Blog | CompassMSP

The Compass Approach to NIST and Other Cybersecurity Frameworks

Written by Jim Ambrosini | Dec 15, 2025 9:00:07 PM

As a vCISO, one of the most common requests I hear from new clients is: "We need to be NIST compliant." 

It makes sense. NIST (National Institute of Standards and Technology) has become the "Kleenex" of cybersecurity; it is the brand name everyone recognizes. According to a 2025 industry survey by Fortra, 54% of organizations now rely on the NIST Cybersecurity Framework (CSF), making it the most widely adopted security standard in the world. 

But here is the reality check: Just because NIST has great name recognition, doesn’t mean it is the best framework for your specific business. 

Cybersecurity is not a "one-size-fits-all" product. Implementing a heavy federal framework for a small law firm is a waste of resources, while applying a basic framework to a high-target defense contractor may be negligence. 

At CompassMSP, our approach is not to simply "install NIST." It is to determine which framework (or combination of frameworks) aligns with your regulatory obligations, your risk tolerance, and your budget. 

What Do We Mean When We Say "NIST"? 

Who Needs NIST vs. Who May Not 

           When NIST IS Needed 

            When NIST May Be Too Much or Not Enough 

How We Help You Decide 

Frequently Asked Questions About Cybersecurity Frameworks 

What Do We Mean When We Say "NIST"? 

When business leaders talk about "NIST," they are usually referring to a vague concept of security best practices. However, when we talk about NIST, we are talking about a specific library of documents, each with a different purpose. 

Before you commit to "doing NIST," you need to understand which flavor you are actually asking for. Here is a brief overview of the different NIST frameworks we utilize: 

  • NIST CSF (Cybersecurity Framework): This is the most popular choice for private businesses. It is designed for evaluating and reducing risk through best practices. It is industry-agnostic and uses business-friendly language (Identify, Protect, Detect, Respond, Recover) that bridges the gap between the server room and the boardroom. 
  • NIST Privacy Framework: This is designed to manage privacy risk for organizations handling personal data. It helps you navigate the complex intersection of cybersecurity and privacy laws like GDPR or CCPA. 
  • NIST SP 800-53: This is the heavyweight champion. It is a massive catalog of security controls, primarily for federal agencies. It provides detailed, prescriptive technical and management controls for confidentiality, integrity, and availability. For most Small and mid-sized businesses, this is overkill; for federal agencies, it is the law. 
  • NIST RMF (Risk Management Framework): This is a structured process for conducting risk assessments. It integrates security and privacy into the system development lifecycle. 

Who Needs NIST vs. Who May Not 

The decision to adopt a framework should be a business decision, not a technical one. 

When NIST IS Needed 

There are specific scenarios where NIST is the clear, and sometimes mandatory, choice: 

  • Federal Agencies: You must use RMF and SP 800-53 for compliance with FISMA (Federal Information Security Modernization Act). 
  • Privacy-Sensitive Organizations: Companies handling massive amounts of PII (healthcare, insurance, marketing) often use the NIST Privacy Framework to ensure compliance with privacy laws. 
  • Contractual Requirements: Any business that has contracts or clients who require NIST compliance (e.g., a manufacturing firm selling to an aerospace prime contractor). 

The Boardroom Advantage: 

We like NIST CSF specifically because it is good for executive leadership and the board of directors. It exposes exactly where a company has weaknesses without being too technical. 

Because NIST CSF is structured in business terms, it is easier for company leadership to understand risk. This clarity pays off financially. A 2024 Healthcare Cybersecurity Benchmarking Study found that organizations using NIST CSF as their primary framework saw annual cyber insurance premium increases of only 6%, compared to 18% for those who did not. That is a 3x difference in cost control simply by speaking the language of risk. 

 When NIST May Be Too Much or Not Enough 

When NIST is Too Much: 

If an organization is very new to cybersecurity and has no measures in place, full NIST adoption may be too much to start. In those instances, we use a more standard, prioritized approach to get companies on the path toward better security. 

As they say, you have to crawl before you can run. 

If you have zero controls, trying to implement a complex governance framework is a recipe for failure. In essence, you have to start somewhere, and NIST might be too complex for your starting point. We might start with the NIST CSF Quick Start Guides or a basic hygiene review and employee cybersecurity awareness training to build the foundation first. 

When NIST is Not Enough: 

On the opposite side of the spectrum, some organizations need even stricter, more prescriptive cybersecurity practices. If you are in highly regulated or often targeted industries (like healthcare, finance, and manufacturing), "best practices" might leave too much room for interpretation. 

In those instances, we might implement NIST alongside the CIS (Center for Internet Security) framework. While NIST is descriptive (telling you what outcome to achieve), CIS is prescriptive (telling you exactly how to configure the technology to achieve it). Stacking these frameworks provides both the governance board members need and the technical rigor engineers need. 

How We Help You Decide 

At CompassMSP, we don’t force-feed you a framework. Our vCISO service is designed to be a strategic partnership that builds a custom roadmap for your reality. 

Our Approach: 

We utilize an advanced GRC (Governance, Risk, and Compliance) tool that helps us implement and map all of these frameworks. We don't rely on spreadsheets; we use data. 

  • For the "Crawlers" (companies with little to no cybersecurity practices in place): If you have no controls in place, we tend to implement a custom framework based on your immediate compliance needs, data privacy requirements, and the systems you already have. We focus on "quick wins" that reduce maximum risk with minimum disruption. 
  • For the "Walkers & Runners"(companies with moderate to advanced cybersecurity measures in place): If a client has basic cyber controls in place, we may lean on CIS because it offers clear Implementation Groups (IG1, IG2, IG3) based on company size. This allows us to scale your security maturity logically, moving you from IG1 (basic hygiene) to IG2 (enterprise) as your budget and risk profile evolve. 

The Bottom Line 

At Compass, we provide a custom approach because there is no one-size-fits-all solution for cybersecurity and compliance. 

Your security strategy should not be dictated by a popular acronym. It should be dictated by your specific risks. We will work with you to understand your fiduciary responsibilities, your unique regulatory requirements, and your operational reality to ensure we come up with what is best for your business. 

Whether that is full NIST 800-171 compliance, a hybrid CIS/NIST approach, or a custom roadmap to get you off the ground, our vCISOs are the architects who make it happen. 

Ready to stop guessing and start strategizing? 

 Speak with a CompassMSP vCISO today to build your custom roadmap

Frequently Asked Questions About Cybersecurity Frameworks