ISO 27001 vs. NIST CSF: which framework leaves bigger ATT&CK gaps — and where attackers find them

The myth that framework choice determines your coverage

Where ISO 27001 and NIST CSF diverge — and why it matters for ATT&CK

ISO 27001 vs. NIST CSF: ATT&CK coverage by tactic

What clients say before assessments — and the root cause underneath

• "We already have ISO 27001. Why do we need an ATT&CK gap assessment on top of that? We just had our audit."

  Root cause:

  ISO 27001 certification confirms that controls exist and are documented. It confirms nothing about whether those controls detect real attacker behavior. The audit examined your logging policy. It did not run T1003 against your domain controllers and check whether your SIEM alerted. These are completely different questions. One is answered by documentation review. The other is answered by adversary simulation. The audit answered the first question. The ATT&CK gap assessment answers the second.

• "We implemented NIST CSF because it maps directly to MITRE ATT&CK. We figured that covered us."

  Root cause:

  NIST CSF describes security functions and outcomes. It does not specify ATT&CK technique coverage. The mapping between CSF subcategories and ATT&CK techniques requires active work — identifying which techniques each control is intended to address, validating that detection logic actually fires against those techniques, and tracking coverage over time as the ATT&CK knowledge base updates. NIST CSF does not do that mapping for you. It provides the architectural language. The ATT&CK alignment is your responsibility to build.

• "We spent significant budget on a SIEM and an EDR. We assumed that covered our detection requirements for both frameworks."

  Root cause:

  Tool presence satisfies control existence requirements. Tool effectiveness is an entirely separate question. A SIEM with no detection rules tuned to your environment generates noise, not signal. An EDR with exclusions covering 30% of the file system does not protect 30% of the file system. Across Vulnox assessments, organizations with mature tooling but no purple team validation have detection rates against ATT&CK techniques of 23% on average. Organizations that combine tooling with quarterly validation exercises hit 61%. The delta is not the tools. It is the validation.

How to close the gap between framework compliance and ATT&CK coverage

1. 1Security architect or GRC lead

   Build a control-to-technique mapping table. Take every ISO 27001 Annex A control or NIST CSF subcategory that addresses detection or protection and map it to the specific ATT&CK techniques it is intended to mitigate. Use the MITRE ATT&CK Navigator to visualize coverage. Identify tactics with zero mapped controls — those are your highest-priority gaps.

   Expected outcome

   A coverage map that shows exactly which ATT&CK tactics and techniques your current framework implementation addresses — and which ones it does not. This takes 2–3 days for a senior practitioner. It is the foundation for everything else.

2. 2Detection engineer or SOC lead

   For each mapped control, validate that detection logic actually fires. Start with the three highest-risk gaps from step 1. Run atomic tests using Atomic Red Team against a test environment that mirrors your production configuration. Document which tests generate alerts and which do not. The controls that do not generate alerts are your actual gaps — not the documented ones.

   Expected outcome

   A validated list of ATT&CK techniques for which you have no detection capability. This is the deliverable that audit evidence does not produce and that attackers already know.

3. 3CISO or security lead

   Prioritize remediation by attacker value, not compliance gap count. A gap in TA0006 (Credential Access) is more urgent than a gap in TA0040 (Impact) because credential access precedes everything else. Fix detection for the three most common initial access and credential access techniques first. T1078 (Valid Accounts), T1566 (Phishing), T1190 (Exploit Public-Facing Application) cover the entry points behind the majority of breaches.

   Expected outcome

   A prioritized remediation roadmap that reflects real attacker behavior rather than framework control numbering. Compliance frameworks are not ordered by attacker priority. Your remediation plan should be.

4. 4Red team or external vendor

   Run a scoped purple team exercise against your top three ATT&CK gap areas every quarter. This does not need to be a full red team engagement. A focused 2-day exercise that emulates specific techniques against specific controls produces more actionable output than a 2-week engagement that ranges across the entire ATT&CK matrix. Validate that the fixes from step 3 actually work before the next audit cycle.

   Expected outcome

   Continuous validation data that replaces point-in-time audit evidence. Over four quarters, this builds a detection effectiveness baseline that is genuinely useful for risk decisions — and that auditors increasingly accept as superior evidence.

Where this goes in the next 24 months

1. Regulators in the EU will begin requiring ATT&CK technique coverage evidence as part of NIS2 supervisory audits by end of 2026, starting with critical infrastructure sectors.

   NIS2 Article 21 requires 'appropriate and proportionate technical measures.' ENISA has already published ATT&CK-aligned guidance for critical sectors. The logical next step is supervisory bodies asking for technique-level coverage evidence rather than control documentation. Several national authorities are already piloting this in Germany and the Netherlands.

   Confidence: mediumCheck ENISA and national NIS2 authority guidance publications through Q4 2026. If no ATT&CK technique coverage requirements appear in supervisory examination criteria by then, this prediction is wrong.

2. Organizations that implement both ISO 27001 and NIST CSF simultaneously without a conflict resolution process will experience a higher rate of material breaches than those implementing either framework alone — because control conflicts create operational exceptions that become permanent vulnerabilities.

   Dual-framework implementations create governance overhead that causes organizations to treat conflicting controls as 'edge cases' and grant permanent exceptions. Exceptions compound. In 8 Vulnox dual-framework assessments, every organization had at least three permanent control exceptions with no remediation timeline. This is a structural problem that grows with time, not shrinks.

   Confidence: highA longitudinal study of breach rates in organizations with dual ISO 27001 / NIST CSF certifications vs. single-framework organizations, controlling for sector and size. If dual-framework organizations do not show higher breach rates by 2027, this is wrong.