NIST Cybersecurity Framework

The NIST Cybersecurity Framework (CSF) is a voluntary set of standards and best practices that helps organizations manage cybersecurity risk. The current version, CSF 2.0, was published on February 26, 2024. It organizes cybersecurity work into six Functions, adds a Govern Function that CSF 1.1 did not have, and applies to organizations of any size or sector rather than to critical infrastructure alone.

What is a cyber security framework?

A cybersecurity framework is a structured set of practices for managing cyber risk. Frameworks such as ISO/IEC 27001 and 27002 give organizations a common vocabulary, a way to measure where they stand, and some assurance that industry best practices are being met. The NIST CSF is the most widely adopted of them in the United States.

What is the NIST Cyber Security Framework?

NIST CSF (the National Institute of Standards and Technology Cybersecurity Framework) is a set of standards to help companies improve their overall cybersecurity posture. The NIST CSF defines a set of best practices that enables IT organizations to more effectively manage cybersecurity risks. Organizations can voluntarily use this framework to assess their cyber risks and set plans for improving or maintaining their security posture over time. The framework focuses on using business drivers to guide cybersecurity activities and considering cybersecurity risks as part of the organization’s risk management processes. In addition, the framework provides a common taxonomy and structure for cybersecurity by assembling standards, guidelines, and practices that are working effectively today.

NIST published CSF 2.0 on February 26, 2024. It is the current version of the framework and it replaces CSF 1.1.

The NIST CSF framework consists of three main parts: the framework core, the implementation tiers, and the framework profiles. The framework core is a set of cybersecurity activities, outcomes, and informative references common across sectors. CSF 1.1 was titled Framework for Improving Critical Infrastructure Cybersecurity. NIST retired that title for CSF 2.0, which is written for organizations of every size and sector. Elements of the core provide detailed guidance for developing individual, organizational profiles. Framework profiles will help an organization align and prioritize its cybersecurity activities with its business objectives and requirements, risk tolerances, and resources. The tiers provide a mechanism for organizations to view and understand the characteristics of their approach to managing cybersecurity risk, which will help in prioritizing and achieving cybersecurity objectives.

The NIST CSF framework offers a flexible way to address cybersecurity. It applies to organizations relying on technology, whether their cybersecurity focuses primarily on information technology, industrial control systems, and connected devices more generally, including the Internet of Things. In addition, the framework can assist organizations in addressing cybersecurity as it affects the privacy of customers, employees, and other parties.

It is important to note that the NIST CSF framework is not a one-size-fits-all approach to managing cybersecurity risk for critical infrastructure. Organizations will have unique risks, including different threats, different environments, and different risk tolerance and will need to modify and customize the framework. Organizations can prioritize investments to maximize the impact of each dollar spent. The goal of the framework is to reduce and better manage cybersecurity risk.

The NIST Framework Core

The framework core is a set of cybersecurity activities, desired outcomes, and relevant references common across critical infrastructure sectors. The core represents industry standards, guidelines, and practices that allow for communication of cybersecurity activities and outcomes across the organization from the executive level to the implementation/operations level. The CSF 2.0 Core is organized around six concurrent and continuous Functions. CSF 2.0 added Govern to the five Functions defined in CSF 1.1. These include:

• Govern: The organization establishes, communicates, and monitors its cybersecurity risk management strategy, expectations, and policy. This Function was added in CSF 2.0 and covers roles, responsibilities, policy, oversight, and cybersecurity supply chain risk management.
• Identify: Organizations manage cybersecurity risk to systems, people, assets, data, and capabilities.
• Protect: This function is where you develop and implement appropriate safeguards to ensure the delivery of critical protective services.
• Detect: This function is where you develop and implement appropriate activities to identify the occurrence of a cybersecurity event. The detect function enables the timely discovery of cybersecurity events.
• Respond: Develop and implement appropriate activities to take action regarding a detected cybersecurity incident.
• Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident.

When considered together these functions provide a high level, strategic view of the life cycle of an organization’s management of cybersecurity risk. The framework then identifies the key categories and subcategories which are discrete outcomes for each function. It then matches them with an example informative reference such as existing standards guidelines, and practices for each subcategory.

What changed in CSF 2.0

CSF 2.0 made three changes that affect how organizations use the framework.

Govern was added as a sixth Function. NIST defines it this way: the organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored. Govern sits alongside the other five rather than above them, and it is where roles, policy, and oversight of cyber risk now live.

The scope widened. CSF 1.1 was titled Framework for Improving Critical Infrastructure Cybersecurity. NIST retired that title for 2.0, which is written for organizations of all sizes and sectors, including industry, government, academia, and nonprofits.

Supply chain risk management moved into Govern. Cybersecurity supply chain risk management is now a Category under Govern, which raises it from an implementation detail to a governance outcome.

The NIST CSF Framework Implementation Tiers

The framework implementation tiers provide context on how an organization views cybersecurity risk and the processes in place to manage that risk. Tiers reflect a progression from informal reactive response to approaches that are agile and risk informed. During the tiers selection process, an organization should consider its current risk management practices, threat environment, legal and regulatory requirements, business and mission objectives and organizational constraints such as available budgets. The four tiers are:

Tier 1: Partial

• Risk Management Process : Not formalized and risk is managed ad hoc and sometimes reactive manner.
• Integrated Risk Management Program : Limited awareness of cybersecurity risk at an organizational level.
• External Participation : The organization does not understand its role in the larger ecosystem with respect to either its dependencies or dependents.

Tier 2: Risk Informed

• Risk Management Process : Risk management practices are approved by management but may not be established as organizational-wide policy.
• Integrated Risk Management Program : There is an awareness of cybersecurity risk at the organizational level, but an organization wide approach to managing this risk has not been established.
• External Participation : Generally, the organization understands its role in the larger ecosystem with respect to either its own dependencies or dependents, but not both.

Tier 3: Repeatable

• Risk Management Process : The organization’s risk management practices are formally approved and expressed as policy.
• Integrated Risk Management Program : There is an organization-wide approach to managing cybersecurity risk.
• External Participation : The organization understands its role, dependencies, and dependents in the larger ecosystem and may contribute to the community’s broader understanding of risks.

Tier 4: Adaptive

• Risk Management Process : The organization adapts its cybersecurity practices based on previous and current cybersecurity activities, including lessons learned and predictive indicators.
• Integrated Risk Management Program : There is an organization-wide approach to managing cybersecurity risk that uses risk-informed policies, processes, and procedures to address potential cybersecurity events.
• External Participation : The organization understands its role, dependencies, and dependents in the larger ecosystem and contributes to the community’s broader understanding of risks.

A Framework Profile

A Framework Profile is the set of outcomes an organization selects from the CSF Categories and Subcategories, based on its own business needs. The profile can be characterized as the alignment of standards and practices to the framework core in a particular implementation scenario.

Profiles can be used to identify opportunities for improving cyber security posture by comparing a current profile with a target profile. A Current Profile describes the as-is state, and a Target Profile describes the to-be, or desired, state. To develop a profile, an organization can review all of the categories and subcategories, based on business and mission drivers in a risk assessment, determine which are most important. The current profile can then be used to support prioritization and measurement of progress towards the target profile, factoring in other business needs including cost-effectiveness and areas such as innovation. Profiles can be used to conduct self-assessments and communicate within an organization, or between organizations.

Comparison of profiles may reveal gaps to be addressed to meet cybersecurity risk management objectives. An action plan to address these gaps to fulfill a given category or subcategory can contribute to the roadmap described above. Prioritizing the mitigation of gaps is driven by the organization’s business needs and risk management process. This risk-based approach enables an organization to gauge the resources needed to achieve cybersecurity goals in a cost-effective, prioritized manner.

Assessing Cybersecurity Risk with the NIST CSF Framework

In summary, CSF 2.0 is designed to reduce risk by tying cybersecurity work to organizational objectives, and by making governance of that work an explicit outcome rather than an assumption. Ideally, organizations using the framework will be able to measure and assign values to the risk along with the cost and benefits of steps taken to reduce risk to acceptable levels. Organizations using the CSF are better able to measure their risk and weigh the cost and benefit of different cybersecurity strategies. Over time, NIST CSF helps organizations develop a more rational, effective, approach to cybersecurity strategy and investment.

Frequently asked questions about the NIST CSF

What are the six Functions of the NIST Cybersecurity Framework?

Govern, Identify, Protect, Detect, Respond, and Recover. Govern was added in CSF 2.0. The other five carried over from CSF 1.1 unchanged in name.

What is the difference between NIST CSF and ISO 27001?

NIST CSF is a voluntary framework that describes cybersecurity outcomes and leaves the controls to you. ISO/IEC 27001 is a certifiable standard that sets requirements for an information security management system. You can be audited and certified against ISO 27001. There is no certification against the CSF itself.

Is NIST 800-53 a security framework?

NIST SP 800-53 is a control catalog rather than a framework: it lists specific security and privacy controls. The CSF describes the outcomes you are trying to reach, and NIST maps 800-53 controls to CSF Subcategories as Informative References, so the two are designed to be used together.

What are the four CSF Implementation Tiers?

Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable, and Tier 4 Adaptive. Tiers describe how rigorous and how well integrated your risk management practices are. They are not maturity levels, and Tier 4 is not the right target for every organization.