“Harmonizing” ISO 27001 and NIST Cybersecurity Guidance

Last Updated on January 13, 2024

The US National Institute of Standards and Technology (NIST) is responsible for developing standards and guidelines for the US government. But NIST is very keen to support US private sector organizations as well.

In the realm of information security, how does NIST guidance relate to leading worldwide information security standards—especially the ISO 27000 family of standards?

On a recent episode of The Virtual CISO Podcast, we got the best possible answer to that pivotal question from none other than Dr. Ron Ross, who heads development of NIST’s cybersecurity and privacy publications.
“It has always been our goal… to harmonize all this guidance. But the problem really goes back to NIST SP 800-53 [Security and Privacy Controls for Information Systems and Organizations, from which NIST SP 800-171 of CMMC fame is derived],” Dr. Ross recalls. “When we first developed that document, ISO 27001 and ISO 27002 were already in print. The problem was the depth and breadth of the [ISO 27001] controls wasn’t sufficient for what we want to do in the federal government.”
“It’s not a criticism; it’s just a recognition that we have to go a little deeper and a little broader for our particular missions,” clarifies Dr. Ross. “Our first goal is always to create an international level standard. That’s better for US industry because many of our companies compete globally now. So, it’s not a lot of fun to comply with two standards: ISO and the NIST guidance. But that was something we had to do.”
“When you do an ISO standard, you’ve got to have agreement with [something like] 180 countries, and that’s hard to do,” Dr. Ross adds. “There are a lot of compromises made, and you try to get the best product you can with the greatest consensus. … We just haven’t found a way to do that yet.”

So… never the twain shall meet? Maybe not completely, given the specific needs of US government agencies. But there is a lot of deliberate overlap and cross-referencing between NIST’s efforts and those of ISO.

As Dr. Ross points out: “The good news is every time we release [a new revision of] 800-53, ISO 27001 folks are looking at that. And every time they release a new update, we are looking at what they have done. So, we are trying to keep up with each other.”
NIST also puts tremendous effort into cross-referencing its cybersecurity guidance with ISO 27001 and other leading cyber standards. But are those mappings all they’re cracked up to be?
“You know mappings are always subjective,” Dr. Ross points out. “Unless you’re using first order predicate calculus, you’re not going to get an exact mapping. But mappings are important for our customers—and that’s the reason we do what we do. We are all about our customers and if they’re successful then that means we’ve done our job.”  
Dr. Ross continues: “Just think: from a business perspective, many of our federal agencies have lots of different contractors. Many of these contractors who are supporting them are also working globally. So they may have already done an ISO certification on a scope of applicability for an ISO 27001 set of controls. The reason the mapping is important is that’s actually value–added. We shouldn’t always want to have them implement controls again, just because they’re from the NIST catalog.”