A curated list of standards, implementation guidance, and tooling for the most widely adopted security and compliance frameworks: NIST Cybersecurity Framework (CSF), ISO/IEC 27001, PCI-DSS, and CIS Critical Security Controls — plus the CRI Profile, a financial-sector-specific extension of NIST CSF included here for practitioners who need the sector overlay.
Scope: Anything that materially helps a practitioner scope, implement, assess, or maintain compliance against these frameworks — official standards, implementation playbooks, control-mapping tools, GRC platforms, and certification paths. Not generic infosec news or vendor marketing without a substantive free tier or open-source component.
Why now: PCI-DSS v4.0.1 is now the only active version after the v3.2.1 sunset. NIST CSF 2.0 broadened scope beyond critical infrastructure to any organization, with Implementation Examples now published alongside Informative References. ISO/IEC 27001:2022 is the current certifiable revision, and the transition deadline for organizations certified under the 2013 edition has passed, making current certification a live compliance gap for laggards.
Contributions welcome.
- Why These Frameworks Matter
- How to Approach Implementation
- NIST Cybersecurity Framework (CSF)
- ISO/IEC 27001
- PCI-DSS
- CIS Critical Security Controls
- CRI Profile
- DISA STIG
- CIS Benchmarks (Configuration Hardening)
- Cross-Framework Mapping and GRC Platforms
- Open-Source Compliance and Security Tooling
- Assessment, Audit, and Scanning Tools
- Certifications and Training
- Government and Standards Bodies
- Learning Resources
- Related Lists
These three frameworks cover the large majority of security and compliance obligations a practitioner will meet in the wild. NIST CSF is the free, voluntary, outcomes-based framework most US organizations use to structure a security program and communicate risk to a board. ISO/IEC 27001 is the internationally recognized, certifiable standard for an information security management system (ISMS), and is frequently a contractual requirement for enterprise vendors. PCI-DSS is mandatory, not voluntary, for any organization that stores, processes, or transmits cardholder data, enforced by the card brands through the acquiring bank relationship rather than a government regulator.
None of the three is mutually exclusive. Most mature security programs run all three in parallel: NIST CSF as the governance and communication layer, ISO 27001 as the certifiable management-system backbone, and PCI-DSS as a mandatory overlay wherever payment card data is in scope. A single well-designed control (for example, quarterly vulnerability scanning) can often satisfy requirements in all three simultaneously, which is why control-mapping tools below are as important as the standards themselves.
CIS Critical Security Controls sit alongside these as a fourth, free, prescriptive baseline many organizations implement first because it is more actionable out of the box than NIST CSF's outcomes or ISO 27001's management-system requirements. The CRI Profile is narrower in applicability — built specifically for financial institutions — but is included here because the FFIEC now names it, alongside NIST CSF and CIS Controls, as an acceptable framework for regulatory self-assessment; see the companion FinServ Compliance list for its full sector context.
The phases below are common to all three frameworks. Framework-specific notes on where each one diverges from this generic path are under its own section below.
- Define scope. Identify the systems, data flows, business units, and third parties in scope. For PCI-DSS this is the cardholder data environment (CDE) and everything connected to it. For ISO 27001 this is the ISMS boundary, documented in the Statement of Applicability's scope statement. For NIST CSF this is usually an organizational unit or a specific system, expressed as a Current Profile.
- Assess the current state. Run a gap assessment against the framework's control set. For NIST CSF, this means scoring each Subcategory against a Current Profile. For ISO 27001, this means a pre-certification gap analysis against Annex A controls. For PCI-DSS, this means determining your merchant or service provider level and completing the applicable Self-Assessment Questionnaire (SAQ) or engaging a Qualified Security Assessor (QSA) for a Report on Compliance (ROC).
- Perform a risk assessment. ISO 27001 mandates a formal risk assessment methodology (Clause 6.1.2) feeding the Statement of Applicability. NIST CSF's Govern function expects an organizational risk management strategy. PCI-DSS is prescriptive rather than risk-based, so this step is lighter but still expected under Requirement 12.
- Build a remediation and implementation plan. Prioritize gaps by risk and effort. Assign owners and deadlines. This is where control-mapping tools (see below) pay off, since a single compensating control can close gaps across more than one framework.
- Implement controls and collect evidence. Evidence-collection automation (see GRC platforms and open-source tooling below) is the difference between a compliance program that survives an audit and one that reconstructs evidence retroactively.
- Internal audit or self-assessment. ISO 27001 requires a documented internal audit program (Clause 9.2) before the external certification audit. PCI-DSS SAQ completion is itself a form of self-assessment; a ROC requires the QSA's independent testing.
- External assessment or certification. ISO 27001 certification runs through an accredited certification body in two stages (Stage 1 documentation review, Stage 2 implementation audit), followed by a 3-year certification cycle with annual surveillance audits. PCI-DSS compliance is validated annually (SAQ or ROC) plus quarterly external vulnerability scans by an Approved Scanning Vendor (ASV) if any system is externally facing. NIST CSF has no certification; conformity is self-declared or assessed by a customer or auditor against your published Target Profile.
- Monitor and maintain. All three expect continuous monitoring, not a point-in-time exercise: ISO 27001's Plan-Do-Check-Act cycle, PCI-DSS's quarterly scans and annual reassessment, and NIST CSF's Detect and Respond functions.
Path to adoption: voluntary, free, no certification. Build a Current Profile, define a Target Profile against your risk tolerance (expressed through Tiers), run a gap analysis, and use the Informative References to map each Subcategory to more detailed controls (NIST SP 800-53, ISO 27001, COBIT, and others) you may already have implemented.
- NIST Cybersecurity Framework - The official NIST CSF 2.0 home page: the framework document, quick-start guides, and the Reference Tool.
- CSF 2.0 Informative References - NIST's official crosswalk from each CSF Subcategory to other standards (ISO 27001, SP 800-53, COBIT, and more), with Implementation Examples.
- CSF 2.0 Quick-Start Guides - Role- and topic-specific short guides, including ones for small business, supply chain risk, and enterprise risk management.
- CSF Tools - Community-run, free browsable reference for CSF 2.0 with Function/Category/Subcategory drill-down and cross-framework mappings.
- NIST SP 800-53 - The detailed security and privacy control catalog most Informative References ultimately point to. The de facto US federal control baseline.
Path to adoption: certifiable via an accredited certification body. Requires a documented ISMS, a risk assessment methodology, a Statement of Applicability against Annex A, and a two-stage external audit followed by a 3-year certification cycle.
- ISO/IEC 27001:2022 - The official standard. Paywalled; ISO does not publish the full control text for free. This is the authoritative source and the version organizations must now be certified against.
- ISO/IEC 27002:2022 - Companion standard providing implementation guidance for each Annex A control referenced by 27001. Also paywalled.
- ISO27k Toolkit - Long-running, free, community-maintained (ISO27k Forum) set of ISMS templates, policies, and awareness materials aligned to 27001. Creative Commons Attribution-NonCommercial-ShareAlike.
- ISO27001security.com - The ISO27k Forum's reference site: FAQs, glossary, standard-by-standard notes, and links to the wider ISO27k family (27002, 27005, 27017, 27018, 27701).
- ISO/IEC 27005 - The companion information security risk management standard referenced by 27001 Clause 6.1.2.
Path to adoption: mandatory for any organization storing, processing, or transmitting cardholder data. Enforced contractually by the card brands via the acquiring bank, not by a government regulator. Validation method (SAQ vs ROC) depends on transaction volume and merchant/service-provider level.
- PCI Security Standards Council - The official standards body. Home of the PCI-DSS document library, SAQs, and the QSA/ASV programs.
- PCI-DSS v4.0.1 - The current, only active version of the standard (v3.2.1 has been retired). Free to download after a short registration.
- PCI-DSS Self-Assessment Questionnaires (SAQs) - The full set of SAQ types (A, A-EP, B, B-IP, C, C-VT, D, P2PE) used for self-validation depending on how card data is processed.
- PCI-DSS Prioritized Approach Tool - Official spreadsheet tool for sequencing PCI-DSS implementation by risk-reduction milestone rather than requirement order.
- List of Approved Scanning Vendors (ASVs) - Required for the quarterly external vulnerability scans mandated under Requirement 11.3.2 for any externally facing system in the CDE.
Path to adoption: voluntary, free, no certification (CIS SecureSuite membership adds paid tooling and support). Eighteen prioritized safeguards organized into three Implementation Groups (IG1, IG2, IG3), scaled from essential cyber hygiene up to controls appropriate for organizations facing sophisticated attacks.
- CIS Critical Security Controls - The official home of CIS Controls v8.1: the full control list, safeguards, and supporting implementation guides.
- CIS Controls Navigator - Interactive tool for filtering Safeguards by Implementation Group and cross-mapping them to NIST CSF, ISO 27001, and other frameworks.
- CIS Controls Implementation Groups - Guidance on which IG applies based on organizational size, data sensitivity, and risk tolerance.
- CIS-CAT Lite - Free configuration-assessment tool scoring systems against CIS Benchmarks, the technical-hardening companion to the Controls.
- CIS SecureSuite Membership - Paid membership tier unlocking CIS-CAT Pro, the CIS Controls Self Assessment Tool (CIS CSAT), and additional benchmark content.
Path to adoption: voluntary, but increasingly the de facto US financial-sector baseline since the FFIEC retired its Cybersecurity Assessment Tool (CAT) in August 2025 and pointed institutions toward it. Not certifiable; institutions self-assess against it or present it to examiners as evidence of a structured program. Built by the Cyber Risk Institute (CRI) as a financial-services-specific extension of NIST CSF, harmonizing more than two dozen regulatory frameworks into a single diagnostic questionnaire.
- Cyber Risk Institute - The organization behind the Profile, backed by a consortium of financial trade associations and institutions.
- The Profile - The current version: diagnostic statements and scoping questions built on NIST CSF, with mappings to FFIEC, NYDFS 500, GLBA, and other sector regulation.
- FinServ Compliance list - The companion list covering the CRI Profile in its full financial-services regulatory context, including the FFIEC CAT retirement it replaces.
Path to adoption: mandatory for US Department of Defense information systems and contractors operating on them; voluntary but widely adopted elsewhere as a rigorous, prescriptive hardening baseline. Not self-certifiable — DoD systems verify compliance through the RMF authorization (ATO) process, typically using SCAP-automated scanning against STIG content.
- DISA STIGs - The official, authoritative home of Security Technical Implementation Guides: downloadable STIGs for operating systems, network devices, applications, and cloud services.
- SRG-STIG Tools - DISA's free STIG Viewer (for reviewing checklists and tracking manual findings) and SCAP Compliance Checker (SCC) for automated scanning.
- Security Requirements Guides (SRGs) - The broader, technology-family-level requirements that product-specific STIGs are derived from; the reference to use when no STIG exists yet for a given product.
- Federal Compliance list - The companion list covering DISA STIG in its full DoD/federal regulatory context alongside FedRAMP, CMMC, and the DoD Cloud Computing SRG.
Path to adoption: voluntary; free to download and use, though CIS SecureSuite membership is required for some automated build content and commercial redistribution. Prescriptive, platform-specific hardening guides distinct from the CIS Controls above — a Benchmark is the technical "how" for the configuration-level Safeguards a Control calls for, applied to one specific product.
- CIS Benchmarks - The full, browsable catalog of CIS hardening benchmarks by vendor and product (operating systems, cloud providers, containers, network devices, and applications).
- CIS-CAT Lite - Free automated tool for scoring a system against a CIS Benchmark and generating a compliance report.
- CIS Hardened Images - Pre-hardened virtual machine images built to CIS Benchmark specifications, available on major cloud marketplaces.
- CIS SecureSuite Membership - Paid tier unlocking CIS-CAT Pro, Build Kits for automated remediation, and full Benchmark PDF access.
- Secure Controls Framework (SCF) - Free, open (Creative Commons) meta-framework of roughly 1,400 controls across 34 domains, mapped outward to 250+ laws, regulations, and frameworks including NIST CSF, ISO 27001, PCI-DSS, HIPAA, and GDPR. The closest thing to a Rosetta Stone across all three frameworks in this list.
- SCF Controls Platform - Open-source, self-hosted GRC platform built natively on the SCF, scoping controls against 350+ frameworks with maturity tracking and evidence workflows.
- NIST OSCAL - NIST's open, machine-readable (XML/JSON/YAML) format for representing control catalogs, system security plans, and assessment results, intended to automate what is today mostly manual crosswalk and evidence work.
- Vanta - Commercial compliance automation platform with continuous control monitoring across SOC 2, ISO 27001, PCI-DSS, and NIST CSF from one evidence pipeline.
- Drata - Commercial compliance automation platform, comparable scope to Vanta, with automated evidence collection and a shared-control model across frameworks.
- Secureframe - Commercial compliance automation platform covering the same core framework set, with vendor risk management and trust-center features.
- Hyperproof - Commercial GRC platform focused on control-to-evidence traceability across multiple simultaneous frameworks.
- OneTrust - Enterprise GRC and privacy platform covering security frameworks alongside broader privacy and third-party risk management.
- Prowler - Open-source cloud security and compliance scanner for AWS, Azure, GCP, and Kubernetes. Ships ready-made checks mapped to CIS, NIST 800-53, NIST CSF, PCI-DSS, HIPAA, FedRAMP, and more.
- InSpec - Chef's open-source compliance-as-code framework. Write auditable, version-controlled profiles that test infrastructure against CIS, PCI-DSS, and NIST baselines.
- OpenSCAP - Open-source implementation of the Security Content Automation Protocol (SCAP) for automated vulnerability and configuration compliance scanning against standard baselines.
- ScoutSuite - Open-source multi-cloud security auditing tool from NCC Group, producing a single report across AWS, Azure, GCP, and others.
- Lynis - Open-source security auditing tool for Unix/Linux systems, widely used for hardening checks that feed PCI-DSS and ISO 27001 technical control evidence.
- NIST CSF 2.0 Reference Tool - NIST's official interactive tool for browsing, filtering, and exporting the CSF Core, Informative References, and Implementation Examples.
- ISO 27001 Internal Audit Checklist (ISO27k Toolkit) - Internal-audit-specific templates within the free ISO27k Toolkit, covering audit planning, checklists, and nonconformity tracking.
- PCI-DSS Approved Scanning Vendors - Directory of ASVs certified to run the mandatory quarterly external scans.
- PCI-DSS Qualified Security Assessors (QSAs) - Directory of firms and individuals certified to produce a Report on Compliance (ROC).
- CIS-CAT Lite - Free configuration-assessment tool from the Center for Internet Security, scoring systems against CIS Benchmarks that map into NIST CSF and PCI-DSS technical requirements.
- ISC2 CISSP - Certified Information Systems Security Professional. The most widely recognized general security-management certification, covering domains relevant to all three frameworks.
- ISACA CISA - Certified Information Systems Auditor. The standard credential for IT audit professionals assessing ISO 27001 and PCI-DSS controls.
- ISACA CRISC - Certified in Risk and Information Systems Control, focused on the risk-assessment step common to all three frameworks.
- PCI SSC Qualified Security Assessor (QSA) Program - Official qualification path for individuals and firms wishing to conduct PCI-DSS Reports on Compliance.
- PCI SSC Internal Security Assessor (ISA) Program - Training for internal staff to conduct PCI-DSS self-assessments with QSA-equivalent rigor.
- PECB ISO/IEC 27001 Lead Implementer - Widely held certification for practitioners who design and implement an ISMS.
- PECB ISO/IEC 27001 Lead Auditor - Certification for practitioners who audit an ISMS against 27001, including certification-body auditors.
- NIST NICE Framework - US framework for cybersecurity workforce roles and the skills, including CSF-adjacent governance and risk roles, that map to it.
- National Institute of Standards and Technology (NIST) - US federal agency responsible for the Cybersecurity Framework, the SP 800 series, and OSCAL.
- NIST Computer Security Resource Center (CSRC) - NIST's publication hub for all cybersecurity standards, including SP 800-53, SP 800-171, and CSF-related guidance.
- International Organization for Standardization (ISO) - The standards body publishing the ISO/IEC 27000 family, including 27001 and 27002.
- PCI Security Standards Council - The industry body (founded by the major card brands) that owns and maintains the PCI-DSS standard and its assessor programs.
- Center for Internet Security (CIS) - Publisher of the CIS Critical Security Controls and CIS Benchmarks, both heavily cross-referenced by NIST CSF and PCI-DSS.
- NIST CSF 2.0 Small Business Quick-Start Guide - Plain-language starting point for organizations with no dedicated security team.
- ISO27k Forum - Free, long-running practitioner mailing list and knowledge base for anyone implementing or auditing ISO 27001/27002.
- PCI SSC Document Library - The single authoritative source for every current PCI-DSS supporting document: SAQs, ROC templates, guidance notes, and FAQs.
- SANS Institute Security Compliance Resources - Practitioner-oriented white papers and webcasts covering implementation of all three frameworks.
- AI Governance - A companion curated list covering AI-specific governance: regulation, standards, and runtime controls for autonomous agents.
- FinServ Compliance - A companion curated list covering US financial-services-specific regulation and the CRI Profile in full sector context.
- awesome-cybersecurity-blueteam - Broader defensive-security tooling list, useful alongside the audit and scanning tools above.
- Risk Management - A companion curated list covering the risk register, heat maps, and treatment planning that unresolved findings from this list feed into.
- VAPT - A companion curated list covering penetration testing methodology and free tools (Nmap, Nessus, Burp, Metasploit) for validating the controls in this list.
- Federal Compliance - A companion curated list covering FedRAMP, CMMC, and NIST SP 800-53/171 — the federal-sector-specific controls and SSP/POA&M process related to this list.
- Cloud Security - A companion curated list covering the shared responsibility model, AWS/Azure/GCP-specific security, and SOC 2 — the cloud-specific implementation layer for these controls.
PRs welcome. See CONTRIBUTING.md for the criteria a new entry must meet.
This list is published under CC0 1.0 Universal. The linked resources retain their own licenses; ISO/IEC 27001 and 27002 in particular are paywalled standards and not freely redistributable.