Gartner Information Technology Research

Security Frameworks: The What and Why, and How to Select Yours

Published: 04 February 2020

ID: G00441470

Analyst(s): Mike Wonham , Joerg Fritsch , Michael Kranawetter

Summary

Security frameworks provide a welcome basis for building a coherent security capability, but the variety can make it a difficult choice. Security and risk management technical professionals can use this comparison and mapping tool to help select which tool and how to start using it for advantage.

Table Of Contents

Comparison

  • Comparing the Framework Families

Analysis

  • Frameworks Explained
    • Security Controls Frameworks
    • Security Management Program Frameworks
    • IT Governance Frameworks
    • Lists of Controls Are Not Enough
    • Lists of Controls Can Be Too Much
    • How Much Use Are Certifications?
    • Related Frameworks Are Easier to Coordinate
    • Mapping Tool: Unified Compliance Framework

Guidance

  • Selecting a Framework
    • Building on a Preexisting Program
  • Using a Controls Framework
    • Risk Management Brings Maturity to the Process
    • IT Governance Greases the Wheels
    • A Security Management Program Is the Most Important Framework

Details

  • Framework Descriptions
    • Security Controls Frameworks
    • IT Governance Frameworks
    • Security Management Programs

Gartner Recommended Reading

©2021 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. and its affiliates. This publication may not be reproduced or distributed in any form without Gartner’s prior written permission. It consists of the opinions of Gartner’s research organization, which should not be construed as statements of fact. While the information contained in this publication has been obtained from sources believed to be reliable, Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner research may address legal and financial issues, Gartner does not provide legal or investment advice and its research should not be construed or used as such. Your access and use of this publication are governed by Gartner’s Usage Policy. Gartner prides itself on its reputation for independence and objectivity. Its research is produced independently by its research organization without input or influence from any third party. For further information, see Guiding Principles on Independence and Objectivity.

Already have a Gartner Account?

Log In

Become a client

Learn how to access this content as a Gartner client.