Which framework is best is the wrong first question, because the framework is rarely yours to choose. Somebody asked for something, in a contract, a tender or a questionnaire. Find that sentence, work out what would satisfy it and who has to issue it, and the framework follows.
A customer asks for a security assessment before renewal, and somebody internal is given the job of choosing a framework. They compare NIST CSF, ISO 27001 and SOC 2, read three vendor comparison pages, and pick the one that looks most thorough.
Six months later the customer asks for the SOC 2 report. The organization has a well-run ISO 27001 program and no report, because nobody went back to the sentence the customer wrote. The work was real. It answered a question nobody asked.
This piece is about avoiding that. It does not rank frameworks. It describes how to find out which one has already been chosen for you, and what it will take to satisfy whoever chose it.
The middle column is a different kind of thing on every row: answers, a report, a certificate, a status. That difference matters more than the framework name, because it decides who has to be involved and how long it takes.
In our experience the framework question almost always arrives attached to somebody else's requirement. A customer's security questionnaire. A clause in a contract renewal. A line in a tender. An insurer's application. Each of those was written by somebody with a view on what they need, and that view is in the text.
So the first step is clerical. Find the actual sentence and copy it word for word. Not a summary from a colleague, and not the account manager's recollection of a call. The exact words, because they usually contain the answer.
Steps two and three are where most of the cost hides. A certificate or a report means an outside party with its own schedule, and no amount of internal effort shortens it.
"Framework" covers several kinds of thing that behave very differently once somebody asks for evidence.
A structure you organize work around. NIST's Cybersecurity Framework is the clearest example. Version 2.0 was released in February 2024 and NIST describes its scope as all organizations in any sector, beyond the critical infrastructure the first version was written for. It has six functions: Govern, Identify, Protect, Detect, Respond and Recover. There is no certificate for it and no body that issues one. That makes it a good spine for a program and a poor answer to somebody who asked for proof.
A standard you can be certified against. ISO/IEC 27001:2022 sets requirements for an information security management system. According to ISO, certification is optional and is carried out by a certification body, not by ISO itself. An accredited certificate carries more weight because an accreditation body has confirmed the certification body is competent. If a tender asks for certification, a document saying you follow the standard does not meet it.
A report somebody else writes about you. SOC 2 is one of the AICPA's System and Organization Controls services, and the AICPA describes these as offerings that CPAs provide. The output is a report on an examination of controls at a service organization, relevant to security, availability, processing integrity, confidentiality or privacy. There is no SOC 2 certificate. A customer asking for SOC 2 is asking for a CPA firm's report, and you cannot write it yourself.
An obligation that comes with the contract. CMMC applies to US defense contracts that handle the relevant information. Under 32 CFR Part 170, Level 1 is an annual self-assessment against the basic safeguarding requirements of FAR 52.204-21, with results submitted to the Department of Defense's Supplier Performance Risk System, and no plan of action is permitted for anything not met. Level 2 rests on NIST SP 800-171 and is either a self-assessment or a third-party assessment, depending on what the contract specifies. PCI DSS applies, according to the PCI Security Standards Council, to entities that store, process or transmit cardholder data. In practice it reaches you through your agreement with the bank that processes your card payments, and that agreement is where to look for what you must show.
Once you know what would satisfy the request, you know who has to produce it, and that is what drives cost and time.
Answers to a questionnaire are yours to give. They can be given in weeks, and they are only as good as the evidence behind each one. A certificate depends on a certification body's audit schedule. A SOC 2 report depends on a CPA firm agreeing to take you on and examining your controls. A CMMC Level 2 third-party assessment depends on an assessor's availability. None of the last three can be accelerated by writing policies faster.
This is why the question of which framework is best usually costs money. A team that spends three months building an ISO-aligned program, when the customer asked for a SOC 2 report, still has to start the CPA engagement from scratch. A team that read the sentence first would have started the engagement in week one and built the program alongside it.
Most requests are narrower than they first appear. A customer asking for SOC 2 typically cares about the service they buy from you, not your whole organization. A defense contract applies to the systems that handle the covered information. A tender may name a single business unit.
That is our observation rather than a rule, and the request itself decides it. But it is worth asking the question directly: which systems, which legal entity, which service, by when. A narrower scope that genuinely covers what the customer cares about is cheaper to evidence and easier to keep current.
An organization with enterprise customers often receives a SOC 2 request from one, an ISO 27001 requirement in a tender from another, and a pile of questionnaires from the rest. This is where an internal structure earns its place.
Organize the work once, against one set of controls, and keep the evidence for each control in one place. Then each external request becomes a matter of mapping: which of your controls answer this requirement, and where is the evidence. NIST CSF is a reasonable spine for that when nothing else is already in use, because it is broad, free to read, and was written to sit above other standards rather than compete with them.
The mistake is letting the spine become the answer. Telling a customer you follow NIST CSF, when they asked for a SOC 2 report, does not respond to what they asked.
None of the left-hand phrases is a lie told on purpose. Each is a shorthand that a knowledgeable reviewer will check, and each one that fails costs the credibility of the answers around it.
None of this needs a consultant or a tool. It needs somebody to read what was actually asked, which is the step most organizations skip because the framework comparison looked like the harder and more interesting problem.
Our readiness assessment is free and editable. It asks eighty questions across ten areas, each asked twice: do you do this, and could you prove it today. The second answer is the one any of these frameworks will eventually test.
If step one came back with three answers
Send us the sentences that asked and we will spend forty-five minutes at no charge telling you what each one needs, who has to issue it, and how much of it one program can cover. If you can do it yourself, we will say so.