The Security Framework Family Tree: GDPR, NIST, ISO, and PCI Lineage Explained

GDPR entered into force in May 2018 and almost immediately became the reference architecture for data protection legislation globally. The mechanism of that influence operated through two channels simultaneously. The first was direct derivation: countries with existing EU relationships or EU market ambitions enacted laws that transposed GDPR principles into national law while adapting them to local legal traditions, enforcement structures, and political contexts. The UK Data Protection Act 2018 is the clearest example , enacted in parallel with GDPR to maintain regulatory alignment while establishing UK-specific derogations and the ICO as an independent supervisory authority operating outside EU GDPR one-stop-shop mechanism. Post-Brexit, the UK GDPR and DPA 2018 together form a regime that is substantially equivalent to EU GDPR but administered independently, which matters practically for companies transferring data between the UK and EU because separate adequacy determinations and transfer mechanisms now apply in each direction.

Brazils Lei Geral de Proteção de Dados , LGPD , enacted in 2018 and effective from September 2020, represents the most structurally faithful GDPR derivative outside Europe. The LGPD adopts GDPR lawful basis framework almost verbatim, with ten processing bases that mirror GDPR six bases plus additional Brazilian-specific grounds. The LGPD data subject rights , access, correction, deletion, portability, information about sharing, and the right to revoke consent , map directly to GDPR Articles 15 through 22. The primary structural divergence is enforcement: LGPD national data protection authority, the ANPD, has been slower to establish its enforcement posture than European supervisory authorities, but its penalty framework , up to 2 percent of Brazilian revenue per violation capped at BRL 50 million , creates meaningful financial exposure for companies with significant Brazilian operations.

India Digital Personal Data Protection Act 2023 and Singapore PDPA represent the Asian branch of the GDPR family, though both demonstrate more adaptation from the GDPR template than the UK and Brazil derivatives. Singapore PDPA predates GDPR , its original enactment was in 2012, before GDPR existed , and the 2020 amendments that brought it into closer GDPR alignment represent a convergence rather than a direct derivation. India DPDPA 2023 shares GDPR consent-centricity and data principal rights architecture but departs from GDPR on lawful basis categories, notably excluding legitimate interests as a standalone processing basis and treating state processing with significantly lighter obligations than private sector processing. Thailand PDPA, enacted in 2019 with full enforcement from June 2022, is the most directly GDPR-influenced Asian privacy law, adopting the data controller and data processor distinction, the consent and legitimate interests lawful bases, and the 72-hour breach notification requirement that are core GDPR architectural elements.

NIST Special Publication 800-53 is the most consequential security control catalog ever published, not because of its direct applicability , it applies directly only to US federal information systems , but because of the framework family it generated. The current version, NIST 800-53 Rev 5, contains 20 control families covering every dimension of organizational security from access control and audit to supply chain risk management and program management. Every subsequent framework in the NIST family draws its control requirements from this catalog, which is why compliance professionals with deep NIST 800-53 expertise find the incremental learning curve for CMMC, FedRAMP, StateRAMP, and NIST 800-171 substantially lower than those approaching these frameworks without the 800-53 foundation.

FedRAMP , the Federal Risk and Authorization Management Program , is the cloud security authorization program that applies to cloud service providers seeking to offer services to US federal agencies. FedRAMP Moderate baseline requires achieving 325 controls from NIST 800-53 Rev 5, and FedRAMP High baseline requires 421 controls. The program operates on the authorize once, use many times principle: a cloud service provider that achieves FedRAMP authorization can offer its authorized service to any federal agency without undergoing agency-specific security assessments. StateRAMP is the state government equivalent, applying FedRAMP-equivalent controls to cloud services purchased by state and local government agencies. As state governments have standardized on StateRAMP over the past three years, cloud providers that have achieved FedRAMP authorization have been able to leverage that existing authorization documentation to accelerate StateRAMP review processes, because the underlying control requirements are structurally identical.

CMMC 2.0 , the Cybersecurity Maturity Model Certification , is the defense industrial base implementation of NIST 800-171, which is itself a subset of NIST 800-53 tailored for non-federal organizations processing Controlled Unclassified Information. The CMMC 2.0 level structure maps directly to NIST 800-171 practice counts: Level 1 covers 17 practices from the basic safeguarding requirements in FAR 52.204-21, Level 2 covers all 110 practices from NIST 800-171 Rev 2, and Level 3 adds requirements from NIST 800-172 for organizations handling the most sensitive CUI. DFARS clause 252.204-7012, the contractual mechanism through which DoD imposes NIST 800-171 requirements on contractors, has been in force since 2017 , CMMC 2.0 adds the third-party assessment requirement on top of the existing DFARS self-attestation obligation rather than introducing new control requirements. The CMMC final rule published in October 2024 formalized the C3PAO assessment pathway for Level 2 contractors, ending the self-attestation option for most defense contractors handling CUI.

NIST Cybersecurity Framework sits in a different position within the NIST family than the 800-53 derivatives. Where CMMC, FedRAMP, and NIST 800-171 are compliance frameworks with specific control requirements and assessment processes, NIST CSF is a risk management framework , it provides a common language and structure for organizations to assess and communicate their cybersecurity posture without prescribing specific controls. The February 2024 update to NIST CSF v2.0 added the Govern function as a sixth core function alongside Identify, Protect, Detect, Respond, and Recover. The Govern function elevated organizational cybersecurity roles, policies, oversight structures, and supply chain risk management to the same structural level as the operational security functions , a change that reflects the increasing recognition that security program failures are as often governance failures as they are technical ones.

The Cyber Resilience Review Methodology , C2M2, maintained by the Department of Energy , applies the NIST CSF principles to operational technology environments in energy, manufacturing, and critical infrastructure sectors. C2M2 version 2.1 organizes its practices into ten domains including asset, change, and configuration management, identity and access management, threat and vulnerability management, and situational awareness , domains that map directly to NIST CSF functions but with OT-specific implementation guidance that NIST CSF technology-agnostic language cannot provide. CISA Cybersecurity Performance Goals , CPG , published in October 2022 represent CISA translation of NIST CSF into a prioritized set of baseline cybersecurity practices specifically for critical infrastructure operators. The CPGs are explicitly designed to be achievable by organizations that lack the resources for comprehensive NIST CSF implementation, and they identify the subset of practices that CISA assessment data suggests provide the greatest risk reduction per unit of implementation effort.

ISO 27001 occupies a unique position in the global security framework landscape because it is simultaneously a management system standard, a certification framework, and the parent of a family of domain-specific extensions that cover cloud security, privacy, healthcare information security, and privacy information management. The ISO 27001 family operates through a deliberate extension architecture: ISO 27001 provides the management system requirements and the Annex A control framework, while the domain-specific standards in the 27000 series provide additional controls and implementation guidance for specific sectors or technology environments. Organizations implementing ISO 27001 can extend their certification scope to include ISO 27017 for cloud services, ISO 27018 for public cloud PII processing, and ISO 27701 for privacy information management , each extension adds domain-specific controls to the base ISO 27001 Annex A without requiring a separate management system.

ISO 27002:2022 , the implementation guidance companion to ISO 27001 , underwent its most significant structural revision in over a decade when it was updated in 2022. The revision reorganized the control set from 14 clauses and 114 controls to four themes , organizational, people, physical, and technological , containing 93 controls. Eleven controls were added that had no equivalent in the 2013 version, covering areas including threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, and configuration management. The ISO 27002:2022 reorganization was designed to better reflect the current technology and threat landscape, and organizations still certified against ISO 27001:2013 that have not yet transitioned to the 2022 version are operating against a control framework that predates widespread cloud adoption, modern supply chain attack techniques, and the current regulatory environment.

ISO 27701:2019 is the privacy extension to ISO 27001 and ISO 27002 that provides the Privacy Information Management System framework. Its relationship to GDPR is the most direct of any ISO standard , the standard includes an explicit Annex D that maps ISO 27701 controls to GDPR articles, allowing organizations to use ISO 27701 certification as documented evidence of GDPR Article 32 security implementation. GAPP , Generally Accepted Privacy Principles, published by AICPA and CPA Canada , is connected to the ISO family through ISO 27701 conceptual alignment with the same privacy management principles that GAPP encodes. The GAPP privacy principles , management, notice, choice and consent, collection, use and retention, access, disclosure to third parties, security, quality, and monitoring and enforcement , appear in various forms in both ISO 27701 and GDPR, creating a privacy framework convergence that allows organizations implementing ISO 27701 to satisfy GAPP requirements with the same control implementation.

HITRUST CSF occupies a singular position in the framework family tree because it is explicitly a synthesized framework , designed from inception to incorporate requirements from multiple parent frameworks into a single, unified control set that satisfies the security due diligence requirements of the healthcare industry. The HITRUST CSF control categories draw requirements from ISO 27001, NIST 800-53, HIPAA Security Rule, PCI DSS, COBIT, and state-specific regulations, and the HITRUST assessment process weights these requirements based on the organization profile , its size, complexity, regulatory environment, and risk profile. An organization with HIPAA obligations operating in a state with additional healthcare privacy requirements will receive a different assessment scope than a health tech startup with limited regulatory exposure, even though both assessments are conducted against the same HITRUST CSF control framework.

The influence relationship between HITRUST CSF and HIPAA runs in both directions. HIPAA Security Rule requirements are embedded within the HITRUST CSF control categories, which is why achieving HITRUST r2 certification is widely accepted as demonstrating HIPAA Security Rule compliance , the HITRUST assessment has evaluated the controls that HIPAA requires as a subset of its broader assessment scope. Conversely, HITRUST has influenced how healthcare organizations interpret and implement HIPAA requirements by providing the specific, testable control implementations that HIPAA principles-based language does not prescribe. HIPAA tells covered entities they must implement reasonable and appropriate safeguards; HITRUST CSF tells them specifically what those safeguards should look like in a healthcare technology environment, with control maturity levels that provide a roadmap from basic compliance to optimized security program.

PCI DSS is the parent of a validation framework family rather than a family of derived substantive standards. The PCI DSS core requirements apply to all entities that store, process, or transmit cardholder data, but the validation methodology varies based on transaction volume and payment processing architecture. SAQ A , Self-Assessment Questionnaire A , is the simplest validation form, applicable to card-not-present merchants that have fully outsourced all cardholder data functions to PCI DSS compliant third-party service providers. SAQ A contains 22 requirements, a fraction of the 250-plus requirements in the full PCI DSS assessment, because its scope is limited to the controls that a merchant retains responsibility for when all payment processing is handled by a third party. The scope reduction that SAQ A provides is significant and frequently misunderstood , it does not mean the merchant has no PCI DSS obligations, it means the merchant specific obligations are narrow and focused on the security of their relationship with their payment service provider.

SAQ B covers merchants that process cardholder data via imprint machines or standalone dial-out terminals with no electronic cardholder data storage, while SAQ D is the most comprehensive self-assessment questionnaire, applicable to all other merchants and all service providers. SAQ D for service providers covers all PCI DSS requirements , it is functionally equivalent to a full Report on Compliance for entities that do not meet the transaction volume thresholds requiring a QSA-conducted assessment. PA DSS , Payment Application Data Security Standard , was the payment application security framework that governed the development and distribution of payment applications before it was retired in October 2022 and superseded by the PCI Software Security Framework, which includes the Secure Software Standard and the Secure Software Lifecycle Standard. Organizations still referencing PA DSS compliance in their vendor security questionnaires are citing a retired standard, and their payment application vendors should be assessed against the current SSF standards instead.

The most consequential misunderstanding in the PCI family is the scope reduction fallacy , the belief that using a third-party payment processor eliminates PCI DSS obligations. PCI DSS v4.0.1 Requirement 12.8 mandates that entities maintain a list of all third-party service providers with whom cardholder data is shared, confirm annually that those providers maintain PCI DSS compliance, and have written agreements acknowledging the providers responsibility for cardholder data security. Requirement 6.4.1 mandates automated security solutions on payment pages regardless of whether the payment processing itself is outsourced. The scope of PCI DSS for a merchant using a fully outsourced payment processor is narrower than for a merchant that stores cardholder data, but it is never zero, and the March 2025 mandatory deadline for all PCI DSS v4.0.1 future-dated requirements has closed the transition period that allowed organizations to defer the most demanding new technical requirements.