Frameworks Overview

"Framework" gets used loosely across security, risk, audit, and privacy work to mean quite different things — a voluntary control catalogue, a legally binding regulation, an independent assurance standard, and a knowledge base of adversary behavior are all called "frameworks," but they serve different purposes and none of them substitute for another. This article maps the landscape: the different types of frameworks and what each is actually for, an overview of the major security and risk frameworks (ISO 27001, MITRE, NIST), a look at regulatory frameworks including APRA's CPS 230/CPS 234 and the ASAE 3402 assurance standard, privacy frameworks across Australia, the US, EU, and Canada, and a reference table of which frameworks typically apply by industry.

1. Types of Frameworks

A single organization typically operates against several of these simultaneously and layered — a regulatory framework sets the non-negotiable floor, a control framework provides the operational backbone to meet it, an assurance standard proves it to third parties, and threat knowledge bases inform what to actually test and detect.

2. Major Security and Risk Frameworks

ISO/IEC 27001

The dominant international standard for an Information Security Management System (ISMS) — a management system (policies, risk assessment process, continual improvement cycle), not just a control list. The 2022 revision's Annex A contains 93 controls grouped into four themes: Organizational, People, Physical, and Technological. Certification is issued by an accredited third-party body following a formal audit, and is widely used as the portable, cross-border proof point of a mature security program — particularly valuable when dealing with international customers or regulators who don't share a common local framework.

NIST

NIST publishes several distinct frameworks that get conflated but serve different purposes:

MITRE

MITRE's frameworks are knowledge bases of real-world adversary behavior, not compliance standards — they answer "what do attackers actually do" rather than "what controls should exist":

• MITRE ATT&CK — a matrix of adversary tactics and techniques observed in real intrusions (Enterprise, Mobile, and ICS variants), used for red/purple team scoping, detection engineering, and threat-informed defense.
• MITRE ATLAS — the AI-specific equivalent of ATT&CK, covering techniques like training data poisoning, model extraction, and adversarial evasion (see AI Model Security Assessment).
• MITRE D3FEND — a complementary knowledge graph of defensive techniques, mapped against the offensive techniques they counter.

CIS Controls and ACSC Essential Eight

Two widely referenced, more prescriptive alternatives to the broader frameworks above:

• CIS Controls (v8) — 18 prioritized controls with three Implementation Groups (IG1–IG3) scaled to organizational maturity and resource level, popular for its concrete, actionable starting point.
• Essential Eight (ACSC, Australia) — eight mitigation strategies (application control, patching applications/OS, restricting admin privileges, MFA, and others) with four maturity levels (0–3), mandatory for Australian non-corporate Commonwealth entities and a common voluntary baseline elsewhere in the Australian private sector.

3. Regulatory Frameworks

Regulatory frameworks are legally binding — non-compliance carries statutory penalties, not just reputational or contractual consequences. Three Australian examples, plus international grounding:

CPS 230 — Operational Risk Management (APRA)

Effective 1 July 2025, CPS 230 consolidated and superseded the previous CPS 231 (Outsourcing) and CPS 232 (Business Continuity) standards for APRA-regulated entities (banks, insurers, superannuation trustees). It requires entities to:

• Identify critical operations and set tolerance levels for disruption to them.
• Maintain and regularly test business continuity plans against severe but plausible scenarios.
• Actively manage risk arising from material service providers — including assessing provider resilience and having exit plans, which is where a service provider's own ASAE 3402/SOC 2 report becomes directly relevant evidence.

CPS 234 — Information Security (APRA)

In force since July 2019, CPS 234 requires APRA-regulated entities to maintain information security capability commensurate with the size and extent of threats to their information assets, with:

• Clearly defined information security-related roles and responsibilities, including Board-level accountability.
• Regular testing of security controls, with independent review of the testing program's effectiveness.
• Mandatory notification to APRA of a security incident within 72 hours of becoming aware of it (where it materially affects, or has the potential to materially affect, the entity or its customers), and notification of a material control weakness within 10 business days.

ASAE 3402 — Assurance Reports on Controls at a Service Organization

ASAE 3402 is the Australian Auditing and Assurance Standards Board's adoption of the international ISAE 3402 standard, and is the direct Australian equivalent of the US SOC 1 (under SSAE 18). It governs how an independent auditor reports on the design (Type I) or design and operating effectiveness over a period (Type II) of controls at a service organization — typically an outsourced provider (payroll processors, super fund administrators, cloud/IT service providers) whose controls matter to their customers' own financial statement audits or regulatory obligations. For an APRA-regulated entity managing CPS 230 material service provider risk, a supplier's current ASAE 3402 Type II report is often the primary artifact reviewed during due diligence — distinct from a SOC 2 report, which addresses security/availability/confidentiality/processing integrity/privacy trust criteria rather than financial-reporting-relevant controls specifically.

International Grounding

4. Privacy Frameworks by Region

Privacy regulation is the area with the least international convergence — approach, scope, and enforcement differ substantially by region.

Australia

The Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) govern handling of personal information by most Australian government agencies and private-sector organizations above a turnover threshold (with sector-specific exceptions that bring some smaller entities into scope regardless). The Notifiable Data Breaches (NDB) scheme requires notification to affected individuals and the regulator — the Office of the Australian Information Commissioner (OAIC) — for breaches likely to result in serious harm. A significant reform tranche has been progressing that increases penalties, introduces a statutory tort for serious invasions of privacy, and adds specific protections for children's online privacy — check current status, as this area has been actively moving.

United States

The US has no single comprehensive federal privacy law — it's a sectoral patchwork:

• HIPAA — health information.
• GLBA — financial institution customer information.
• COPPA — children's online data.
• FTC Act Section 5 — a general backstop against "unfair or deceptive" practices, used by the FTC to enforce against privacy failures with no sector-specific law.
• State laws — led by California's CCPA/CPRA, the most influential and closest US analogue to GDPR-style rights (access, deletion, opt-out of sale/sharing). A growing list of other states (including Virginia, Colorado, Connecticut, Utah, and Texas) have enacted their own comprehensive laws, each with meaningful variation in scope, thresholds, and consumer rights — multi-state operators face a genuine patchwork rather than one standard.

European Union

The GDPR is the most comprehensive privacy framework globally and has extraterritorial reach — it applies to any organization processing EU residents' personal data regardless of where the organization is based. Core principles include lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, and accountability, backed by enumerated data subject rights (access, erasure, portability, objection), mandatory 72-hour breach notification, a Data Protection Officer requirement for certain organizations, and fines of up to 4% of global annual turnover or €20 million, whichever is higher. The ePrivacy Directive (and its long-pending successor Regulation) separately governs cookies and electronic communications, complementing rather than replacing GDPR.

Canada

PIPEDA (Personal Information Protection and Electronic Documents Act) is the federal private-sector privacy law, built around 10 fair information principles, with mandatory breach notification in force since 2018. Provinces with their own "substantially similar" legislation are exempted from PIPEDA for intra-provincial activity — most notably Quebec's Law 25, which is materially more stringent and GDPR-influenced (including a private right of action and biometric-specific requirements), alongside Alberta's and British Columbia's own PIPA statutes. Federal reform (via the proposed Consumer Privacy Protection Act) has been under active legislative consideration — confirm current status, as Canadian federal privacy reform has moved on an uneven timeline.

5. Framework Applicability by Industry

Frameworks typically layer: a regulatory floor, a security/risk backbone, an assurance standard used with customers/regulators, and privacy obligations tied to where data subjects are located rather than where the organization operates.

This is a starting reference, not an exhaustive compliance determination — actual applicability depends on specific licensing, customer contracts, and data-subject location, and should be confirmed with legal/compliance counsel for a given entity.

6. Choosing and Layering Frameworks in Practice

A practical adoption order, rather than treating every framework as equally optional:

1. Start with what's legally mandated for your jurisdiction and sector — regulatory frameworks are non-negotiable and set the floor (e.g., an APRA-regulated entity has no choice about CPS 234).
2. Add what's contractually required by customers — SOC 2 or ASAE 3402 is frequently a sales/procurement gate even where no regulator mandates it directly.
3. Adopt a control framework as the operational backbone — ISO 27001 or NIST CSF gives structure to actually meet the requirements above, rather than treating each regulatory obligation as a one-off project.
4. Layer privacy compliance based on where your data subjects are, not just where you're headquartered — GDPR's extraterritorial reach and the expanding US state-law patchwork mean this is rarely a single-jurisdiction question even for a locally-focused business.
5. Use threat knowledge bases (MITRE ATT&CK/ATLAS) to scope testing and detection engineering — they tell you what to actually test for and detect, which the compliance frameworks above generally don't specify at that level of technical detail.

References

• ISO/IEC 27001
• NIST Cybersecurity Framework 2.0
• NIST SP 800-53 Rev. 5
• MITRE ATT&CK
• MITRE ATLAS
• MITRE D3FEND
• ACSC Essential Eight
• APRA CPS 230 — Operational Risk Management
• APRA CPS 234 — Information Security
• AUASB — ASAE 3402
• OAIC — Australian Privacy Principles
• GDPR (EUR-Lex)
• Office of the Privacy Commissioner of Canada — PIPEDA
• California Privacy Protection Agency — CCPA/CPRA
• MCP Security Assessment
• AI Model Security Assessment