ISO 31000, COSO ERM, the NIST RMF, NIST CSF 2.0 and ISO/IEC 27005 are not rivals. They work at different levels. ISO 31000 and COSO cover risk across the organization, ISO/IEC 27005 applies ISO 31000 to information security, CSF 2.0 describes cybersecurity outcomes, and the RMF authorizes individual systems.
Pick the one that matches your question, and use shared risk criteria so the results add up.
Key takeaways
- These frameworks sit at different levels, so the useful question is which one answers yours, not which one is best.
- ISO 31000 and COSO ERM are the closest pair. ISO 31000 has principles, a framework and a process. COSO has five components and 20 principles and stresses strategy and performance.
- ISO/IEC 27005:2022 applies ISO 31000 to information security and supports ISO/IEC 27001, but 27001 does not require it.
- The NIST RMF has seven steps and works system by system. NIST CSF 2.0 has six functions and describes cybersecurity outcomes.
- NIST IR 8286, revised on December 18, 2025, shows how to bring cyber risk into the enterprise risk register. Shared criteria make that possible.
The five frameworks at a glance
People search for these as if they were rivals. They are not. They sit at different levels, and several of them were written to work together. The table shows what each one is before the sections that compare them with ISO 31000.
| Framework | Published by | What it gives you | Where it is strongest |
|---|---|---|---|
| ISO 31000:2018 | ISO | Eight principles, a framework and a six-activity process for any kind of risk | A shared structure and vocabulary across the whole organization |
| COSO ERM (2017) | COSO | Five components and 20 principles that tie risk to strategy and performance | Board and executive oversight, and linking risk to strategy |
| NIST RMF (SP 800-37 Rev. 2) | NIST | A seven-step process for managing security and privacy risk in systems | Authorizing and monitoring individual systems |
| NIST CSF 2.0 | NIST | Six functions that describe cybersecurity outcomes | Organizing and explaining a cybersecurity program |
| ISO/IEC 27005:2022 | ISO and IEC | Guidance on information security risk assessment and treatment | Running the risk work that an ISO/IEC 27001 system needs |
If you want the detail on ISO 31000 itself first, the ISO 31000 guide covers its principles, framework and process.
ISO 31000 vs COSO ERM
These two are the closest pair. Both describe how an organization should manage risk as a whole, and both want risk to inform decisions rather than sit in a register. COSO describes its work as thought leadership on internal control, risk management, governance and fraud deterrence, which is one reason it is common in finance and internal audit teams.
The difference is in how each one is built. ISO 31000 has three parts: principles that describe what good looks like, a framework that builds risk management into governance, and a process you run on each decision or project. COSO's current framework, Enterprise Risk Management: Integrating with Strategy and Performance, replaced its 2004 version. It has five components, supported by 20 principles, and it puts the link between risk and strategy in the title.
| Question | ISO 31000:2018 | COSO ERM |
|---|---|---|
| How is it organized? | Principles, framework and process | Five components: Governance and Culture; Strategy and Objective Setting; Performance; Review and Revision; Information, Communication and Reporting |
| What is its emphasis? | A generic approach that fits any organization, size or sector | Risk as part of setting strategy and driving performance |
| How does it describe responding to risk? | Treatment options such as avoiding, taking risk to pursue an opportunity, changing likelihood or consequences, sharing and retaining | Five responses: accept, avoid, pursue, reduce and share |
| Is it a certification scheme? | No. ISO says it cannot be used for certification | It is a framework for organizations to apply. COSO runs an ERM Certificate Program for individuals |
| Where do you meet it most? | Across sectors, and as the base for narrower standards | Finance, internal audit and board reporting |
The practical answer for most organizations is to pick one as the main approach and borrow from the other. A team that already reports to a board through COSO can use the ISO 31000 process for the detailed work on projects and suppliers. A team built on ISO 31000 can use COSO's emphasis on strategy when it prepares the board's risk discussion.
ISO 31000 vs ISO/IEC 27005
This is a parent and child relationship, not a choice. ISO's catalogue lists ISO/IEC 27005:2022 as the fourth edition, published in October 2022. It gives guidance on managing information security risk, it supports an information security management system based on ISO/IEC 27001, and it adapts the general principles of ISO 31000 to information security. If you are comparing ISO 31000 with ISO/IEC 27001 itself, ISO 31000 vs ISO 27001 gives the short answer.
In practice, ISO 31000 tells you how to run risk management across the organization. ISO/IEC 27005 tells you how to run the information security part in detail: identifying risks, analyzing them, evaluating them against criteria, treating them and communicating the results.
| Question | ISO 31000:2018 | ISO/IEC 27005:2022 |
|---|---|---|
| What risks does it cover? | Any risk to any objective | Information security risks |
| What is it for? | A common approach and vocabulary across the organization | Detailed guidance for the risk assessment and treatment an ISMS needs |
| Is it a certification scheme? | No | No. Certification is against ISO/IEC 27001, which it supports |
| Do you need it? | No, it is guidance | No. ISO/IEC 27001 asks for a defined risk assessment process, not a specific method, though most organizations use this one |
One point causes confusion in audits. ISO/IEC 27001 does not name ISO/IEC 27005 as a requirement. It asks for a defined risk assessment process that produces consistent, comparable results. ISO/IEC 27005 is the guidance written to help you build that process, so using it is a sensible choice and not an obligation.
ISO 31000 vs the NIST Risk Management Framework
NIST's Risk Management Framework is defined in NIST SP 800-37 Revision 2. NIST describes it as a process that integrates security, privacy and cyber supply chain risk management into the system development life cycle. It has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. You classify a system by impact, select controls from NIST SP 800-53, put them in place, check them, and a senior official makes a risk-based decision to authorize the system to operate. NIST's page says the RMF can be applied to any type of system and any type of organization.
The scale is what separates it from ISO 31000. The RMF works on one system at a time and ends in an authorization decision. ISO 31000 works across the organization and does not prescribe controls. The RMF also draws on a control catalogue, while ISO 31000 leaves the choice of techniques to you.
Watch the vocabulary. In the RMF, the Assess step checks that selected controls are in place and working. In ISO 31000, risk assessment means identifying, analyzing and evaluating risks. A team that mixes the two ends up saying "we did the assessment" and meaning different things.
ISO 31000 vs NIST CSF 2.0, and how cyber risk reaches the board
NIST released Cybersecurity Framework 2.0 on February 26, 2024. It organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new in version 2.0, and NIST says it addresses how an organization makes and carries out cybersecurity strategy decisions and treats cyber risk as an enterprise risk next to finance and reputation. NIST also widened the scope from critical infrastructure to organizations of any type and size.
CSF 2.0 describes what a cybersecurity program should achieve. It does not walk you through a risk assessment step by step the way the ISO 31000 process does. That is why the two combine well: ISO 31000 or COSO gives you the enterprise approach, and CSF 2.0 gives the security team a shared way to describe where it stands.
The bridge between the two
NIST publishes a series for exactly this problem. NIST IR 8286, Integrating Cybersecurity and Enterprise Risk Management, was revised on December 18, 2025, together with IR 8286A and IR 8286C. The revisions align the series with CSF 2.0 and put more emphasis on governance. They cover how to integrate cybersecurity risk management into enterprise risk management, how to identify and estimate cyber risks in risk registers, and how to aggregate and harmonize that data so senior leaders can oversee it.
NIST SP 800-221 takes the same view. It treats information and communications technology risk as a subset of enterprise risk: ICT risks are recorded in lower-level registers, then aggregated and normalized into enterprise-level registers that feed an enterprise risk profile. It cites ISO 31000 and COSO ERM when it defines its terms.
How the frameworks fit together
The cleanest way to see it is by layer. Each layer answers a different question, and a mature organization usually has something at every level.
| Layer | The question it answers | Typical framework |
|---|---|---|
| Enterprise | How do we manage every kind of risk and compare them? | ISO 31000 or COSO ERM |
| Cybersecurity program | What should our cybersecurity program achieve, and where are we? | NIST CSF 2.0, linked to enterprise risk through NIST IR 8286 |
| Information security management system | How do we assess and treat information security risk inside a certifiable system? | ISO/IEC 27001 with ISO/IEC 27005 guidance |
| Individual system | Should this system be authorized to operate, and under which controls? | NIST RMF with NIST SP 800-53 |
What holds the layers together is a common set of risk criteria. If the enterprise team scores consequence in money, the cyber team scores it in a three-level scale of its own, and the system team uses a fourth, nothing can be added up. NIST's own description of aggregating and normalizing lower-level registers is an admission that this has to be designed, not hoped for.
A worked example: one company, four questions
Illustrative scenario with invented details, not a client case.
The online lender from the ISO 31000 guide is about to launch instant payouts. Four people are asking risk questions on the same day, and each question calls for a different framework.
| Who asks | The question | Framework | What comes out |
|---|---|---|---|
| Product owner | Can we launch in 90 days, and what risk are we accepting? | ISO 31000 process | Agreed criteria, scored risks, a treatment plan and a named person who accepts the residual risk |
| Information security manager | How are the information security risks of the payout system assessed for our ISMS? | ISO/IEC 27005 under ISO/IEC 27001 | Risks with owners, treatment decisions and records that an ISO/IEC 27001 audit can follow |
| Chief information security officer | Is the cybersecurity program mature enough for the board and the regulator? | NIST CSF 2.0 | A description of current and target outcomes across the six functions |
| Chief risk officer | How does cyber risk compare with credit and liquidity risk? | ISO 31000 or COSO ERM, with NIST IR 8286 | Cyber risks aggregated into the enterprise register, scored on the same criteria |
None of the answers contradict each other, because the criteria are shared. That is the real test of whether the frameworks are working together: the number the product owner accepts and the number the board sees should come from the same scale.
Which one should you start with
Start from your situation, not from the framework's reputation.
| Your situation | Start with | Why |
|---|---|---|
| You have no formal risk approach, in any sector | ISO 31000 | It is short, generic and the base the narrower standards build on |
| Your board or finance team wants risk linked to strategy and performance | COSO ERM | Its components are built around strategy and performance |
| You are building or maintaining an ISO/IEC 27001 system | ISO/IEC 27001 with ISO/IEC 27005 | The guidance was written to support its risk requirements |
| You run a cybersecurity program and need a shared language for outcomes | NIST CSF 2.0 | It organizes outcomes in six functions and now includes Govern |
| You authorize systems and select NIST SP 800-53 controls | NIST RMF | It is a system-level process that ends in an authorization decision |
| You need cyber risk to appear in the enterprise risk register | The NIST IR 8286 series, with your ERM approach | It describes how to integrate and aggregate cyber risk |
Most organizations end up with two or three of these. The order matters less than making sure they share criteria.
Common mistakes when combining frameworks
Treating the frameworks as rivals is the first one. A project that spends months choosing between ISO 31000 and COSO usually delivers neither. The second is keeping separate registers on separate scales, which makes aggregation impossible. The third is claiming to be "ISO 31000 certified". ISO says the standard cannot be used for certification, so a claim like that will not survive scrutiny. If you are unsure whether anything obliges you to adopt it at all, read is ISO 31000 mandatory.
A fourth is mixing vocabularies without noticing, as the word "assess" shows. A fifth is adopting a framework as paperwork: the policy is approved, the templates exist, and nobody consults the register when a decision is made. Whichever framework you choose, the test is the same. Does risk information change what people decide?
Where PECB credentials fit
Because ISO 31000 cannot be certified, PECB certifies people. The ISO 31000 credentials run from Provisional Risk Manager to Senior Lead Risk Manager, and the requirements rise with experience. The ISO 31000 guide sets out the levels and the exam. Shorter answers cover the Risk Manager certification, the Lead Risk Manager certification and the exam format.
For the information security side, reconn also offers PECB ISO/IEC 27005 Risk Manager as a self-study or eLearning course in English. It is the natural next step if your work is risk inside an ISO/IEC 27001 system. reconn attaches the same support to every enrollment: a free 1-on-1 session with a PECB Certified Trainer, and email and WhatsApp help until you clear the exam, within 12 months of enrollment. That is support, not a pass guarantee.
Frequently asked questions
What is the difference between ISO 31000 and COSO ERM?
ISO 31000:2018 gives eight principles, a framework and a six-activity process for managing any kind of risk. COSO's Enterprise Risk Management framework is organized as five components and 20 principles, and its title, Integrating with Strategy and Performance, shows its emphasis: tying risk to strategy and performance. Both aim at the same outcome, and many organizations use one as the main approach and borrow ideas from the other.
Can ISO 31000 and COSO ERM be used together?
Yes. They are not mutually exclusive, and nothing in either document stops you from using both. The practical condition is consistency: one set of risk criteria, one risk register and one vocabulary, so results from the two do not conflict when they reach the board.
How does ISO 31000 relate to ISO/IEC 27005?
ISO/IEC 27005:2022 applies the general principles of ISO 31000 to information security. It gives guidance on information security risk assessment and treatment, and it supports the risk requirements of ISO/IEC 27001. ISO 31000 covers every kind of risk, while ISO/IEC 27005 stays inside information security.
Do I have to use ISO/IEC 27005 to get ISO/IEC 27001 certified?
No. ISO/IEC 27001 asks you to define and apply a risk assessment process that produces consistent, comparable results, but it does not name ISO/IEC 27005 or any other method as a requirement. ISO/IEC 27005 is the guidance most organizations use because it was written to support that requirement.
What is the NIST Risk Management Framework?
The NIST Risk Management Framework, defined in NIST SP 800-37 Revision 2, is a seven-step process: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. It integrates security, privacy and supply chain risk management into the system development life cycle, and it works at the level of individual systems. ISO 31000 works at the level of the whole organization.
Is NIST CSF 2.0 a risk management framework?
NIST CSF 2.0, released on February 26, 2024, organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It helps an organization describe and improve its cybersecurity program. It is narrower than ISO 31000, which covers every type of risk, and the two work well together.
Which risk management framework is best for cybersecurity risk?
There is no single best choice, because the frameworks answer different questions. ISO/IEC 27005 fits an organization building an ISO/IEC 27001 management system. NIST CSF 2.0 fits a team that wants a shared language for cybersecurity outcomes. The NIST RMF fits system-by-system authorization. ISO 31000 or COSO ERM sits above them and puts cyber risk next to other enterprise risks.
How does cybersecurity risk fit into enterprise risk management?
NIST's guidance treats information and communications technology risk as one part of enterprise risk. Cyber risks are recorded in lower-level registers, then aggregated and normalized into an enterprise register so leaders can compare them with other risk types. NIST revised its IR 8286 series on December 18, 2025 to describe how to do this.
Which risk management framework should I learn as a professional?
Start with ISO 31000, because its vocabulary and structure are the base the others build on, and PECB certifies individuals against it from Provisional Risk Manager to Senior Lead Risk Manager. Add ISO/IEC 27005 if your work is information security, or NIST CSF 2.0 and the RMF if you work with US-style system authorization.
Sources
- ISO 31000:2018, Risk management: Guidelines, International Organization for Standardization
- ISO/IEC 27005:2022, Guidance on managing information security risks, International Organization for Standardization
- Risk Management Framework (RMF), NIST Computer Security Resource Center
- NIST Releases Version 2.0 of Landmark Cybersecurity Framework, NIST, February 26, 2024
- NIST Revises Publications on Integrating Cybersecurity and Enterprise Risk Management, NIST, December 18, 2025
- NIST SP 800-221, Enterprise Impact of Information and Communications Technology Risk, NIST
- Enterprise Risk Management: Integrating with Strategy and Performance, COSO
- Managing Cyber Risk in a Digital Age, COSO
- COSO ERM: Getting Risk Management Right, The Institute of Internal Auditors, Internal Auditor