Security Frameworks

What is a Security Framework?

A security framework is a structured set of controls, principles, and governance practices used to reduce cyber risk in a consistent way. Frameworks exist so organisations do not have to reinvent security architecture from scratch for every system. They create a shared language for technical teams, executives, regulators, and assessors. Good frameworks connect policy decisions to operational controls, evidence, and accountability.

Standards and guidelines are related but not identical. A standard is usually something you are measured against formally, such as ISO/IEC 27001. A guideline provides implementation direction that may be mandated by policy context but is often applied through risk-based tailoring, such as the NIST Cybersecurity Framework (CSF) and the Australian Information Security Manual (ISM). In practice, mature programs use both: standards for assurance and guidelines for execution.

Australian Frameworks

In Australia, three core references appear repeatedly in public-sector and critical-infrastructure security programs. The Information Security Manual (ISM), maintained by the Australian Signals Directorate (ASD), provides detailed control guidance. The Essential Eight is ASD's prioritised mitigation subset for common threats. The Protective Security Policy Framework (PSPF) defines broader protective-security obligations for Australian Government entities.

For critical infrastructure, legal obligations may also arise under the Security of Critical Infrastructure Act 2018 (Cth), as amended. This means framework selection is not purely academic. It directly influences architecture decisions, operational controls, evidence requirements, and assurance pathways. Even private organisations that supply government often inherit these requirements contractually.

New Zealand Frameworks

New Zealand's primary government framework is the New Zealand Information Security Manual (NZISM), published by the Government Communications Security Bureau (GCSB) via the National Cyber Security Centre (NCSC). NZISM provides mandatory and recommended controls for government environments, with strong alignment to risk management, classification handling, and assurance practices.

Organisations working across Australia and New Zealand should expect conceptual overlap between NZISM and ISM but not perfect equivalence. The safest approach is to map controls explicitly rather than assuming one jurisdiction's wording satisfies another's assurance expectations. This reduces duplicated engineering while preserving audit and policy traceability in both countries.

International Standards

Four globally referenced frameworks are commonly used as baseline models. ISO/IEC 27001 defines requirements for an information security management system (ISMS), and ISO/IEC 27002 provides implementation guidance for controls. NIST CSF 2.0 gives outcome-oriented governance and capability functions. NIST SP 800-53 provides detailed control catalogs, while the CIS Controls offer practical prioritised safeguards.

A brief comparison: ISO 27001 is strongest for formal certification and management-system assurance; NIST CSF is excellent for executive-to-technical risk communication; NIST 800-53 is deep and prescriptive for control engineering; CIS Controls are concise and implementation-focused for rapid uplift. Most mature organisations blend these references based on regulatory context, sector obligations, and operational complexity.

For new teams, it helps to separate framework purpose from implementation tooling. Frameworks define what security outcomes are expected; tooling defines how you execute and evidence those outcomes. A team can use cloud-native controls, endpoint tools, and SIEM platforms in many different combinations while still mapping cleanly to ISO, NIST, CIS, or ISM expectations. The key is maintaining traceability from each control statement to measurable implementation and review cadence.

Which Framework Applies to You?

Start with jurisdiction and regulatory obligations, then tailor by business risk. Australian Government entities generally align to the ISM and PSPF. New Zealand Government entities align to NZISM. Private-sector organisations commonly adopt ISO 27001 or NIST CSF as primary governance anchors.

For critical infrastructure operators, consider obligations under the SOCI Act and align with ISM guidance where appropriate, especially when government-connected assurance is expected. In all cases, begin with scope, data sensitivity, and threat profile, then build a control map that can produce evidence, not just policy text.

Framework choice should also account for customer expectations, board reporting maturity, and internal operating model. A smaller organisation may begin with NIST CSF or CIS-style uplift, then formalise around ISO 27001 as governance matures. A government supplier may invert that path and map directly to ISM from the start because contractual assurance requirements are immediate.