[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Foverview":3},{"item":4,"lessons":16,"controls":66,"related":93},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","overview","CSF","NIST Cybersecurity Framework",12,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The NIST Cybersecurity Framework is a voluntary, outcome based framework for managing cybersecurity risk. Version 2.0, published in 2024, organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover, each split into categories and subcategories. It does not prescribe specific controls.\n\n**In practice.** Organisations typically use it to build a current profile of where they stand and a target profile of where they want to be, then plan and prioritise the gap. Informative references map subcategories to detailed control sets, and implementation tiers describe how rigorous risk management practices are. Managers use it to report posture to boards and to align security with enterprise risk.\n\n**Common gaps.** A common mistake is treating the framework as a checklist and scoring every subcategory without tying it to business risk. Profiles are often produced once and not maintained, and the Govern function added in 2.0 is frequently underdeveloped.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ransomware-hits-south-africas-air-traffic-control-systems","Ransomware Hits South Africa's Air Traffic Control Systems","2026-09-30T08:20:50.35+00:00",{"slug":23,"title":24,"published_at":25},"law-enforcement-takedown-of-criminal-vpn-service-highlights-third-party-risk","Law Enforcement Takedown of Criminal VPN Service Highlights Third-Party Risk","2026-06-14T20:20:23.737+00:00",{"slug":27,"title":28,"published_at":29},"ai-powered-worms-present-new-autonomous-threat-landscape","AI-Powered Worms Present New Autonomous Threat Landscape","2026-06-05T16:20:34.798+00:00",{"slug":31,"title":32,"published_at":33},"supply-chain-partner-data-breach-exposes-153k-customer-records","Supply Chain Partner Data Breach Exposes 153K Customer Records","2026-04-23T05:09:56.464+00:00",{"slug":35,"title":36,"published_at":37},"chinese-smart-home-devices-hide-surveillance-infrastructure-through-shell-companies","Chinese Smart Home Devices Hide Surveillance Infrastructure Through Shell Companies","2026-04-23T02:09:32.814+00:00",{"slug":39,"title":40,"published_at":41},"state-sponsored-groups-target-critical-energy-infrastructure","State-Sponsored Groups Target Critical Energy Infrastructure","2026-04-15T18:09:06.884+00:00",{"slug":43,"title":44,"published_at":45},"google-implements-memory-safe-dns-parser-in-pixel-10-to-eliminate-vulnerability-class","Google Implements Memory-Safe DNS Parser in Pixel 10 to Eliminate Vulnerability Class","2026-04-14T19:08:51.702+00:00",{"slug":47,"title":48,"published_at":49},"supply-chain-attack-compromises-openais-code-signing-process","Supply Chain Attack Compromises OpenAI's Code Signing Process","2026-04-13T22:10:00.269+00:00",{"slug":51,"title":52,"published_at":53},"android-banking-trojan-linked-to-cambodian-scam-operations-targets-21-countries","Android Banking Trojan Linked to Cambodian Scam Operations Targets 21 Countries","2026-04-10T22:09:41.417+00:00",{"slug":55,"title":56,"published_at":57},"iranian-threat-actor-targets-los-angeles-metro-critical-infrastructure","Iranian Threat Actor Targets Los Angeles Metro Critical Infrastructure","2026-04-10T00:08:10.938+00:00",{"slug":59,"title":60,"published_at":61},"foreign-router-ban-highlights-supply-chain-security-risks","Foreign Router Ban Highlights Supply Chain Security Risks","2026-03-25T19:07:59.719+00:00",{"slug":63,"title":64,"published_at":65},"fcc-bans-foreign-routers-due-to-supply-chain-security-risks","FCC Bans Foreign Routers Due to Supply Chain Security Risks","2026-03-25T09:07:50.92+00:00",[67,72,76,80,84,88],{"slug":68,"name":69,"problem":70,"stories":71},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",2,{"slug":73,"name":74,"problem":75,"stories":71},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":77,"name":78,"problem":79,"stories":71},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":81,"name":82,"problem":83,"stories":71},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",{"slug":85,"name":86,"problem":87,"stories":71},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",{"slug":89,"name":90,"problem":91,"stories":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,[94,100,106,111,116,120,124,128],{"family":95,"item":96,"code":97,"title":98,"together":99},"cis","12","Control 12","Network Infrastructure Management",7,{"family":101,"item":102,"code":103,"title":104,"together":105},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",6,{"family":95,"item":107,"code":108,"title":109,"together":110},"2","Control 2","Inventory and Control of Software Assets",3,{"family":112,"item":113,"code":114,"title":115,"together":110},"iso","27036","ISO\u002FIEC 27036","ISO\u002FIEC 27036: Cybersecurity, Supplier relationships",{"family":101,"item":117,"code":118,"title":119,"together":110},"800-82","SP 800-82","SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security",{"family":95,"item":121,"code":122,"title":123,"together":71},"15","Control 15","Service Provider Management",{"family":95,"item":125,"code":126,"title":127,"together":71},"13","Control 13","Network Monitoring and Defense",{"family":129,"item":6,"code":130,"title":131,"together":71},"iec-62443","62443","IEC 62443 series"]