ISO 27001 vs NIST CSF: when a mid-market firm needs a certificate, not just a framework

This page is a buying comparison. It is for operations, IT, and compliance leads at mid-market manufacturers and professional-services firms who keep hearing two security sentences in the same quarter. One customer, or an insurer, talks about the NIST Cybersecurity Framework (CSF) 2.0. Another asks for an ISO/IEC 27001 certificate. Sales conversations will offer to "cover NIST and ISO" in one proposal. The useful question is a procurement question: which artifact does this cycle have to produce, and can you show the system behind it.

Those two artifacts are not the same product. NIST CSF 2.0 is a voluntary framework for most organizations: a shared language for cybersecurity outcomes, profiles, and tiers. NIST does not certify you against it. ISO/IEC 27001 is a management-system standard. An accredited certification body can audit the information security management system (ISMS) and issue a certificate for a defined scope. A profile can inform that system. It does not replace the certificate, and the certificate does not automatically fill a field that asked for the profile.

The certificate-versus-report fork, when the other artifact is SOC 2, is ISO 27001 vs SOC 2. Information security versus an AI management certificate is ISO 27001 vs ISO 42001. When the live question is whether to add ISO/IEC 27701 privacy certification beside the information-security certificate, that decision is ISO 27001 vs ISO 27701. When the live question is an ISO 22301 business continuity certificate versus the information-security certificate, that decision is ISO 22301 vs ISO 27001. The multi-year sequence is the 9001 → 27001 → 42001 path. Whether a management system is real enough to book Stage 1 is first ISO certification. After you pick the artifact, the ISO half still uses one outbound scope pack. You still choose a registrar for any certificate, read the quote, and verify accreditation for the legal entity and the edition. When the artifact is the ISO/IEC 27001 certificate, the directory profiles that record that standard on a cited accreditation scope are compared in how to choose an ISO/IEC 27001 certification body in the US. This page does not invent prices, audit-day counts, accreditation identifiers, or claims about which firms are accredited.

The decision here is narrower: a CSF 2.0 profile this cycle, a 27001 certificate this cycle, or neither until the system exists. Then one honest request.

1. What each artifact actually is

Skip the clause lecture. Buyers do not award work because they memorized a function wheel.

NIST CSF 2.0 is guidance for managing cybersecurity risk. NIST published it as NIST CSWP 29 on 26 February 2024 (DOI 10.6028/NIST.CSWP.29). The NIST Cybersecurity Framework site is the public home for the document and the resources that sit beside it. The publication describes a taxonomy of high-level outcomes any organization can use to understand, assess, prioritize, and communicate its cybersecurity efforts. It does not prescribe how those outcomes are achieved. It points to other resources for practices and controls.

The Core is the taxonomy: Functions, then Categories, then Subcategories. CSWP 29 names six Functions and says to address them together. The order is not a ranking, and the outcomes are not a checklist of actions. Govern sets and watches strategy, expectations, and policy, including roles, oversight, and supply-chain risk, and it shapes the other five. Identify is current risk: assets, suppliers, and where the program can improve. Protect is safeguards in use, from identity and access through data, platforms, and infrastructure resilience. Detect is finding and analyzing possible attacks. Respond is acting on an incident. Recover is restoring operations. The same Functions apply to information technology, operational technology, cloud, and artificial intelligence systems. That last point is a scope fact, not an AI certificate. Section 7 keeps ISO/IEC 42001 as a separate buy.

Organizational Profiles describe current and target posture. NIST's CSF 2.0 Profiles page has a spreadsheet for a Current Profile and a Target Profile. Current is what you achieve now. Target is what you have chosen. A profile can cover the whole organization, one system, or one threat, and you can keep more than one. A Community Profile is someone else's shared baseline. NIST hosts examples, including manufacturing and ransomware. It can inform a Target Profile. It is not your certificate.

Tiers characterize rigor: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4). CSWP 29 describes a progression from informal responses toward approaches that are agile, risk-informed, and continuously improving. Tiers complement your risk method. A higher tier is encouraged when risk, a mandate, or a cost-benefit look supports it. A tier is not a score NIST issues.

The CSF FAQ states that NIST does not offer certifications or endorsements of CSF products, implementations, or services, and has no plans for a conformity assessment program. A consultant is not required, and NIST does not recommend assessors. A workshop badge or a letter that says you are "CSF certified" is not a NIST product.

ISO/IEC 27001 is a management-system standard for information security. A certification body samples the ISMS: scope, risk treatment, and whether the controls you claim actually run. Buyers meet the control decision as a Statement of Applicability: which Annex A controls apply, and why the others do not. The 2022 edition groups that annex into organizational, people, physical, and technological themes. Name the edition. A body can certify a later edition only after its accreditation covers it.

The output is a certificate for a defined scope. Trace the issuing legal entity on IAF CertSearch and the accreditation-body directory, commonly ANAB or UKAS when those are the marks on the proposal. The method is how to verify accreditation. A logo and a sister company's schedule are not that check. The certificate shows that an accredited body examined the ISMS. It is not a promise that a breach cannot happen, and it is not a CSF profile.

You can hold a 27001 certificate and also keep a CSF 2.0 profile about the same environment. This page is about which one this request is for.

2. Who asks for which

Read the field in the contract, the vendor portal, the insurance application, or the security questionnaire. The logo on a slide is a clue. The sentence in the exhibit is the requirement.

NIST's FAQ states that NIST is not a regulatory agency and that most organizations use the CSF voluntarily. The same answer notes that Executive Order 13800 made the Framework mandatory for U.S. federal agencies, and that some companies require it of customers or suppliers. If you are not a federal agency, the requirement is the contract or the application in front of you.

A customer or insurer mentions NIST CSF 2.0 when they want a common language: "aligned to the NIST Cybersecurity Framework," "provide your CSF profile," or "which tier, and for which part of the business." They want priorities, gaps, and an owner. They have not asked an accreditation body to stand behind a certificate.

A customer, portal, or insurer names ISO/IEC 27001 when they want a certificate they can trace, for a scope that matches what they buy. International, EU, and many UK buyers do this often. So do some insurers and contractual exhibits in any country. A worksheet does not fill a field that says "ISO/IEC 27001 certificate." A 27001 certificate does not fill a field that says "CSF 2.0 Current Profile" unless that party has accepted the certificate as the evidence.

The split is not a law of geography. A U.S. subsidiary of a European group can require the certificate. A domestic customer can require only the profile. The client whose data you hold, or the OEM portal in front of you, writes the artifact.

Put a CSF 2.0 profile on this cycle when the written ask names the CSF, a profile, alignment, or a tier, and does not name an accredited certificate on a date you can point at. You can scope it the way NIST describes: the whole organization, a named system, or a named threat. Someone can walk which outcomes are in place, partial, or not started. If they asked for a target, the gap and the action plan exist. The 27001 ask, if any, is a forecast: a logo you hope to win, not a date that kills a contract this cycle.

Put ISO/IEC 27001 on this cycle when a customer, portal, insurer, or bid names that certificate, or an accredited information-security certificate, on a date you can point at. You can describe the information, where it lives, and which legal entity operates it. Someone owns risk treatment, access, incidents, and suppliers. The Statement of Applicability matches Tuesday: applicable controls have evidence, and exclusions have a reason you will defend at Stage 1. The CSF mention is a forecast, or that party has agreed in writing that the certificate is the evidence they will accept.

If neither description is true, build the system before you send. The person who writes the profile or the Statement of Applicability should not be the certification body. That split is consultant vs certification body. NIST will not name an assessor. This site will not name one either.

A SOC 2 report, a penetration test, a PCI assessment, a CMMC certificate, a FedRAMP authorization, NIST SP 800-171 as a contract clause, and Cyber Essentials are different products. If the exhibit names one of them, leave it off this request. The SOC 2 case has its own page, linked in section 7.

3. How to map one to the other

The daily work can look similar, which is why the two products get treated as one purchase. Both expect a boundary, a way to decide risk, and evidence that people do what the description says: which systems and suppliers are in scope, who has admin access, how changes and incidents are handled, how work is restored, and who accepts risk.

The CSF describes outcomes. Subcategories sit under the six Functions. NIST's CSF FAQ uses one Govern outcome as a compliance example: legal, regulatory, and contractual cybersecurity requirements, including privacy and civil liberties obligations, are understood and managed (GV.OC-03). That sentence does not name the control, the record, or the owner. Implementation Examples on the CSF 2.0 Reference Tool are suggestions. NIST says they are not a complete list and not a baseline of required actions.

The ISMS is what a certification body samples. Context, leadership, planning, support, operation, performance evaluation, and improvement are part of Stage 1 and Stage 2. The Statement of Applicability is the control decision. Annex A is the reference list. Marking every control applicable, with no evidence, is a hollow document. The pack does not need the full Statement of Applicability attached. It does need an honest map. That rule is already in the scope pack.

Govern is the CSF neighborhood that sounds most like the management-system conversation: strategy, policy, roles, oversight, supply-chain expectations, and the duties in GV.OC-03. Identify through Recover sound most like the outcomes Annex A controls are meant to support. That is orientation, not a finished crosswalk. Do not tell a certification body that "Govern covers the management-system clauses" unless you can show the relationship in a source you have opened.

NIST's way to look up relationships is an Informative Reference: a mapping between Core outcomes and another document. CSWP 29 says these mappings may come from NIST or from another organization. The CSF 2.0 Informative References page lists an ISO/IEC 27001:2022 to CSF 2.0 reference and states the limit. NIST does limited conformance testing of submissions. It does not correctness-test non-NIST mappings. A listing is not an endorsement. Use the catalog and the Reference Tool, then check each relationship against the control you operate and the evidence you could show.

A mapping can help one evidence set feed a profile and, later, an audit. It does not make a profile into a certificate, or a certificate into a Current Profile. Do not paste a blog crosswalk into the request. Do not ask a certification body to invent a mapping you have not checked. Do not treat a tier number as the grade on a future certificate.

The boundaries have to tell the same story when both artifacts describe one operation. A profile scoped to "the company" and a 27001 scope scoped to "the customer portal and the cloud account that runs it" are two systems. Write that split on purpose, or pick the boundary the customer is buying. NIST allows a profile to be as narrow as one system. An ISMS scope can be narrow too. Narrow on purpose is honest. Narrow by accident is how a customer later says the certificate misses the plant they asked about.

4. When a self-assessment is enough

Use a self-assessment when the checks in section 2 for a profile are true. NIST already describes the work in CSWP 29: scope the profile, gather the policies and practices you actually run, record the Current Profile, and add a Target Profile plus an action plan if they asked where you are going. A Current Profile is also how NIST says you can describe capabilities to a customer. A Target Profile is how you can tell a supplier what you expect. That is a communication artifact. It does not need a certification body.

An owner inside the company has to walk partial outcomes without a script. A slide that lists six verbs is not a Current Profile. A profile that marks every outcome achieved, with no evidence, fails the first working session with the customer's security team.

You can do this with your own people. If you hire help, hire an implementer. NIST does not require a consultant and will not recommend one. The implementer who drafts the profile should not be the firm you later ask to certify the ISMS. Put their name on the file.

A commercial review can still be a second set of eyes. Ask what they will hand you: a Current Profile, a gap, a tier with reasons, or a letter. They cannot hand you a NIST certificate. If the letter says "certified to the NIST Cybersecurity Framework," slow down. The verify guide is for the accreditation behind an ISO certificate. There is no NIST directory of CSF certification bodies, because the FAQ says there is no conformity assessment program.

Claim a tier only when someone asked, or when it helps you describe rigor. Partial is an acceptable answer when the program is new and you can show what Partial means here. Do not buy a project whose only purpose is to move one tier before anyone asked. If a certificate is likely later, keep the same legal entity, sites, suppliers, and owner in the profile. A profile that describes a different boundary than the future certificate is work you will undo.

5. When the certificate is the buy

The certificate is the buy when a named party will not proceed without it: a portal, a contract, a bid, or an insurance application that names ISO/IEC 27001. The test is the sentence and the date. A competitor's homepage does not create the gate. A careful Current Profile does not clear a field that says certificate.

Use the checks in section 2, then confirm four facts before you send. The scope is what the customer is buying, with sites in or out on purpose. More than one location is multi-site certification scope. Internal audit and management review have touched the ISMS, or you are not pretending they have. Readiness still has the first-certificate shape. You can name the edition, and you will verify that the legal entity's accreditation covers it. You have written what the CSF profile is this cycle: an input the ISMS already uses, a later add, or out of scope. That sentence stops a body from quoting a "NIST certification" you cannot receive.

Four sequences cover almost every room. Pick one and write it in the first paragraph of the request.

Profile first, certificate later. The live ask is the framework. Finish a Current Profile the owner can walk. Mark 27001 as a later add, with a recheck date. Do not ask a certification body to quote a certificate you will not staff.

Certificate first, profile later. The certificate is the gate. Certify the ISMS. A later profile can reuse the evidence and the boundary. Someone still has to write the outcomes in CSF language. The certificate does not generate that profile.

Both this cycle. Two requirements have dates, and both the ISMS and the profile match Tuesday. One evidence binder is fine. Two outputs remain. The certification body signs the certificate. Your organization, or an implementer who is not that body, owns the profile. Decline a line that says the ISO audit certifies the CSF.

Neither this cycle. The requirement is real and the system is a slide. Six function names are not a profile. A policy folder nobody uses is not an ISMS.

If you already hold a 27001 certificate, name the issuer, edition, scope, and expiry, and say whether the profile uses that boundary. The certificate can support the profile. It is not a NIST assessment. An existing profile can make Annex A evidence easier to find. It does not remove Stage 1.

6. How to scope the RFQ

One narrative, so the facts do not drift. Send a certification-body request only for the certificate. The ISO half uses the scope pack. The CSF half is a document you prepare for the customer or insurer who asked for it. If only one artifact is this cycle, do not dress the other up as a line item so the proposal looks complete.

Fact	If ISO/IEC 27001 is this cycle	If NIST CSF 2.0 is this cycle
What you are buying	An accredited certificate for the edition you will claim	A Current Profile, plus a Target Profile and gap plan if the ask included them. Not a NIST certificate
Who may produce it	A certification-body legal entity accredited for that standard	Your team, or an implementer who will not also certify the ISMS. NIST does not certify CSF work and does not recommend assessors
How you check them	IAF CertSearch and the accreditation-body directory (ANAB, UKAS, or the body named on the schedule)	There is no NIST CSF accreditation directory. If a firm offers a certificate, ask which standard they are accredited to issue, then verify that claim
Boundary	Information, activities, legal entity, sites, and what sits outside	The Organizational Profile scope: the whole organization, one system, or one threat, written down
Control decision	A Statement of Applicability you can defend	The Core outcomes in scope, and how far each is achieved. Implementation Examples are not a required baseline
Time	Stage 1 and Stage 2 for a first certificate. Ask for days by stage. Do not copy a number from this page	The date on the profile, and a gap plan only if they asked. Do not invent an audit length
The other artifact	Later add, an input you already use, or not this cycle	Later add, or not this cycle
Where the customer looks	The certificate and the accreditation path	The profile itself, shared with that customer or insurer

Headcount is a band per location, not the about-page total. Name the same locations in the profile and in the ISMS scope when they are truly in both. For every certification body, ask the questions in what a quote includes. Days, sites, and travel are what drives cost. This page does not publish a fee or a day count.

On the certificate request, you may say that customers also speak CSF 2.0, so the body understands the language in your policies. Do not add "NIST CSF certification" as a standard. Do not ask the body to assess a tier or to certify a community profile. On the profile you hand a customer, name version 2.0, the date, the scope, the owner, and whether a 27001 certificate already covers any of that scope.

7. Where SOC 2 and ISO 42001 fit, then send one request

SOC 2 is an attestation report from a licensed CPA firm against the AICPA Trust Services Criteria. A customer who names that report wants the report. A CSF profile does not produce it, and a 27001 certificate does not produce it. If the live fork is the certificate versus the report, use that comparison. If the fork on this page is the profile versus the certificate, write SOC 2 as out of scope unless a separate field names it.

ISO/IEC 42001 is an AI management system, examined by an accredited certification body. A customer who names 42001 wants that certificate. NIST's FAQ says there are no immediate plans to update the CSF Core for AI, and that some existing outcomes still speak to cybersecurity risks from using AI: third-party AI tools (GV.SC-07), software inventories that include AI (ID.AM-02), patching and configuration (PR.PS-01 and PR.PS-02), and awareness for people using AI tools (PR.AT-01). Those are CSF outcomes. They are not an AIMS. The FAQ also points to the NIST AI Risk Management Framework as a separate voluntary resource. It is not ISO/IEC 42001.

When the room is choosing 27001 or 42001, use ISO 27001 vs ISO 42001. The sequence lives on the path guide. If a model is already part of the operation, say so in the ISMS scope and, if you keep a profile, in the profile scope. Leave 42001 off this request while nobody owns the inventory. One line and a recheck date are enough. Confirm live accredited AIMS scope in the quarter you would book. A 27001 schedule does not imply it. A CSF profile does not imply it.

Make the call in one sitting. The output is a sentence at the top of the request.

1. Write the actual requirement in their words. If one field says a CSF 2.0 profile and another says an ISO/IEC 27001 certificate, note which deal is blocked this cycle. Mark SOC 2, 42001, a penetration test, or a sector scheme as a different product.
2. Match it to a system you can show. A profile needs a scoped Current Profile an owner can walk. A certificate needs an ISMS and a used Statement of Applicability. If that system does not exist, do not send.
3. Name one primary artifact. Mark the other "later add" or "not this cycle," unless both are real enough to defend.
4. Name the boundary, the owner, and the sites. Say whether the profile and any certificate describe the same legal entity and the same systems.
5. Check the signer before you invite them. For 27001, use how to verify accreditation and how to choose a registrar. For a profile, confirm you are not buying a NIST certificate. This site's directory is an editorial shortlist of certification bodies for the ISO standards it tags. It is not a list of CSF assessors. A 27001 tag does not mean the organization assesses the Framework.

If the room is still split after step 3, do the work that unblocks the deal and park the other until its evidence exists.

When the certificate is the artifact, send one registrar RFQ / scope pack. The Get quotes form lists the ISO standards on the directory desk. NIST CSF is not one of those checkboxes. In Scope notes, say whether a customer or insurer asked for a CSF 2.0 profile, state Current and whether Target is included, and say whether ISO/IEC 27001 is this cycle or a later add. If the form will not send without a ticked standard, do not let a ticked ISO/IEC 27001 box stand in for a profile-only request. Put any certificate you already hold in Existing certificates. Submit once. The artifact on the page has to be the artifact you can staff.