[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_28":-5,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58},"routes/_store+/_readers+/email_author.$slug/route",{"_9":10,"_11":-5},"book",{"_12":13,"_14":15,"_16":17,"_18":19,"_20":21,"_22":23},"currentUser","id","Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6Qm9va1Byb2R1Y3QvODM1OTY","title","Dual Compliance","state","published","contactAuthorMethod","email","aboutText","

Overview

Organizations worldwide increasingly face a dual cybersecurity demand: customers and partners require ISO/IEC 27001 certification, while boards of directors and regulators increasingly expect risk to be reported in the language of the NIST Cybersecurity Framework (CSF) 2.0. Leadership teams have to satisfy both requirements at once, and the most common management mistake is to run them as two parallel, poorly aligned projects instead of one coherent program. Dual Compliance answers this problem directly: rather than asking an organization to choose between frameworks, it shows that both describe, in essence, one and the same cyber-risk management program in two complementary languages — NIST CSF in the language of desired outcomes, ISO/IEC 27001 in the language of a formal, certifiable management system — and walks the reader through both in sequence, so that what emerges is one working system rather than two disconnected sets of documents.

The book takes the reader chapter by chapter through a single, consistent build: from risk-based cybersecurity management and the GOVERN function, through all six Core Functions of NIST CSF (GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER), Organizational Profiles and Tiers, to the architecture of an ISO/IEC 27001 information security management system and a detailed methodology for mapping the two standards to each other. A running case study — a mid-sized online retailer of consumer electronics, InterShop — accompanies the reader from roughly a third of the way through the book to its final chapter, turning the requirements of both standards into concrete, fully worked working documents for a single organization.

What the Book Covers

The book is organized into five parts and fourteen chapters.

Part I. Foundations of Risk-Based Cybersecurity Management (Chapters 1–3) establishes a shared vocabulary: why cybersecurity management is a management discipline rather than a purely technical one, an overview of the structure of NIST CSF 2.0, and the GOVERN function as the cross-cutting foundation shared by both frameworks.

Part II. The CSF Core in Practice (Chapters 4–7) works sequentially through the IDENTIFY, PROTECT, and DETECT/RESPOND/RECOVER functions, along with Organizational Profiles and Tiers as tools for gap analysis and maturity assessment.

Part III. ISO/IEC 27001 and Risk Management (Chapters 8–10) turns to the formal, certifiable information security management system (ISMS): the standard's harmonized structure, information security risk assessment and treatment, and a detailed methodology for mapping between the two frameworks.

Part IV. Operational Maturity (Chapters 11–13) details an organization's day-to-day practice: supplier and supply chain risk management, policies, documentation and personnel awareness, and internal audit and continual improvement.

Part V. Running Case Study and Synthesis (Chapter 14) brings all preceding chapters together into one integrated cybersecurity management system built around InterShop, and closes the book.

Audience

GRC professionals, managers and implementers of information security management systems (ISMS), security leads and current or aspiring CISOs, IT executives, and compliance consultants. No technical background is required.

What Sets This Book Apart

Both frameworks together, not \"either/or.\" Most existing material treats NIST CSF and ISO/IEC 27001 as competing options to choose between. This book consistently shows how to build a single system and describe its results in the language of both standards, including a detailed mapping methodology (Chapter 10) with a mapping table narrowed to a specific worked example (Chapter 10) and then applied to the running case study (Chapter 14).
A running case study, not scattered examples. The organization InterShop runs through eight chapters (Chapters 4–14), accumulating a risk register, a Statement of Applicability, a supplier assessment, an access control policy, and an internal audit record — all documents interlinked around a single organization, the way they are in practice.
A practical, not a summarizing, treatment of ISO/IEC 27001. The book never reproduces the text of this commercial standard verbatim or in close paraphrase — every clause and Annex A control is explained in the author's own original words, with the author's own examples and illustrative cases, giving readers a practical understanding of the requirements without infringing the standard publisher's copyright.
Terminology aligned with the official NIST source text, unified in a single glossary. All NIST CSF terminology is checked against the official English text of NIST CSWP 29, and both frameworks' terms are consolidated into a single alphabetical glossary at the end of the book.

","authors",[24],{"_12":25,"_26":27,"_28":29},"Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci84OTI1NA","name","Andrii Bogdanovych","user",{"_30":31},"avatar",{"_32":33,"_34":35,"_36":37},"url","https://d39qdlcrvnra4b.cloudfront.net/avatars/3773395/medium/avatar.jpg?1787809809","styleName","medium","exists",true,"shoppingCartId","shoppingCart",{"_12":71,"_72":73,"_74":37,"_75":76,"_77":78,"_79":80,"_81":37},"locale","en","readerTheme","light","constants",{"_69":70},"publishers",{"_65":66,"_67":68},"learnerOrganizations",[],"needsLocaleCookieSync",false,"announcements",{"_59":60,"_61":-5},"sentryEnvironment","production","sentryRelease","77d32e91cc5200ffc698997ed435d10e61301d30","announcement_store",{"_62":52,"_63":64},"announcement_authors","flag","text","

Kick off your book project, get started with GhostAI, get better at marketing, or spend the day doing all three! Free live workshops on Zoom. Saturday, June 27, 2026.

\n","companies",[],"universities",[],"paypalClientId","AX53Cwz8jR6rVVzzZiZNWWXl0dGagi-GZrjG-S3Ua14E5nrKMn7DxDQ730O4R8LusLPp49ALn6aRVaEy","no-cart","count",0,"free","updatedAt","","paymentGateway","STRIPE","cartItems",[],"loading"]

Email the Author