SaaS Firm With Strong Protect and Weak Detect
A 600-employee SaaS company serves 4,000 business customers and stores payroll data. Its security budget is $3.2 million. Over three years it invested in endpoint detection and response, hardware tokens, vulnerability scanning, and a patch SLA of 14 days for critical flaws. Last quarter an intruder used a stolen service account and dwelled for 36 hours before a customer reported odd invoices; containment took five days. The CISO wants $800,000 for another endpoint tool. The company has no complete asset inventory, no formal risk appetite, and no documented incident response roles. Post-incident review found logs existed but no one monitored them, and the on-call engineer did not know whom to call. The CEO asks whether more protection spending is the right answer and how the NIST CSF Core should guide the next 12 months.
1. Using the CSF Core functions, diagnose why the incident was not contained faster and why more Protect spending alone is unlikely to fix it.
Read the worked answer
The incident is not primarily a Protect failure. The stolen service account bypassed controls that Protect spending had already funded, and the endpoint tool did not monitor the service account behavior that mattered. The weakness sits across several functions. Identify is weak because there is no complete asset inventory or service-account inventory, so the team cannot know what is exposed or what normal looks like. Detect is weak because logs existed but no monitoring use cases or alert triage turned them into action. Respond is weak because roles, escalation paths, and playbooks were undocumented; the on-call engineer lacked a contact tree. Govern is weak because there is no risk appetite or clear accountability for incident decisions. Recover was untested. CSF functions are concurrent and continuous, not sequential maturity stages. Adding another Protect tool would increase cost without addressing the 36-hour dwell time or the five-day containment. The higher-value investment is detection engineering, response roles, and asset visibility, with Protect maintained rather than expanded blindly.
2. Propose a 12-month sequencing of CSF function improvements and justify the order.
Read the worked answer
A defensible sequence starts with Govern and Identify because they set the decision rights and visibility needed by every other function. In the first quarter, define risk appetite, assign incident response ownership, and build an asset and service-account inventory with criticality ratings. In the second quarter, strengthen Detect by turning existing logs into prioritized use cases, assigning 24/7 triage through the existing provider or a retainer, and testing alert quality. In the third quarter, formalize Respond with an incident response plan, roles, escalation contacts, communication templates, and at least two tabletop exercises. In the fourth quarter, test Recover through backup restoration and post-incident lessons, then feed findings back into Govern. Protect should be maintained, not ignored: patch SLAs and MFA remain important, but the plan should not buy another endpoint tool before detection and response are operable. Metrics should include mean time to detect, mean time to contain, percentage of critical assets logged, and percentage of incidents handled with a documented playbook.
3. What metrics and board reporting should replace tool-count reporting?
Read the worked answer
Tool counts and budget totals describe inputs, not risk reduction. The board should see a small set of outcome metrics tied to CSF functions: mean time to detect and mean time to contain for high-severity incidents; percentage of critical assets and service accounts in the inventory and under logging; percentage of high-severity alerts triaged within the defined service level; number of incident response exercises completed and corrective actions closed; backup restore success rate; and open high-risk gaps from the CSF profile. The CISO should also report the current and target profiles at a summary level, the tier rationale, and the top risk decisions requiring board attention. A useful narrative is: here is the risk appetite, here is where we are against it, here is what changed this quarter, and here is the funding decision requested. That reporting style makes the case for reallocating part of the $800,000 tool request into detection engineering, response capability, and governance rather than relying on tool quantity.