What is a security framework?
A security framework gives information security a structure: it defines which topics an organisation should cover, what has to be in place for each topic and how to tell. This article clarifies the terms and introduces three frameworks that are particularly relevant for Swiss organisations.
The short definition
A security framework is a structured set of requirements and measures for information security. It answers three questions: Which topics are included? What has to be in place for each topic? And how can you tell whether it is?
That is what separates it from a list of good tips. A framework is complete in its ambition: it covers organisation, people, technology and processes so that no important gap is overlooked. And it is testable: every requirement can be backed by evidence – or not.
A framework usually does not prescribe specific products. It requires, for example, that data is backed up regularly and that backups are tested, but not with which software. This is why it stays valid for years even when technology changes.
Framework, standard, control, evidence
In everyday use the terms are often mixed up. For an audit it pays to keep them apart. The hierarchy is similar in all common frameworks:
- Frameworkstructure and approach – e.g. the ICT Minimum Standard
- Function or themee.g. “Protect”
- Categorye.g. PR.AC – access control
- Controle.g. PR.AC-1 – grant permissions through a defined process
- Evidencee.g. access control concept, record of the last access review
- Framework: the structure as a whole – organisation, topics and approach.
- Standard: a formally published document. For a standard such as ISO/IEC 27001, an independent body can confirm conformity.
- Function, theme, category: groups of related requirements, such as “access control” or “data security”.
- Control: a single, testable requirement with a control objective. The ICT Minimum Standard calls them measures or tasks, ISO/IEC 27001 calls them controls.
- Evidence: what shows that a control is in place – a document, a log, a screenshot or a documented interview.
Frameworks differ less in these levels than in their structure, their level of detail, and who publishes them for what purpose.
Three frameworks that matter in Switzerland
ISO/IEC 27001:2022
ISO/IEC 27001 is the international standard for information security management systems (ISMS). ISO and IEC publish it jointly; the current edition dates from 2022 and was supplemented by an amendment in 2024. The main body, clauses 4 to 10, describes the management system: context and scope, leadership, planning and risk treatment, support, operation, performance evaluation and improvement. Annex A lists the controls in four themes: organisational, people, physical and technological. How to implement them is described in the companion standard ISO/IEC 27002.
What makes it special: an organisation can be certified against ISO/IEC 27001 by an accredited certification body. This makes the standard the reference whenever customers or partners require formal proof.
ICT Minimum Standard
The “Minimum standard for improving ICT resilience”, or ICT Minimum Standard for short, is a recommendation of the Swiss federal government. It was developed by the Federal Office for National Economic Supply (FONES) together with external experts; since March 2024 the Federal Office for Cybersecurity (BACS) has been responsible for it. The current version of May 2023 builds on the core of the NIST Cybersecurity Framework and contains 108 measures in five functions: Identify, Protect, Detect, Respond and Recover.
It is aimed primarily at operators of critical infrastructure, but according to its own text it can be applied by any company or organisation and is freely available. More in the article The ICT Minimum Standard for SMEs.
NIST Cybersecurity Framework (CSF)
The Cybersecurity Framework of the US National Institute of Standards and Technology (NIST) is widely used around the world. Version 2.0 of February 2024 is organised into six functions: Govern, Identify, Protect, Detect, Respond and Recover. “Govern” is new: strategy, roles, policies and supply chain risk management now come first as a function of their own. Version 2.0 is explicitly intended for organisations of any size and sector.
| Aspect | ISO/IEC 27001:2022 | ICT Minimum Standard 2023 | NIST CSF 2.0 |
|---|---|---|---|
| Publisher | ISO and IEC | Swiss federal government (FONES, now BACS) | NIST (USA) |
| Type | Standard with requirements for an ISMS | Recommendation with concrete measures | Framework of desired outcomes |
| Structure | Clauses 4–10, Annex A with 4 themes | 5 functions, 23 categories | 6 functions |
| Certification | yes, by accredited bodies | no; self-assessment or review by a third party | no |
| Availability | standard text must be purchased | freely available | freely available |
How the frameworks relate
The three frameworks are not competitors. The ICT Minimum Standard adopts the structure of the NIST CSF and lists matching references in other standards for each category, including ISO/IEC 27001:2022. If you already work with ISO or NIST, you can use the checklist in the ICT Minimum Standard to see whether its requirements are already covered.
In practice, the choice of framework mainly determines how you structure your work and to whom you demonstrate it. The actual measures overlap considerably: inventory, access rights, updates, backups, incident planning, training. The differences in detail are covered in ISO 27001 vs. ICT Minimum Standard.
What a framework means in everyday work
A framework is not a project with an end date but a cycle: you decide which controls apply, assess the current state, close gaps and assess again. The ICT Minimum Standard recommends reviewing at least once a year. ISO/IEC 27001 requires internal audits at planned intervals and a review by top management.
For this to work you need three things:
- A scope: which sites, systems and processes are included?
- A justified selection of controls: which requirements apply, which do not – and why?
- A traceable assessment: a status or maturity level for each control, backed by evidence.
How Audhive helps
Audhive ships two catalogues: ISO/IEC 27001:2022 with 94 controls (German and English) and the ICT Minimum Standard 2023 with 108 controls (official texts in German, English, French and Italian), each control with objective, expected documentation and guidance. For each tenant you define in the control set what applies, rate it in the assessment and request evidence through data requests. Your own frameworks come in as CSV. Audhive does not change the standards themselves: it ships the ICT Minimum Standard in its official wording (obvious errors corrected and marked) and ISO/IEC 27001 as a short description per control, each with Audhive’s own working aids; the originals are authoritative (origin of the catalogues). More under Workflows.
Sources
- ISO: ISO/IEC 27001:2022 – Information security management systems
- Federal Office for Cybersecurity (BACS): ICT minimum standards (page in German)
- NIST: Cybersecurity Framework