A South Asian fintech should move from a NIST CSF profile to ISO/IEC 27001 certification when its customers start needing third-party assurance that a self-assessment cannot provide. Not before, and not on a fixed calendar. Until that point, a CSF profile builds the same controls at lower cost and with more flexibility. After it, every month without a certificate means longer questionnaires, slower deals and exposure to a single customer's auditor deciding you are a risk.
What each framework gives you
NIST CSF 2.0 describes outcomes, not controls. NIST calls it "not prescriptive." It gives you Organizational Profiles, a Current Profile of what you achieve today and a Target Profile of what you are aiming for, and Tiers from Partial (Tier 1) to Adaptive (Tier 4) that describe how rigorous your risk practices are. The CSF document itself defines no certification. A CSF profile is your own statement about yourself.
ISO/IEC 27001 is a management system standard that accredited certification bodies audit against. A certificate is a third party's statement about you, within a defined scope. That difference is the whole decision.
A CSF profile is your statement about yourself. A certificate is someone else's statement about you.
The triggers
Triggers come from your customers' obligations, not your own maturity. A fintech serving banks inherits the assurance demands their regulators place on them.
Trigger 1: your customer's regulator asks them to get assurance from you
Nepal Rastra Bank's Cyber Resilience Guidelines 2023 apply to institutions licensed by the Payment Systems Department, including A to D class BFIs, payment system operators and payment service providers. Para 63 says the licensed institution should obtain assurance from its participants that they meet its cyber resilience requirements, "in the form of participant self-attestations or external third-party certifications." Para 64 says it should request confirmation that third-party vendors and service providers meet its requirements, with contracts covering "validation of security capabilities," for example "a self-assessment" or "a third-party assessment such as a certification, accreditation or external audit."
The CRG does not require you to hold ISO 27001. It requires your bank customer to get assurance from you. A self-assessment is allowed. The trigger is the day a customer tells you a self-assessment no longer satisfies their own reviewers.
Trigger 2: a regulator names the certificate
Some rules skip the choice. In Sri Lanka, the framework in Schedule I of CBSL's Banking Act Directions No. 16 of 2021 requires licensed banks to ensure that third-party SOC providers exposed to the bank's non-public data hold "a certification for the latest edition of ISO 27001" from an accredited certification body, for the SOC services provided (section 5.6.9). Section 3.5 defines an accredited body as one accredited by the Sri Lanka Accreditation Board or by a member of the International Accreditation Forum. If your product falls under a rule like this, the decision is made for you.
Trigger 3: questionnaires start costing more than an audit
Banks following CSF 2.0's supply chain category push requirements into supplier contracts (GV.SC-05), perform due diligence before onboarding (GV.SC-06) and monitor supplier risk across the relationship (GV.SC-07). Each bank runs its own version. When your team spends more time answering bespoke questionnaires than an annual surveillance audit would take, a certificate becomes the cheaper answer.
Trigger 4: a partner outside the region asks
Partners in other markets may not know your regulator's guidelines. An accredited ISO 27001 certificate is something they can evaluate without learning them. When a correspondent, card scheme partner or international investor asks for one, a local self-assessment is a weak substitute.
The failure mode: the certificate that covers the wrong thing
One way to waste a certification is scope dodging. To get certified fast, the fintech scopes the ISMS to head office IT or a single internal function and leaves out the product the bank is buying. The certificate is real. It answers a question nobody asked. The first bank reviewer who reads the scope statement sends the full questionnaire anyway.
Scope the ISMS around what customers rely on: the platform, the people who run it, and the suppliers it depends on. A narrower first scope is fine if it contains the product.
Using the CSF profile until the trigger hits
The CSF work is not wasted. Done properly, it is most of the groundwork for certification.
Ordered steps for founders and CTOs:
- Write the Current Profile now. Record which CSF outcomes you achieve and how. Be specific enough that a bank reviewer could test it.
- Set a Target Profile tied to customer demands. Start from the requirements your bank customers have actually sent you, not a generic template.
- Build evidence as you go. Every outcome in the profile should point to a record: a policy, a log, a review, a ticket. Certification audits run on evidence.
- Track the triggers. Keep a short log of customer requests for third-party assurance, regulator-named certifications and questionnaire hours. Review it each quarter.
- Decide scope before you decide timing. Agree internally which product and services the ISMS will cover. If that scope wouldn't satisfy your largest customer, it is the wrong scope.
- Run a gap assessment against ISO 27001 when two triggers are live. One trigger can be a single demanding customer. Two suggests the market has moved.
A quick self-test
- Has any customer rejected a self-assessment in the last year?
- Does any rule your customers are under name ISO 27001 for your type of service?
- How many hours did questionnaires take last quarter?
- Would your planned ISMS scope include the product your largest customer buys?
If the answer to any of the first three is yes and the fourth is no, fix the scope before you book the audit. For Nepali BFIs on the other side of this relationship, the regulatory case for ISO 27001 is covered in The CISO's Guide to NRB Unified Directives 2081. For board-level governance under CSF 2.0, see Govern as a bank board's job description.