The NIST Cybersecurity Framework

The NIST Cybersecurity Framework (CSF) is a voluntary, risk-based framework published by the US National Institute of Standards and Technology. It is deliberately technology-neutral and adaptable to any organization size or sector.

Its strength is a simple, memorable structure for organizing a security program. Originally built for critical infrastructure, it is now used broadly worldwide as a common language for cybersecurity risk.

The heart of the CSF is the Core, organized into high-level Functions. The classic five are:

• Identify — understand your assets and risks.
• Protect — put safeguards in place.
• Detect — find events when they happen.
• Respond — act on detected incidents.
• Recover — restore and learn.

CSF 2.0 (2024) adds a sixth, Govern, wrapping the others with oversight and strategy.

Identify builds the organizational understanding needed to manage risk. You cannot protect what you do not know you have.

• Asset management, hardware, software, data, services.
• Business environment and critical dependencies.
• Risk assessment and risk management strategy.
• Supply-chain risk.

This function answers what do we have and what threatens it? Everything downstream depends on getting it right.

Protect implements safeguards to limit or contain the impact of an event. This is the bulk of preventive controls:

• Identity management and access control (least privilege, MFA).
• Awareness and training.
• Data security, encryption at rest and in transit.
• Maintenance and protective technology (hardening, patching).

Protect reduces the likelihood and blast radius of incidents before they occur.

Detect defines activities to identify a cybersecurity event in a timely way. Prevention always fails eventually, so detection is essential.

• Continuous security monitoring (SIEM, EDR, network sensors).
• Anomaly and event detection, knowing your baseline.
• Detection processes that are tested and maintained.

The metric here is detection time, the longer a threat goes unseen, the more damage it does.

Respond covers the actions taken once an incident is detected, to contain its impact.

• Response planning, a documented incident response plan.
• Communications, internal and external, including legal and PR.
• Analysis, understanding scope and root cause.
• Mitigation, containing and eradicating the threat.

This is where SOAR playbooks and IR runbooks live. A well-rehearsed response shrinks the impact of any given breach.

Recover restores capabilities impaired by an incident and feeds lessons back into the program.

• Recovery planning and tested backups.
• Improvements, the post-incident review that updates controls.
• Communications during restoration.

Recover closes the loop. The post-incident lessons-learned step is what turns a painful breach into a stronger program rather than a repeated mistake.

CSF 2.0 introduced Govern as a function that spans all the others. It establishes and monitors the organization's cybersecurity risk management strategy, expectations, and policy.

• Roles, responsibilities, and accountability.
• Risk management strategy aligned to business goals.
• Policy and oversight, including board-level involvement.

Govern reflects that cybersecurity is a leadership and enterprise-risk concern, not just a technical one.

Each Function breaks into Categories and Subcategories (specific outcomes), referenced with codes.

The CSF defines Implementation Tiers describing how mature and integrated your risk management is, from Tier 1 to Tier 4:

• Tier 1 Partial — ad hoc, reactive.
• Tier 2 Risk Informed — practices approved but not org-wide.
• Tier 3 Repeatable — formal policies, consistently applied.
• Tier 4 Adaptive — continuously improving, threat-driven.

Tiers are not a maturity score to maximize blindly; pick the tier that matches your risk and resources.

The CSF becomes actionable through Profiles. Build two and compare them:

• A Current Profile — the outcomes you achieve today.
• A Target Profile — the outcomes you need given your risk and business goals.

The gap between them is your prioritized roadmap. This gap analysis turns the abstract framework into a concrete, budgeted plan: close the highest-risk gaps first. It is how the CSF drives investment decisions rather than sitting as a reference document.

Map an activity to the correct CSF Function.

The NIST Cybersecurity Framework:

• A voluntary, risk-based, technology-neutral structure for organizing a security program.
• Core Functions: Identify, Protect, Detect, Respond, Recover, plus Govern (added in CSF 2.0) wrapping them all.
• Identify knows assets and risk; Protect prevents; Detect finds events; Respond contains; Recover restores and learns.
• Functions decompose into Categories and Subcategories (coded outcomes); a Profile is the set you target.
• Implementation Tiers (1 Partial to 4 Adaptive) describe maturity; choose the tier that fits your risk, do not maximize blindly.