial for implementing an effective information security program that would be tightened to the organization's context and needs and expectations of interested parties.

A common misunderstanding is that companies have to pick one or the other framework and stick with it, or that one is better than the other. In fact, both frameworks can be applied to a single organization due to their synergy and can greatly increase its information security, risk management, and security program.

It is not always necessary to choose between NIST 800-53 and ISO 27001. In fact, the two are complementary and can be used the same organization. However, if certification is your goal, you should definitely look closer at ISO 27001. Being externally audited and achieving accredited certification against ISO 27001's requirements would likely provide a higher level of confidence among clients and stakeholders and would be a prerequisite for securing certain contracts. Accredited certification to ISO 27001 demonstrates that your organization follows information security best practices, and delivers an independent, expert assessment of whether your valuable information and information assets are adequately protected. At the same time, while implementing the ISO 27001 requirements you still can leverage NIST 800-53 to strengthen the areas that are missing or not sufficiently covered in the ISO.