Informative References are the bridge
Informative References map each Subcategory to specific sections of other standards, guidelines and frameworks — SP 800-53, ISO/IEC 27001, the CIS Controls and others. They are how you get from a CSF outcome to something implementable, and how you reuse work already done against another standard.
Why it is like this
Most organisations arrive at the CSF already holding an ISO certificate or a 800-53 baseline. References make the CSF a lens over that work rather than a second programme running beside it.
Not to be confused with
An equivalence claim. A mapping says two things are related, not that satisfying one satisfies the other — and the mappings are maintained separately from the framework document, so they move.
In practice
This is the practical argument for the CSF in a European context: it gives you one outcome vocabulary that can be mapped onto ISO 27001, NIS2's Article 21 measures and DORA's framework at the same time.
Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §2.2 and the CSF 2.0 Reference Tool. Read on .
Say it back Check yourself
What is an Informative Reference, and what does it not establish?
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- A mapping from a CSF Subcategory to a section of another standard or framework
- Examples: SP 800-53, ISO/IEC 27001, the CIS Controls
- It shows where to find implementable detail, and lets existing work be reused
- It does not establish equivalence or compliance with the other standard
"We are ISO 27001 certified, so we meet the CSF" is the claim the mappings get misused to support.