Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

ISO 27001 is the international standard for information security and protection. It’s roughly equivalent to similar infosec frameworks in the United States, like FedRAMP and CMMC, but the international development, maintenance, and scope of the ISO framework makes it much more commonly seen outside of US Government contracting. In the US, it’s clear that a security framework mandated by the government is required when working as a contractor for the government. What about ISO 27001?

If you’ve spent any length of time reading about the internationally accepted security framework laid out in ISO 27001, you’ve likely come across the term ISMS or Information Security Management System. You may wonder, though; what is the ISMS specifically, how do you set one up, and what does it do for your business? Let’s talk about it.

One of the biggest burdens on any government agency or contractor is dealing with controlled unclassified information, or CUI. This information requires oversight, security, access control, and record-keeping – all part of the general “control” of that information – and keeping track of it all can be a huge task. One way in which this task is made easier is through the process of decontrol.

We’ve talked a lot on this blog about protecting controlled unclassified information, and we’ve mentioned in places some other kinds of information, like classified and secret information, covered defense information, and other protected information. There’s one thing all of this information has in common: it’s generated by the United States government.

We’ve written a lot about various security frameworks, from CMMC to ISO 27001, and throughout all of them, one of the core elements is the need to protect CUI. Information that is controlled at a very high – SECRET, Classified, or other – level is tightly bound by specific rules and can only be handled by select individuals. Completely base, public information is freely available and completely uncontrolled. But there’s a lot of information somewhere in the middle.

As the strongest and most well-recognized security certification around the world, ISO 27001 is a very popular – and very stringent – framework to adhere to. If you’re a business operating anywhere in the world, and you want to achieve security levels that build confidence and open doors with customers and clients who value trust, ISO 27001 is a great option.

When you consider national and global cybersecurity, a handful of names stand out. Two of the largest are NIST and ISO/IEC. Both of these organizations have issued plenty of rulings and frameworks for securing digital systems, and in a sense, they can be viewed as competitors. So, what’s the difference, where is the overlap, and which option is right for your business?

We’ve written extensively before about FedRAMP’s impact levels. As a brief refresher, there are four: You can read our full guide to these four impact levels, how they’re calculated, and what they mean in this post. One important thing to know here is that FedRAMP is not the be-all and end-all security framework for the government.

CMMC is a familiar framework to any contractor working as part of the defense industrial base and handling any form of controlled unclassified information. Whether it’s compliance in general, a specific clause relating to DFARS 252.204-7012 in your contract, or impetus from another source, you’re going to need to implement security standards from NIST SP 800-171 and adhere to the rules laid out in the Cybersecurity Maturity Model Certification framework.

In the world of government-adjacent security and compliance, there are many different terms and acronyms you’ll encounter for the processes you have to perform. Often, these terms are interrelated in a single process, so you tend to learn them in clusters. One such cluster includes STIGs, SRGs, SCAP, and CCIs. What are these, what do they mean, and what do you need to do to utilize them properly? Let’s answer the most commonly asked questions.