Four frameworks, one shared goal: protecting your business
Several reference frameworks structure cybersecurity worldwide. For a Swiss SME, four are particularly relevant: ISO 27001 (certifiable international standard, 93 controls, 70,000+ certified organisations), the NIST CSF (voluntary US framework, 5 functions, free of charge), the ANSSI framework (French-speaking reference, 42 hygiene measures) and the Swiss ICT Minimum Standard (recommended by FOEE for critical infrastructures).
Each has its strengths: international certification, flexibility, French-speaking pragmatism or Swiss grounding. The table below helps you choose the framework best suited to your situation. At Bexxo, we have been supporting Swiss SMEs since 2003 in achieving compliance with these frameworks.
Comparative table of the 4 cybersecurity standards
| Criterion | ISO 27001 | NIST CSF | ANSSI | ICT Min. Standard (CH) |
|---|---|---|---|---|
| Type | Certifiable standard | Voluntary framework | Government recommendations | Swiss federal standard |
| Body | ISO / IEC | NIST (USA) | ANSSI (France) | FOEE (Switzerland) |
| Structure | 93 controls (Annex A) | 5 functions, 23 categories | 42 hygiene measures + EBIOS RM | 106 measures based on NIST |
| Certification | Yes (third-party audit) | No (self-assessment) | ANSSI security visa | No (self-assessment) |
| Estimated cost | CHF 10,000 – 50,000 | Free | Free (public guides) | Free |
| Renewal | Every 3 years | Ongoing | Ongoing | Ongoing |
| Flexibility | Strict framework | Highly adaptable | Pragmatic | Adaptable by sector |
| Ideal target | SMEs seeking certification | SMEs starting in cyber | French-speaking SMEs | Critical infrastructures CH |
| Swiss relevance | Recognised by nFADP | Recommended by NCSC | French-speaking reference | Recommended by FOEE |
| Latest version | ISO 27001:2022 | CSF 2.0 (Feb. 2024) | Hygiene guide v2 (2017) | Version 2023 |
These four frameworks are complementary. The Swiss ICT Minimum Standard and NIST CSF are the best starting points for a Swiss SME. ANSSI guides bring a pragmatism valued in French-speaking contexts. ISO 27001 is the ideal choice for obtaining internationally recognised certification. At Bexxo, we combine these frameworks according to your context.
What is the NIST CSF?
The NIST Cybersecurity Framework provides voluntary guidelines for managing and reducing cybersecurity risks. These recommendations are adaptable to the diverse needs of organisations, regardless of their size and sector. Unlike ISO 27001, NIST requirements are flexible and designed to evolve with the organisation.
The 5 functions of the NIST CSF
The Framework Core is built on 5 core functions, divided into 23 categories:
- Identify — Understand the organisation's assets, risks and governance
- Protect — Implement protection measures (access control, training, encryption)
- Detect — Deploy security incident detection capabilities
- Respond — Plan and execute the response to detected incidents
- Recover — Restore services and draw lessons from the incident
Who is the NIST CSF for?
The NIST CSF is aimed at any organisation wishing to structure its cybersecurity approach without a large initial investment. It is the ideal starting point for Swiss SMEs that do not yet have a formal framework. The NCSC (National Cyber Security Centre) recommends this framework as a basis for Swiss organisations.
What is ISO 27001?
ISO 27001 is an international standard that defines best practices for information security management systems (ISMS). It enables organisations to demonstrate their approach to data security and confidentiality through a certification verifiable by an accredited third-party auditor. More than 70,000 companies worldwide are certified (ISO Survey 2023).
The 93 controls of ISO 27001:2022
The 2022 version of ISO 27001 defines 93 controls divided into 4 categories in Annex A:
- Organisational controls (37) — Policies, roles, asset management, supplier relationships
- People controls (8) — Staff selection, awareness, training
- Physical controls (14) — Security perimeter, equipment, surveillance
- Technological controls (34) — Authentication, encryption, logging, secure development
ISO 27001 certification cost and process
The cost of ISO 27001 certification for a Swiss SME is between CHF 10,000 and 50,000, depending on the size of the organisation and the complexity of its scope. The process includes: gap analysis, ISMS implementation, internal audit, then certification audit by an accredited body. At Bexxo, we support SMEs through every step of this process, from the initial analysis to obtaining certification.
The ANSSI framework (France)
The ANSSI (National Agency for the Security of Information Systems) is the French authority on cybersecurity. Its IT Hygiene Guide defines 42 essential measures covering awareness, authentication, workstation security, network security and incident management. Published free of charge, it is the most pragmatic reference for French-speaking SMEs.
The 42 IT hygiene measures
The 42 ANSSI measures cover 10 domains:
- Awareness — Train and empower users
- Authentication — Password policy and MFA
- Workstations — Updates, encryption, antivirus
- Network — Segmentation, firewall, monitoring
- Remote working — VPN, securing remote work
- Administration — Privileged accounts, logging
- Security maintenance — Monitoring, patches
- Supervision — Incident detection, alerts
- Incident management — Response plans, communication
- Business continuity — Backups, BCP/BRP
EBIOS Risk Manager
ANSSI also offers EBIOS Risk Manager, a risk analysis method structured in 5 workshops, adopted by French government bodies and many French-speaking organisations. It identifies the most realistic threat scenarios and prioritises security measures. Comparable to the NIST risk assessment, EBIOS is particularly valued for its methodological rigour in French-speaking contexts.
The Swiss ICT Minimum Standard
The ICT Minimum Standard is a framework developed by the Federal Office for National Economic Supply (FOEE) in collaboration with the NCSC. Based on the NIST CSF, it defines 106 measures organised around the 5 NIST functions, adapted to the Swiss context. It is recommended for operators of critical infrastructures but applicable to any Swiss SME.
Why the ICT Standard is relevant for Swiss SMEs
The ICT Minimum Standard offers several advantages for Swiss SMEs:
- Free and public — available in French, German and Italian on the FOEE website
- Adapted to the Swiss context — incorporates nFADP requirements and NCSC recommendations
- NIST-compatible — same 5-function structure, facilitating a transition to NIST CSF or ISO 27001
- Self-assessment — includes an Excel assessment tool to measure maturity
Which framework should you choose for your SME?
Are you new to cybersecurity? Start with the Swiss ICT Minimum Standard (free, adapted to the local context) or the ANSSI guide (42 pragmatic measures). These two frameworks give you a solid foundation without any initial investment.
Do you want to structure your approach? The NIST CSF offers a flexible framework with measurable maturity levels (score 0-4). The NCSC recommends it for Swiss SMEs.
Are you aiming for certification? ISO 27001 is the only framework certifiable by a third-party auditor. It is a strong competitive advantage for SMEs handling sensitive data or working with large enterprises. At Bexxo, we often recommend a progressive approach: ICT Standard → NIST CSF → ISO 27001.
