| Primary Focus |
Formal Information Security Management System (ISMS) |
Cybersecurity Risk Management Lifecycle |
Prioritised Technical Cyber Defense |
Governance & Management of Enterprise I&T |
| Core Audience |
Security & Compliance Officers, Auditors, Senior Management |
Senior Executives, Risk Managers, Security Leadership |
IT & Security Operations Teams, System Administrators |
Board of Directors, CIO, CISO, IT Governance & Audit |
| Approach |
Prescriptive on process, flexible on controls. Mandates a formal, documented, risk-based system. |
Descriptive and adaptive. Provides a high-level structure to organize security activities. |
Highly prescriptive on controls. A prioritised checklist of technical actions. |
Process and governance-oriented. Focuses on aligning IT with business goals through defined processes. |
| Key Output |
A formal, auditable, and certifiable ISMS. |
A "Current Profile" and "Target Profile" of cybersecurity capabilities. A risk management plan. |
An implemented baseline of technical "cyber hygiene" and security controls. |
A tailored governance system for enterprise I&T, with clear roles, responsibilities, and metrics. |
| Level of Detail |
High on management processes; Medium on control guidance (via ISO 27002). |
High-level functions; refers to other standards (like CIS, ISO) for detailed controls. |
Very High on specific technical safeguard implementation. |
High on governance and management processes; Low on specific technical security controls. |
| Strengths for NG |
Provides the formal structure and international certification needed to fix "disarray" and build trust. |
Offers an intuitive way to organize the security program and communicate with leadership. |
Delivers an immediate, actionable plan (IG1) to quickly reduce the most common risks. |
Establishes top-down executive oversight needed to protect "billions" in IP and align security with strategy. |
| Weaknesses for NG |
Can be slow and bureaucratic to implement initially. May not provide enough "quick wins." |
Not prescriptive enough on its own; doesn't tell a team in disarray what to do first. Not certifiable. |
Lacks the overarching governance and risk management framework needed for a mature program. |
Too abstract and complex to fix immediate technical issues. Must be paired with a security-specific framework. |
| Certifiable? |
Yes, accredited certification for ISO 27001 is a key feature. |
No, it is a voluntary framework, not a standard for certification. |
No, though some tools can assess compliance with the controls. |
Yes, certifications exist for professionals (e.g., CGEIT) and assessors, but not for the organisation itself like ISO. |