Having worked performing assessments against these frameworks and standards. The important thing people need to know particularly for NIST, is that you could ha

Having worked performing assessments against these frameworks and standards. The important thing people need to know particularly for NIST, is that you could have a clean bill of health today. But if one or two of your controls fails tomorrow, then you may run into trouble. NIST isn't a maturity framework, it doesn't tell you that you need x control in place to be x level of maturity. It gives you control objectives that you need to design and operate effectively over time. You might have a great set of controls across penetration testing and vulnerability management today, but if you fail to perform one of these controls tomorrow you will be vulnerable. For example, I have performed controls assessments against organisations that have implement CIS controls. I have seen more often than not, CIS controls not being fully implemented as per the wording of the control AND the control not having been performed appropriately. This is where using a cyber security standard and obtaining controls assurance is very important.