Which statement best describes the structural difference between NIST CSF and ISO 27001 from an audit perspective?

• A. NIST CSF is outcome-based with Identify/Protect/Detect/Respond/Recover; ISO 27001 is an ISMS standard with Annex A controls; auditors map controls to activities, assess effectiveness, and drive continual improvement under both frameworks.
• B. NIST CSF is prescriptive; ISO 27001 is process guidelines.
• C. Both frameworks require identical control sets.
• D. NIST CSF is outcome-based with Identify/Protect/Detect/Respond/Recover; ISO 27001 is an ISMS standard with Annex A controls; auditors map controls to activities, assess effectiveness, and drive continual improvement under both frameworks.

Answer: (D)