Frameworks & Standards
Voluntary frameworks and standards — ISO 27001, NIST CSF, SOC 2, and similar.
NIST CSF 2.0: What Actually Changed From Version 1.1
The first major revision since 2014 adds a sixth function — Govern — and explicitly extends the framework beyond critical infrastructure to organizations of any size or sector.
The State of Multi-Framework Compliance: Why the Same Control Gets Typed In Three Times
A short research note on why control reuse across frameworks remains rare in practice, even though the underlying control overlap is substantial.
Mapping SOC 2 to ISO 27001: Where the Overlap Actually Is
Both frameworks assess similar underlying security practices, but their structures, audiences, and outputs are different enough that neither is a drop-in substitute for the other.
CIS Controls v8: A Practical Starting Point for Under-Resourced Teams
The CIS Controls' Implementation Group tiers exist specifically so a five-person security team isn't held to the same bar as a Fortune 500 SOC — worth understanding before dismissing the framework as too basic.
Essential Eight: Australia's Answer to the Cybersecurity Framework Question
The Australian Cyber Security Centre's eight mitigation strategies, assessed across four maturity levels, are mandatory for Australian government agencies and increasingly referenced well beyond government.