Many security teams hear the ISF Standard of Good Practice mentioned in audits, supplier questionnaires and board papers without knowing what it is or how it relates to ISO 27001 and the NIST Cybersecurity Framework. The Standard of Good Practice for Information Security (SOGP) is a control reference published by the Information Security Forum (ISF), a membership organisation. This short explainer covers what the ISF says publicly about the SOGP, who can use it, how it sits next to the frameworks you probably already run, and how to decide whether it is worth adopting. It is written for security managers, GRC leads and CISOs. It is based only on the ISF's public pages, checked in November 2026, and does not describe the members-only content of the standard.
Key takeaways
- It is a control reference, not a certification. The SOGP is a library of good-practice controls you use to write policy and test coverage; there is no SOGP certificate to obtain.
- The current edition is SOGP 2026. The ISF says it launched exclusively to ISF Members, with an executive summary available to download and a public SOGP Framework release announced for later in the year.
- The ISF states alignment with three external frameworks. Its SOGP page names ISO/IEC 27002, the NIST Cybersecurity Framework and the CSA Cloud Controls Matrix.
- The Benchmark is its measuring tool. The ISF Benchmark mirrors the SOGP structure, so members can assess themselves by SOGP topic and compare results with peers.
- Use it to supplement, not replace. If you need an ISO 27001 certificate or a NIST CSF profile, keep that as the anchor and use the SOGP as extra depth where your own control set is thin.
What the SOGP is and who publishes it
The ISF is an independent, member-funded organisation. Its SOGP page describes the standard as covering a wide range of information security topics across current and emerging threats, technology and risk, and names risk management specialists, information security managers and security practitioners as its users. The ISF also states that the SOGP is "trusted by 93% of ISF Members", which is a figure about its own membership, not about the wider market.
The ISF's 2024 edition webinar page described that release as a major update covering artificial intelligence, cyber resilience and Zero Trust, and listed three intended uses: input into security policies, standards and procedures; a comprehensive reference library of controls; and a supplement to existing control frameworks. The ISF Annual Report 2025 adds that the SOGP provides "continuously updated controls" and lists it beside the ISO/IEC 27001 series, NIST CSF and CIS as a framework the ISF assesses compliance against.
The ISF does not publish the internal structure (numbers of categories, areas or topics) of the 2026 edition on its public pages, and this guide does not repeat secondary descriptions of older editions. Read the executive summary for the official overview.
Editions and access
| Item | What the ISF states publicly | What it means for you |
|---|---|---|
| Current edition | SOGP 2026, launched exclusively to ISF Members | Cite the edition year in policies and supplier contracts |
| Previous edition | SOGP 2024, presented as a major update (AI, cyber resilience, Zero Trust) | Check which edition any mapping or assessment you inherit was built on |
| Full standard | Members only for now | Non-members cannot rely on the full control text |
| Executive summary | Available to download from the SOGP page | The lawful starting point for non-members |
| Public framework | Announced for release to the public later in 2026, with a waitlist | Watch the ISF page; terms of public access were not stated when checked |
| Benchmark | Exclusive to ISF Members, online assessment tool | Only useful if you are, or plan to become, a member |
How the SOGP sits next to ISO 27001 and NIST CSF
The three are different kinds of document, which is why they combine well. For the wider landscape see the Cybersecurity Frameworks Compared Guide.
| Question | ISF SOGP | ISO/IEC 27001:2022 | NIST CSF 2.0 |
|---|---|---|---|
| What kind of document | Good-practice control reference | Management system requirements with Annex A controls | Outcome taxonomy (Functions, Categories, Subcategories) |
| Publisher | Information Security Forum (membership body) | ISO and IEC | US National Institute of Standards and Technology |
| Certification | None | Accredited third-party certification | None; self-assessed profiles and tiers |
| Access | Members; public framework announced | Purchased standard | Free |
| Stated link to the others | ISF states alignment with ISO/IEC 27002 and NIST CSF | Annex A controls are described in detail in ISO/IEC 27002 | NIST publishes informative references to other frameworks |
Because the ISF aligns the SOGP with ISO/IEC 27002, and ISO/IEC 27002 gives the guidance behind the ISO/IEC 27001 Annex A controls, the practical route from SOGP to ISO 27001 runs through 27002. Use the ISF's own mapping, where your membership gives you access to it, rather than building one from memory. See the ISO 27001 Certification Guide and the NIST CSF 1.1 vs CSF 2.0 guide.
When the SOGP is worth adopting
- You are already an ISF Member: adopt it as your control library and use the Benchmark for year-on-year measurement; you are already paying for both.
- You need a certificate for customers: anchor on ISO 27001. The SOGP can deepen individual controls but does not replace an accredited certificate in a tender.
- You report to a board on outcomes: anchor on NIST CSF 2.0 profiles and use SOGP content to define what "good" looks like inside each outcome.
- Customers or regulators name it: some supplier questionnaires and group policies reference the SOGP. Ask which edition and which sections apply before you commit effort.
- Small organisation, not a member: the free NIST CSF 2.0 and CIS Controls usually give enough structure; revisit the SOGP once the public framework is released and its terms are clear.
Using the SOGP in practice
- Confirm the edition and your rights. Record which SOGP edition you use and whether your licence allows sharing extracts with suppliers or auditors.
- Pick one anchor framework. Keep ISO 27001 or NIST CSF 2.0 as the backbone of your control register and add SOGP references as a column, so each control has one owner.
- Map through ISO/IEC 27002. Use the ISF-provided alignment to link SOGP topics to your Statement of Applicability. See the ISO 27001 Statement of Applicability Template.
- Close gaps, do not duplicate. Where the SOGP covers a topic your anchor treats lightly (the ISF highlights AI, cyber resilience and Zero Trust in recent editions), write the extra requirement into your existing policy rather than a parallel one.
- Measure. Members can use the Benchmark, which the ISF says offers a 50-question Security Radar, a Security Healthcheck of up to 500 questions and a library of over 5,000 questions for in-depth assessments.
- Re-baseline on each new edition. Treat a new SOGP edition like a framework change: diff it, update mappings, and record decisions.
Measuring the programme
- Coverage: percentage of anchor-framework controls with a mapped SOGP reference and a named owner.
- Edition currency: months since the current SOGP edition was released versus when your mapping was last updated.
- Benchmark trend: score movement by SOGP topic between assessments (members).
- Duplicate controls: number of controls that appear twice because two frameworks were registered separately (target: zero).
Framework mapping for running the programme itself
| Activity | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 |
|---|---|---|---|
| Set policy from a chosen good-practice source | GV.PO-01 | PM-9 | Clause 5.2, Annex A 5.1 |
| Assign control owners | GV.RR-02 | PM-9 | Clause 5.3 |
| Improve from assessments and benchmarking | ID.IM-01, GV.OV-01 | PM-9 | Clause 10.1 |
Common failure patterns
- Treating SOGP alignment as certification. Telling customers you "comply with the ISF standard" does not answer a request for an ISO 27001 certificate.
- Running two registers. Separate SOGP and ISO 27001 control lists double the evidence work and drift apart.
- Stale editions. Mappings built on an older edition are kept after a new one is released.
- Using unofficial copies or summaries. Content shared outside the ISF licence, or third-party summaries of older editions, can be wrong and may breach licence terms.
Practitioner checklist
- Download the SOGP 2026 executive summary from the ISF and record the edition you use.
- Decide on one anchor framework for your control register.
- If you are a member, obtain the ISF's own alignment to ISO/IEC 27002 and NIST CSF.
- Add SOGP references as a column in the existing register, not a second register.
- Check your licence before sharing SOGP text with suppliers or auditors.
- Plan a Benchmark assessment (members) and set a re-assessment date.
- Watch the ISF page for the public framework release and its terms.
Standards and references
- Information Security Forum: Standard of Good Practice for Information Security
- Information Security Forum: SOGP 2024, the all-encompassing Standard of Good Practice
- Information Security Forum: The Benchmark
- Information Security Forum: Annual Report 2025
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Cybersecurity Frameworks Compared Guide · ISO 27001 Certification Guide · NIST CSF 1.1 vs CSF 2.0 · ISO 27001 Statement of Applicability Template