THREATNOIR
Subscribe
Control frameworks and standards

NIST Cybersecurity Framework

Security outcomes organised in six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0 (2024) reorganised several categories.

Official source Published by US National Institute of Standards and Technology. US government work in the public domain.

What it is

The NIST Cybersecurity Framework describes the cybersecurity outcomes an organisation should achieve, without prescribing how. It exists to give leaders and practitioners a shared language for understanding, prioritising and communicating cyber risk.

Who it applies to

  • Organisations of any size or sector, in any country, as a voluntary structure for a security programme
  • Boards and executives who need a high level view of security posture and targets
  • Critical infrastructure operators, for whom it was first written
  • Organisations mapping NIS2, DORA or ISO 27001 work to a common outcome model
  • Some US regulators and customers expect programmes to be aligned with it
Status
A voluntary framework. Version 2.0 was published in February 2024, replacing version 1.1 from 2018; it added the Govern function and broadened the scope beyond critical infrastructure.
Enforcement
Voluntary: there is no certification and no regulator enforces it directly. It becomes expected in practice through customer requirements, US sector regulators and as a reference model in audits.

Key points

  • Govern, new in 2.0, covers strategy, roles, policy, oversight and cyber supply chain risk management
  • The framework describes outcomes, so you choose controls from other sources such as ISO 27001, CIS or 800-53
  • Profiles are the main working tool: the gap between current and target profile becomes your roadmap
  • Tiers are not maturity levels to maximise, they show how well risk management fits your context
  • NIST publishes quick start guides, including ones for small businesses and for creating profiles
  • Version 2.0 reorganised several categories, so mappings built for 1.1 need to be updated

Where to start

  1. 1Read the 2.0 core and the small business or organisational profile quick start guide
  2. 2Build a current profile by scoring yourself against the subcategories
  3. 3Agree a target profile with management based on risk and regulatory needs
  4. 4Turn the gaps into a prioritised plan and report progress using the six functions

How it is structured

Core: 6 functionsGovern, Identify, Protect, Detect, Respond and Recover
Categories and subcategoriesSpecific outcomes under each function, such as asset management or incident analysis
ProfilesA current profile and a target profile describe where you are and where you want to be
Tiers 1 to 4Describe how rigorous and integrated your risk management practices are
Informative references and examplesOnline mappings to other standards and implementation examples

A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.

Items explained (35)

In the order of the framework itself.