Frameworks at a Glance
| Framework | Who typically needs it | Mandatory? | How it’s verified | Our role |
|---|---|---|---|---|
| CMMC | Defense contractors handling FCI or CUI | Yes, when in the contract | Self-assessment, C3PAO, or DIBCAC (by level) | Readiness, gap assessment, SSP/POA&M |
| NIST SP 800-171 | Defense and federal contractors with CUI | Yes, via DFARS 252.204-7012 | Self-assessment + SPRS score | Gap assessment, SSP/POA&M, remediation planning |
| NIST SP 800-53 | Federal agencies, cloud providers serving them | Yes, for federal systems | Agency/FedRAMP authorization | Control selection, documentation, advisory |
| NIST CSF 2.0 | Any organization | Voluntary | Self-assessment | Program assessment and roadmap |
| ISO/IEC 27001:2022 | Companies selling internationally or to large enterprises | Voluntary (often customer-required) | Accredited certification body audit | Gap analysis, ISMS implementation, audit readiness |
| CIS Controls v8.1 | Small and mid-sized organizations | Voluntary | Self-assessment | Baseline assessment and prioritization |
| SOC 2 | SaaS and service providers | Voluntary (often customer-required) | CPA firm attestation report | Readiness only |
| HIPAA Security Rule | Covered entities and business associates | Yes, by law | HHS OCR enforcement | Risk analysis and safeguards review |
| NIST AI RMF | Organizations using or building AI | Voluntary | Self-assessment | AI risk assessment and governance |
| ISO/IEC 42001 | Organizations providing or using AI | Voluntary (sometimes customer-required) | Accredited certification body audit | Readiness and gap analysis |
| OWASP Top 10 (LLM & Agentic) | Teams building AI applications and agents | Voluntary | Design review / testing | Secure design review |
USCIBER is a consulting firm. We prepare you for assessments and audits; we don’t issue certifications, attestation reports, or CMMC assessments.
Defense & Federal Frameworks
CMMC (Cybersecurity Maturity Model Certification)
What it is: The Department of Defense program that verifies contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), codified at 32 CFR Part 170. Level 1 covers the 15 basic safeguarding requirements of FAR 52.204-21. Level 2 covers the 110 requirements of NIST SP 800-171 Rev. 2. Level 3 adds selected requirements from NIST SP 800-172 and is assessed by the government.
Who needs it: Prime contractors and subcontractors whose DoD contracts include CMMC requirements.
How we help: CMMC readiness reviews, scoping, SPRS score estimates, and remediation roadmaps. Program timelines have changed — see our CMMC compliance consulting page for current status.
NIST SP 800-171
What it is: NIST’s requirements for protecting CUI in nonfederal systems. DFARS 252.204-7012 requires defense contractors handling CUI to implement it, and assessment results are recorded in the Supplier Performance Risk System (SPRS). NIST published Revision 3 in 2024, but DoD continues to require Revision 2 — 110 requirements across 14 families.
Who needs it: Defense contractors with CUI, and increasingly other federal contractors.
How we help: Gap assessments, SPRS scoring, and the System Security Plan and POA&M your assessment depends on. See NIST 800-171 & DFARS compliance.
NIST SP 800-53
What it is: The comprehensive catalog of security and privacy controls for federal information systems. Revision 5 organizes controls into 20 families, with low, moderate, and high baselines published in SP 800-53B. It underpins FISMA compliance and FedRAMP cloud authorizations, and NIST SP 800-171 was derived from it.
Who needs it: Federal agencies, their system integrators, and cloud providers pursuing FedRAMP — plus organizations that want a deep, control-level reference.
How we help: Control selection and tailoring, control documentation, and advisory support. Our leadership has applied NIST SP 800-53 in federal (DHS) environments.
Foundational Security Frameworks
NIST Cybersecurity Framework (CSF) 2.0
What it is: A voluntary, outcome-based framework for managing cybersecurity risk, usable by organizations of any size or sector. Version 2.0 organizes outcomes into six functions — Govern, Identify, Protect, Detect, Respond, and Recover — with Govern added to put cybersecurity strategy, roles, and supply chain risk at the leadership level.
Who needs it: Organizations that want a credible structure for their security program without a certification requirement — and boards that want a common language for cyber risk.
How we help: Current-state and target-state profiles, a prioritized roadmap, and ongoing program leadership through our vCISO services.
ISO/IEC 27001:2022
What it is: The international standard for an information security management system (ISMS). Organizations define their scope, assess risk, and select controls from Annex A — 93 controls grouped into organizational, people, physical, and technological themes. Certification is issued by an accredited certification body after an external audit, with annual surveillance audits and recertification every three years.
Who needs it: Companies selling to international customers or large enterprises that require certification.
How we help: Gap analysis, risk assessment and treatment, policies and the Statement of Applicability, internal audit support, and audit readiness, delivered with hands-on ISO 27001 implementation experience. See ISO 27001 consulting.
CIS Critical Security Controls v8.1
What it is: A prioritized set of 18 controls and 153 safeguards from the Center for Internet Security. Safeguards are grouped into three Implementation Groups. IG1 — 56 safeguards — is defined as essential cyber hygiene for every organization.
Who needs it: Small and mid-sized organizations that want a practical, prioritized technical baseline — often alongside NIST CSF or as preparation for a larger framework.
How we help: IG1/IG2 baseline assessments and prioritized remediation plans as part of a security and risk assessment.
Customer Assurance & Sector Frameworks
SOC 2
What it is: An attestation report, defined by the AICPA, on a service organization’s controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Security is required in every SOC 2; the other criteria are included based on your services. A Type I report evaluates control design at a point in time; a Type II report evaluates operating effectiveness over a period, typically several months to a year.
Who needs it: SaaS companies and service providers whose customers ask for a SOC 2 report before signing.
How we help: Readiness only — scoping, gap assessment, policies, and evidence preparation before your audit. SOC 2 reports are issued by licensed CPA firms; USCIBER does not perform SOC 2 audits.
HIPAA Security Rule
What it is: The federal rule (45 CFR Part 164, Subpart C) requiring HIPAA covered entities and their business associates to protect electronic protected health information (ePHI) through administrative, physical, and technical safeguards. A documented, accurate risk analysis is a core requirement — and one of the most common findings in enforcement actions. HHS has proposed significant updates to the Security Rule; until a final rule is published, the current rule applies.
Who needs it: Healthcare providers, health plans, and the vendors that handle ePHI on their behalf.
How we help: Security risk analysis, safeguards gap review, and risk management planning as part of our compliance services.
AI Governance & Security Frameworks
NIST AI Risk Management Framework (AI RMF)
What it is: Voluntary NIST guidance (NIST AI 100-1) for managing risks across the AI lifecycle, organized into four functions: Govern, Map, Measure, and Manage. NIST’s Generative AI Profile (NIST AI 600-1) applies the framework to generative AI risks.
Who needs it: Any organization using or building AI that wants a defensible, structured approach to AI risk.
How we help: AI risk assessments and governance programs aligned with the AI RMF. See AI security & governance consulting.
ISO/IEC 42001
What it is: The international standard (ISO/IEC 42001:2023) for an AI management system — the policies, roles, risk and impact assessments, and controls an organization uses to develop, provide, or use AI responsibly. Like ISO 27001, it is certifiable by accredited certification bodies, and the two can share one management system.
Who needs it: AI product companies and organizations whose customers ask for evidence of responsible AI management.
How we help: Gap analysis, AI policies, risk and impact assessment processes, and audit readiness. We prepare you for certification; we don’t issue it.
OWASP Top 10 for LLM Applications & for Agentic Applications
What it is: Community-developed lists from the OWASP GenAI Security Project of the most critical security risks in AI applications. The LLM Top 10 (2025) covers risks such as prompt injection, sensitive information disclosure, excessive agency, and system prompt leakage. The Top 10 for Agentic Applications covers risks specific to AI agents, such as agent goal hijacking, tool misuse, identity and privilege abuse, and memory and context poisoning.
Who needs it: Teams building AI assistants, retrieval-augmented chatbots, and AI agents.
How we help: Secure design reviews of LLM and agentic applications against both lists.
How to Choose — and Avoid Doing the Work Twice
- Start with what’s required. Contracts (CMMC, DFARS), laws (HIPAA), and customer requirements (SOC 2, ISO 27001) come first.
- Pick one foundation. If nothing is required yet, NIST CSF 2.0 or CIS Controls IG1 gives you a credible program that maps to everything else.
- Map once, reuse often. NIST 800-171, NIST 800-53, ISO 27001, SOC 2, and CSF overlap heavily — access control, incident response, risk assessment, and policies carry across. We build one control set and map it to each framework you need.
- Add AI governance to the same program. The NIST AI RMF and ISO/IEC 42001 extend your existing risk management and policy structure rather than replacing it.
Frequently Asked Questions
What is a cybersecurity compliance framework?
A cybersecurity compliance framework is a structured set of requirements or best practices for protecting information — such as NIST SP 800-171, ISO 27001, or SOC 2. Some are legally or contractually mandatory; others are voluntary but expected by customers.
Which cybersecurity framework should a small business start with?
If no framework is required by contract or law, start with NIST CSF 2.0 for overall structure or CIS Controls Implementation Group 1 for a practical technical baseline. If you handle CUI for the DoD, start with NIST SP 800-171 and CMMC — they’re required.
What’s the difference between ISO 27001 and SOC 2?
ISO 27001 is an international certification of your information security management system, issued by an accredited certification body. SOC 2 is a U.S. attestation report on your controls, issued by a CPA firm. ISO 27001 is more common internationally; SOC 2 is common with U.S. SaaS buyers. The underlying controls overlap substantially.
What’s the difference between NIST CSF and ISO 27001?
NIST CSF is a voluntary framework of security outcomes with no certification. ISO 27001 defines requirements for a management system that can be certified. Many organizations use CSF to structure their program and ISO 27001 when customers require certification.
Can one program cover multiple frameworks?
Yes. Most frameworks share core controls. Building one control set and mapping it to each framework avoids duplicate policies, evidence, and assessments.
Do you certify organizations?
No. USCIBER is a consulting firm. We prepare you for CMMC assessments, ISO certification audits, and SOC 2 examinations, which are performed by independent, authorized assessors, certification bodies, or CPA firms.
Not Sure Which Framework Applies?
Book a 30-minute consultation. We’ll review your contracts, customers, and data, tell you which frameworks actually apply, and recommend the most efficient path to meet them.