Many organisations run security as a collection of tools, policies and good intentions. That approach works until an auditor, a regulator or a customer asks a simple question: how do you know you are secure? Without a shared reference point, the honest answer is usually a shrug.

A cybersecurity framework is that reference point. It gives you a defined baseline against which you can measure, prioritise and prove your security posture instead of improvising control by control.

What a baseline actually gives you

A framework converts abstract ambition into a structured set of expectations. That structure is what makes progress visible and defensible.

• A common language. Executives, engineers and auditors describe the same controls in the same terms, which reduces misunderstanding and rework.
• A measurable starting point. You can assess current state against the framework and quantify the gap, rather than guessing where you stand.
• A prioritisation logic. Controls map to risks, so you invest effort where exposure is highest instead of spreading budget thinly.
• An evidence trail. Documented controls and their status become the raw material for audits, tenders and regulatory reporting.

Why improvisation fails

Security programmes built ad hoc tend to accumulate blind spots. New tools are added after incidents, policies are written and forgotten, and nobody owns the overall picture.

A framework forces completeness. Because it enumerates domains such as access control, incident response and third-party risk, it exposes the areas you would otherwise ignore until something breaks. It also survives staff turnover, since the baseline lives in documentation rather than in one person's head.

One framework or several

Most organisations end up using more than one, and that is normal. The trick is to designate a backbone and treat the rest as overlays.

• ISO 27001 works well as a management-system backbone that structures how you govern security over time.
• NIST CSF offers an accessible way to assess maturity across identify, protect, detect, respond and recover.
• CyberFundamentals gives smaller European organisations a proportionate, tiered starting point.
• NIS2 and DORA are regulatory obligations that map onto your chosen backbone rather than replacing it.

Mapping overlapping frameworks once, then reusing that mapping, prevents you from answering the same control question five different ways.

Common pitfalls to avoid

Adopting a framework badly can be as unproductive as having none at all. Watch for a few recurring mistakes.

• Certification theatre. Chasing a certificate without embedding controls in daily operations leaves you compliant on paper and exposed in practice.
• Copy-paste scope. Applying every control regardless of your actual risk wastes effort and buries the important items.
• Set and forget. A baseline decays; without regular reassessment it stops reflecting reality.

Where to start this quarter

Pick one backbone framework aligned to your regulatory obligations and customer expectations. Run an honest gap assessment against it, record the results, and turn the top gaps into an owned, time-bound remediation plan. Then schedule the next reassessment before you close the first one, so the baseline stays alive.