The other frameworks you have also met

What a defence manufacturer typically meets

The certification programme and the NIST publication behind it are the ones with a contractual date attached. Around them sit several others that arrive from different directions.

An information security management standard, usually demanded by a commercial customer rather than by government, certifying that you run a management system rather than that you meet a specified control set.

Service organisation reporting, requested by customers who buy a service from you and want assurance about how you operate it.

Cloud authorisation requirements, which reach you indirectly: not something you hold, but something your providers must satisfy for you to use them for covered information.

Export control, which is not a security framework at all and which constrains the same decisions. The next entry names it and declines to advise on it.

Customer security schedules, which are bespoke, proliferate, and are the ones nobody counts.

Three axes worth keeping straight

What is certified. A control set, a management system, or a report on operating effectiveness. These are different claims and customers frequently ask for one while meaning another.

Who assesses. An accredited body, an auditor of your choosing, a government agency, or you.

What compels it. A contract clause, a customer preference, or a market expectation. The first has a date; the others have leverage.

Substantial, and never total

Access control, logging, incident response and configuration management appear in all of them and are written differently in each. The controls you implement can serve several; the wording you evidence against cannot be shared blindly.

The entry on working to two standards sets out how to run this without duplicating the programme.

Contract first, market second

Anything with a clause and a date comes first, because failing it has a defined consequence. Anything requested by a customer without a clause is a commercial decision: what revenue depends on it, and what it costs against the alternatives.

Suppliers frequently pursue a well-known certification because it is well known, ahead of the one their contracts actually require. It is an expensive way to be diligent.

The framework nobody names

The two-hundred-question spreadsheet that arrives from a customer's procurement team is, in practice, a framework you have to satisfy. It has no standard, no assessor and no certificate, and it consumes real time several times a year.

The defence against it is a maintained set of answers, kept current with the evidence, so that each new questionnaire is an editing job rather than a research project.

Holding one does not answer another

A customer asking for a specific standard is rarely satisfied by a different one, even where the coverage is comparable. Offering a mapping sometimes works and is worth trying; assuming it will is not.

Keep a list of what you are subject to

Framework, what compels it, who assesses, when it expires, who owns it. One page, reviewed annually.

Most suppliers cannot produce this and discover an obligation when a customer asks about it, which is the worst moment to begin finding out.

Elsewhere in the wider regime

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.