Cybersecurity Framework: How UK Businesses Choose and Use One

A cybersecurity framework is a structured set of practices, outcomes or controls that helps an organisation understand its cyber risk and decide what to do about it. It does not install anything. It gives you a common checklist and vocabulary so that IT, management and customers can agree what good looks like.

Several are in common use in the UK, and they differ in purpose, depth and cost. This article compares the five that UK businesses meet most often, explains how a small or mid-sized firm can choose between them, and sets out the implementation steps that apply whichever you pick.

All version details were checked against the publishers' own pages as at October 2026.

What a cybersecurity framework is, and is not

A framework organises security work into topics, such as managing assets, controlling access, detecting incidents and recovering from them. For each topic it says what outcome you need. It usually leaves the choice of tools to you.

That is why a framework is different from a regulation. A regulation, such as UK GDPR, imposes duties with legal consequences. A framework is voluntary unless a customer, regulator or contract makes it a requirement. Some frameworks also come with an external certificate or assessment, and some do not.

It is also different from a one-off audit. A framework is something you run continuously: assess, improve, reassess. The audit tells you where you are today. The framework tells you where to look next.

A framework also gives you a defensible answer when a customer, insurer or director asks how you decide what to spend on security. Pointing to a recognised structure and a dated plan is more persuasive than describing a list of tools.

Five frameworks compared

The table summarises how the five common options differ. Detail on each follows.

NIST CSF 2.0 and the Govern function

The NIST Cybersecurity Framework 2.0 was released on 26 February 2024. Its core has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is the addition in version 2.0. It puts leadership, risk strategy, roles and supplier oversight at the centre, rather than treating them as background.

NIST also publishes quick-start guides aimed at particular users, including small businesses, so that newcomers know where to begin.

CSF is a good fit for reporting to a board, because the six functions are easy to explain and to score. It is less prescriptive than ISO 27001 or CIS Controls, which is a strength for planning and a weakness if you need exact instructions.

In practice, most organisations use it as a map. Each function gets a short assessment, a current score and a target score, and the difference becomes the improvement plan. Because the Govern function sits at the top, it also helps non-technical directors see their own part in the work, rather than leaving security to IT.

ISO/IEC 27001

According to ISO's page for the standard, ISO/IEC 27001 is in its third edition, published in October 2022, and sets out requirements for an information security management system (ISMS). A 2024 amendment added climate action changes without altering the main text.

Its distinguishing feature is the management system: scope, risk assessment, risk treatment, internal audit, management review and continual improvement. Organisations can be independently certified, which is why it is common in tenders and for suppliers handling client data.

The cost is effort. You will need documented policies, a risk process and evidence that you follow them, usually with outside help for a first certification. It rewards firms with a clear scope and executive sponsorship. Certification is typically reviewed on a cycle rather than earned once, so budget for surveillance activity and internal audits as well as the first assessment. Where it is required by contract, there is rarely a substitute.

CIS Controls and the NCSC CAF

CIS Controls. The CIS Controls v8.1 list 18 Controls and, in the same release, added a Governance security function. The Implementation Groups make them usable: IG1 is described as essential cyber hygiene that every enterprise should apply, IG2 builds on it and IG3 covers all Controls and Safeguards. A small IT team can work through IG1 in order, which is why technical teams like it.

NCSC Cyber Assessment Framework. The CAF version 4.0 was published in April 2024 and reviewed in August 2025. It has four objectives and 14 principles, and it is aimed mainly at organisations running essential services, those under the NIS Regulations and critical national infrastructure. Its principles are outcome-based: they describe what good looks like, then ask you to judge how far you meet it. If you are not in those sectors, it is useful as reading rather than as a target.

Cyber Essentials as a baseline

The NCSC's Cyber Essentials scheme covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Certification starts at £320 plus VAT, and Cyber Essentials Plus adds independent technical testing.

It is narrower than the other four, which is its advantage. The scope is clear, and the evidence is short. For many UK SMEs it is the right first framework, and everything it requires also sits inside larger frameworks. Our Cyber Essentials certification guide explains the process, and our Cyber Essentials service handles it end to end.

It is a base set of controls, not a ceiling, so organisations with more sensitive processing may need measures beyond it. The Cyber Essentials requirements checklist shows what an assessor looks for.

How an SME picks a cybersecurity framework

Choose by asking five questions in order.

• Does a customer, regulator or contract name one? If so, that decides it.
• Do you need an external certificate? If yes, Cyber Essentials or ISO 27001 are the usual routes.
• Do you have a security specialist? If not, begin with Cyber Essentials or CIS IG1, which are specific enough to follow without one.
• Does the board need a reporting model? NIST CSF's six functions work well for this, whatever else you adopt.
• Are you an essential service operator? If so, expect the CAF.

Most small and mid-sized firms end up with a baseline plus a reporting model: Cyber Essentials for the controls and NIST CSF as the language of the board paper. You do not need to adopt every framework. Mapping one to another is common, so work done for one carries over to the next. Our guide to choosing an IT support company lists the questions to ask a provider about the frameworks they work with.

Implementing a cybersecurity framework: six steps

1. Set scope and sponsor. Decide which systems, sites and data are covered and name an executive owner.
2. Baseline. Score where you stand today. A cyber security audit gives a neutral starting point.
3. Rank the gaps. Use likelihood and impact so that the cheapest, highest-impact items come first.
4. Assign owners and dates. Each gap needs one named person and a deadline.
5. Run it as a service. Patching, access reviews and backup tests need a rota, which is where managed IT support typically helps.
6. Review twice a year. Re-score, report progress to the board, and update the plan after any incident or major change.

People controls belong in the plan from the start; see our guide to training employees on cybersecurity awareness for a practical programme. Resist the urge to start with documents. Evidence of controls working, such as patch reports and restore test results, is worth more than a polished policy nobody follows.

Conclusion

A cybersecurity framework earns its place when it changes what gets done next. Pick the one that answers your real constraint: a customer demand, a certificate, a board report or a technical checklist. Then assign owners and measure progress at set intervals.

For most UK SMEs that means Cyber Essentials first, with NIST CSF 2.0 for reporting and ISO 27001 only when a contract calls for it. To work out which fits your organisation, speak to NetMonkeys about framework selection and implementation.

Frequently Asked Questions (FAQs)