NIST Cybersecurity Foundation cheat sheet

The NIST Cybersecurity Framework (CSF) was issued in February 2014 under Executive Order 13636 as a voluntary, risk-based set of standards, guidelines, and practices; CSF 2.0 followed in February 2024.

CSF 2.0 consists of six parts: the Core, Organizational Profiles, Tiers, the Implementation Examples, the Informative References, and a new Govern function; the earlier version had five functions and no Informative References section as a standalone part.

The CSF is explicitly voluntary and outcome-based: it describes what outcomes matter, not which specific products or controls an organization must buy.

CSF 2.0 broadened the intended audience from critical infrastructure to organizations of all sizes, sectors, and maturity levels, including small businesses and non-profits.

The CSF complements, rather than replaces, other frameworks: it can be mapped to ISO/IEC 27001, NIST SP 800-53, CIS Controls, and COBIT through Informative References.

The CSF is not a compliance checklist and does not itself create legal obligations; obligations come from laws, regulations, and contracts that the CSF can help satisfy.

Key vocabulary: Core (desired outcomes), Profile (alignment of outcomes to mission and risk), Tier (rigor of governance and management), and Informative References (mappings to standards).

CSF 2.0 added a Quick Start Guide and small-business guidance, reflecting a design goal of usability for organizations without dedicated security staff.

The Core comprises six Functions in CSF 2.0: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC).

Govern is new in CSF 2.0 and is placed at the center: it covers organizational context, risk management strategy, roles and responsibilities, policy, and supply-chain risk management.

Identify covers asset management, risk assessment, improvement, and the new CSF 2.0 category of risk management strategy at the organizational level.

Protect covers identity management and access control, awareness and training, data security, platform security, and technology infrastructure resilience.

Detect covers adverse event analysis and continuous monitoring, including monitoring of networks, physical environments, and personnel activity.

Respond covers incident management, analysis, reporting and communication, and mitigation, with CSF 2.0 adding explicit incident response reporting categories.

Recover covers incident recovery plan execution and recovery communication, aiming to restore assets and operations affected by a cybersecurity incident.

Function and Category identifiers are stable codes (for example GV.OC, ID.AM, PR.AA, DE.CM, RS.MA, RC.RP) used for mapping, gap analysis, and tooling.

The Functions are not a sequential lifecycle: activities in Detect, Respond, and Recover run concurrently with Protect and Identify, and Govern spans all of them.

CSF Tiers are Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable, and Tier 4 Adaptive; they characterize rigor of cybersecurity risk governance and management, not absolute security level.

Tier 1 Partial: informal, ad hoc risk practices with limited awareness of organizational cybersecurity risk and little or no information sharing with external parties.

Tier 2 Risk Informed: risk management practices are approved by management but not organization-wide policy; awareness exists at the organizational level but processes are not formalized.

Tier 3 Repeatable: formal, organization-wide policy and processes that are regularly updated, with defined roles and consistent methods for responding to change.

Tier 4 Adaptive: the organization adapts to lessons learned and to evolving threats, shares information actively, and improves continuously based on predictive indicators.

Tiers apply to the organization's overall risk management approach; the same organization can sit at different Tiers for different Functions or Categories.

A Profile is a mechanism for describing an organization's current state (Current Profile) and desired state (Target Profile) against Core outcomes.

CSF 2.0 distinguishes Organizational Profiles (organization-level scope) from Community Profiles (created and shared by a group with common interests, such as a sector).

Gap analysis compares Current and Target Profiles; prioritized gaps drive a remediation action plan and can justify Tier movement.

The CSF 2.0 implementation lifecycle: Scope, Gather Information, Create the Current Profile, Perform a Gap Analysis, Create an Action Plan, and Implement the Plan.

Step 1 Scope: define organizational objectives, the risk appetite, the assets and systems in scope, and the relevant regulatory and contractual obligations.

Step 2 Gather Information: collect policies, risk assessments, asset inventories, incident records, audit findings, and existing control mappings.

Step 3 Current Profile: record which Core outcomes are currently achieved and at what Tier; Step 4 Gap Analysis compares this against the Target Profile.

Step 5 Action Plan: prioritize gaps by risk and mission impact, assign owners, resources, and timelines, and record expected outcomes.

Step 6 Implement: execute the plan, then monitor and update the Profiles as threats, business objectives, and technology change; the cycle is iterative, not one-time.

Informative References map Core outcomes to specific controls in standards such as NIST SP 800-53, ISO/IEC 27001, CIS Controls, and COBIT, so the framework can reuse existing control work.

Prioritization should be driven by the organization's mission and risk appetite rather than by Tier maximization; a higher Tier is not automatically the right target.

Supply-chain risk and third-party dependencies are addressed in CSF 2.0 under Govern (GV.SC) and should be captured in the organizational Profile scope.

Small organizations commonly start with a narrow scope, use the CSF 2.0 Small Business Quick-Start Guide, and build a Target Profile incrementally.

The CSF 2.0 implementation lifecycle: Scope, Gather Information, Create the Current Profile, Perform a Gap Analysis, Create an Action Plan, and Implement the Plan.

Step 1 Scope: define organizational objectives, the risk appetite, the assets and systems in scope, and the relevant regulatory and contractual obligations.

Step 2 Gather Information: collect policies, risk assessments, asset inventories, incident records, audit findings, and existing control mappings.

Step 3 Current Profile: record which Core outcomes are currently achieved and at what Tier; Step 4 Gap Analysis compares this against the Target Profile.

Step 5 Action Plan: prioritize gaps by risk and mission impact, assign owners, resources, and timelines, and record expected outcomes.

Step 6 Implement: execute the plan, then monitor and update the Profiles as threats, business objectives, and technology change; the cycle is iterative, not one-time.

Informative References map Core outcomes to specific controls in standards such as NIST SP 800-53, ISO/IEC 27001, CIS Controls, and COBIT, so the framework can reuse existing control work.

Prioritization should be driven by the organization's mission and risk appetite rather than by Tier maximization; a higher Tier is not automatically the right target.

Supply-chain risk and third-party dependencies are addressed in CSF 2.0 under Govern (GV.SC) and should be captured in the organizational Profile scope.

Small organizations commonly start with a narrow scope, use the CSF 2.0 Small Business Quick-Start Guide, and build a Target Profile incrementally.

CSF Tiers are Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable, and Tier 4 Adaptive; they characterize rigor of cybersecurity risk governance and management, not absolute security level.

Tier 1 Partial: informal, ad hoc risk practices with limited awareness of organizational cybersecurity risk and little or no information sharing with external parties.

Tier 2 Risk Informed: risk management practices are approved by management but not organization-wide policy; awareness exists at the organizational level but processes are not formalized.

Tier 3 Repeatable: formal, organization-wide policy and processes that are regularly updated, with defined roles and consistent methods for responding to change.

Tier 4 Adaptive: the organization adapts to lessons learned and to evolving threats, shares information actively, and improves continuously based on predictive indicators.

Tiers apply to the organization's overall risk management approach; the same organization can sit at different Tiers for different Functions or Categories.

A Profile is a mechanism for describing an organization's current state (Current Profile) and desired state (Target Profile) against Core outcomes.

CSF 2.0 distinguishes Organizational Profiles (organization-level scope) from Community Profiles (created and shared by a group with common interests, such as a sector).

Gap analysis compares Current and Target Profiles; prioritized gaps drive a remediation action plan and can justify Tier movement.

The Core comprises six Functions in CSF 2.0: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC).

Govern is new in CSF 2.0 and is placed at the center: it covers organizational context, risk management strategy, roles and responsibilities, policy, and supply-chain risk management.

Identify covers asset management, risk assessment, improvement, and the new CSF 2.0 category of risk management strategy at the organizational level.

Protect covers identity management and access control, awareness and training, data security, platform security, and technology infrastructure resilience.

Detect covers adverse event analysis and continuous monitoring, including monitoring of networks, physical environments, and personnel activity.

Respond covers incident management, analysis, reporting and communication, and mitigation, with CSF 2.0 adding explicit incident response reporting categories.

Recover covers incident recovery plan execution and recovery communication, aiming to restore assets and operations affected by a cybersecurity incident.

Function and Category identifiers are stable codes (for example GV.OC, ID.AM, PR.AA, DE.CM, RS.MA, RC.RP) used for mapping, gap analysis, and tooling.

The Functions are not a sequential lifecycle: activities in Detect, Respond, and Recover run concurrently with Protect and Identify, and Govern spans all of them.

The NIST Cybersecurity Framework (CSF) was issued in February 2014 under Executive Order 13636 as a voluntary, risk-based set of standards, guidelines, and practices; CSF 2.0 followed in February 2024.

CSF 2.0 consists of six parts: the Core, Organizational Profiles, Tiers, the Implementation Examples, the Informative References, and a new Govern function; the earlier version had five functions and no Informative References section as a standalone part.

The CSF is explicitly voluntary and outcome-based: it describes what outcomes matter, not which specific products or controls an organization must buy.

CSF 2.0 broadened the intended audience from critical infrastructure to organizations of all sizes, sectors, and maturity levels, including small businesses and non-profits.

The CSF complements, rather than replaces, other frameworks: it can be mapped to ISO/IEC 27001, NIST SP 800-53, CIS Controls, and COBIT through Informative References.

The CSF is not a compliance checklist and does not itself create legal obligations; obligations come from laws, regulations, and contracts that the CSF can help satisfy.

Key vocabulary: Core (desired outcomes), Profile (alignment of outcomes to mission and risk), Tier (rigor of governance and management), and Informative References (mappings to standards).

CSF 2.0 added a Quick Start Guide and small-business guidance, reflecting a design goal of usability for organizations without dedicated security staff.