Chapter 2 of 13 · Days 1–5
The Frameworks You Inherited
- Which frameworks are we actually following, and which are just mentioned in slides?
- What is the difference between a standard, a framework and a law?
- Do I need to know all 93 ISO 27001 controls by heart?
You will hear many names in your first week. Some are certifications the company holds. Some are laws that apply whether anyone planned for them or not. Some are slides from a project that stopped two years ago. Your first job is to sort them.
Three kinds of obligation
| Kind | Examples | Who checks it |
|---|---|---|
| Certifiable standard | ISO/IEC 27001, ISO/IEC 42001 | An accredited certification body, on a cycle |
| Framework you choose | NIST Cybersecurity Framework 2.0 | Usually you, or an assessor you hire |
| Law or regulation | NIS2 in the EU, DORA for EU financial entities | A national authority or regulator |
| Contractual standard | PCI DSS v4.0.1 for card data | Assessors and your acquiring bank, per the contract |
Facts worth knowing
- ISO/IEC 27001:2022 Annex A lists 93 controls, down from 114 in the 2013 edition, grouped into four themes: organisational, people, physical and technological.
- You do not have to use every Annex A control. You decide your controls through risk treatment, then compare them with Annex A so you do not miss one. The Statement of Applicability records the result.
- NIST CSF 2.0, published 26 February 2024, has six functions: Govern, Identify, Protect, Detect, Respond and Recover.
- NIS2 member states had until 17 October 2024 to put the directive into national law. It makes top management accountable for cybersecurity risk-management measures.
- DORA is Regulation (EU) 2022/2554. It has applied since 17 January 2025 to many types of financial entities and covers ICT risk, incidents, testing and third-party providers.
- PCI DSS v4.0.1 was published on 11 June 2024. It added and removed no requirements. v4.0 was retired on 31 December 2024.
Build your obligations list
- Ask the CISO, legal and sales: what certificates do we hold, what laws apply, and what do our biggest contracts promise?
- For each item, write who checks it, how often, and when the next check is due.
- Note who owns it today. "Nobody" is a valid and important answer.
- Mark anything that is only mentioned in old slides. Ask whether it is still in scope.
The question you might not ask out loud
Do I need to memorise the frameworks?
No. Know their shape and where to look things up. What you must know by heart is your own scope, your own Statement of Applicability and your own open risks.
Rule of thumb:Many controls satisfy several frameworks at once. Map controls once and point each framework at them, rather than running a separate programme per framework.
Sources
- ISO/IEC JTC 1/SC 27 Journal 2025, Issue 1 (93 controls in ISO/IEC 27002:2022; how the SoA works) (read 2026-11-14)
- NQA, ISO 27001:2022 transition webinar (93 Annex A controls vs 114; four themes; management review inputs) (read 2026-11-14)
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29, 26 February 2024 (read 2026-11-14)
- European Commission, NIS2 Directive policy page (read 2026-11-14)
- EIOPA, Digital Operational Resilience Act (DORA) (read 2026-11-14)
- PCI Security Standards Council, Just published: PCI DSS v4.0.1 (read 2026-11-14)