Which framework is commonly used for mapping information security controls in third-party risk management?

• A. ISO 27001
• B. NIST Cybersecurity Framework (CSF)
• C. COBIT
• D. PCI DSS

Answer: (B)

In third-party risk management, teams map security controls to vendor practices to understand risk exposure and identify gaps across the supply chain. The NIST Cybersecurity Framework (CSF) is commonly used for this because it provides a flexible structure with core functions (Identify, Protect, Detect, Respond, Recover) and a broad set of categories that align with many control baselines. Importantly, the CSF is designed to be cross-wwalkable to other standards and controls, such as NIST SP 800-53 and ISO 27001, which makes it easier to map a vendor’s security controls to an organization’s risk posture and to create a consistent, language-friendly view across multiple third parties. This adaptability and wide industry acceptance help organizations assess, compare, and improve security controls across a diverse vendor ecosystem.

Other standards exist for specific purposes—ISO 27001 centers on implementing an information security management system, COBIT focuses on IT governance and control objectives, and PCI DSS targets payment card data protection. While these can inform third-party risk programs, they don’t provide the same broad, cross-mwalkable framework for mapping and comparing controls across many different vendors as the NIST CSF.