Standard vs. Framework

Notes

Both are useful; they do different work. The NIST Cybersecurity Framework is a framework — it organizes cybersecurity considerations into functions and categories that practitioners use to structure programs, but it does not prescribe the criteria against which a cybersecurity posture is found compliant or non-compliant.¹ ISO/IEC 27001 is a standard — it prescribes requirements for an information security management system against which an organization is certified or not certified.² The COSO Internal Control — Integrated Framework is a framework — it organizes the components of internal control; the auditing standards under PCAOB and the assessment requirements under SOX 404 are the standards against which controls are evaluated.³

The distinction matters for the architecture of an institution. A body that publishes frameworks is in the orientation business; a body that publishes standards is in the determination business. The disciplines are different — public methodology, due process for changes, governance over interpretation, inspection of consistent application. A framework can be adopted; a standard must be applied. The Operational Suitability Standard is a standard. It prescribes the criteria against which the Operational Readiness Assessment renders its finding. The Trust Fabric is a framework — it organizes the domains in which Operational Suitability must be established. Both are necessary; conflating them collapses the institutional discipline that each requires.