NIST Cybersecurity Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CSF 2.0 release date

NIST released version 2.0 of the Cybersecurity Framework in February 2024, a decade after the original 2014 version, adding the Govern function and expanding scope beyond critical infrastructure.

Voluntary framework status

The NIST CSF is voluntary guidance, not a regulation. Organizations adopt it to manage risk, while legal obligations arise from separate laws, regulations, and contracts.

CSF Core definition

The Core is a set of cybersecurity outcomes organized by Function, Category, and Subcategory. It states what should be achieved without prescribing specific products or implementations.

Informative References role

Informative References map Core Subcategories to specific controls in standards such as NIST SP 800-53, ISO/IEC 27001, and CIS Controls, letting organizations reuse existing control work.

Executive Order 13636

The 2013 executive order that directed NIST to develop a voluntary cybersecurity framework for critical infrastructure, leading to the original CSF released in February 2014.

CSF audience in 2.0

CSF 2.0 targets organizations of all sizes, sectors, and maturity levels, including small businesses, non-profits, and state and local governments, not only critical infrastructure operators.

CSF versus compliance checklist

The CSF is outcome-based and risk-based rather than prescriptive. It does not define pass or fail criteria, so it complements rather than replaces audit standards and regulatory requirements.

Framework terminology: Framework Profile

A Profile is a selected subset of Core outcomes aligned to an organization's mission, risk appetite, and obligations. It describes current and desired cybersecurity posture.

Govern function purpose

Govern, new in CSF 2.0, establishes and monitors the organization's cybersecurity risk management strategy, expectations, and policy, and sits at the center of the other five functions.

Identify function scope

Identify covers understanding the organization's assets, suppliers, and risks. Categories include asset management, risk assessment, improvement, and the risk management strategy category.

Protect function scope

Protect covers safeguards that limit or contain incidents: identity management and access control, awareness and training, data security, platform security, and technology infrastructure resilience.

Detect function scope

Detect covers finding and analyzing anomalous activity. Its categories are continuous monitoring and adverse event analysis, spanning networks, physical environments, personnel, and external service providers.

Respond function scope

Respond covers actions after an incident is detected: incident management, incident analysis, reporting and communication, and mitigation, including coordination with internal and external stakeholders.

Recover function scope

Recover covers restoring assets and operations affected by an incident. Categories are incident recovery plan execution and incident recovery communication with stakeholders.

Six CSF 2.0 Functions

The CSF 2.0 Core has six Functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern is new compared with the five Functions of CSF 1.1.

Subcategory identifier format

Subcategories use codes of Function and Category abbreviations plus a number, for example ID.AM-01 or PR.AA-05, which support mapping, gap analysis, and automated tooling.

Functions are not sequential

The CSF Functions describe concurrent areas of activity, not phases. Detect, Respond, and Recover operate alongside Protect, and Govern spans all of them continuously.

Tier 1 Partial

Tier 1 describes ad hoc, informal risk management. The organization has limited awareness of cybersecurity risk, and information sharing with external parties is minimal or absent.

Tier 2 Risk Informed

Tier 2 means risk management practices are approved by management but not adopted as organization-wide policy. Awareness of risk exists but processes are not formalized.

Tier 3 Repeatable

Tier 3 means formal, organization-wide policies and processes are defined, regularly updated, and consistently applied, with defined roles and methods for responding to change.

Tier 4 Adaptive

Tier 4 organizations adapt continuously, learn from experience, share information proactively, and use predictive indicators to improve cybersecurity risk management ahead of threats.

Tier meaning clarified

Tiers describe the rigor of an organization's cybersecurity risk governance and management processes. They do not measure absolute security or guarantee a specific risk level.

Current Profile purpose

A Current Profile records which Core outcomes the organization is already achieving and at what Tier, forming the baseline for gap analysis and remediation planning.

Target Profile purpose

A Target Profile states the desired cybersecurity outcomes aligned to mission, risk appetite, and obligations. Comparing it with the Current Profile reveals gaps to prioritize.

Community Profile definition

A Community Profile is a baseline Profile created and shared by a group with common interests, such as a sector or region, which members can adopt or tailor.

Organizational Profile definition

An Organizational Profile describes how an organization's mission objectives, stakeholders, and risks align with Core outcomes. It may cover the whole organization or a subset.

Scope step in implementation

The first implementation step defines organizational objectives, risk appetite, in-scope assets and systems, and applicable legal and contractual obligations before any Profile work begins.

Gather information step

Before building a Current Profile, collect existing policies, risk assessments, asset inventories, incident records, audit findings, and control mappings to establish an evidence base.

Gap analysis output

Gap analysis compares Current and Target Profiles to identify missing or underperforming outcomes. Its output is a prioritized list of gaps that feeds the action plan.

Action plan contents

An action plan lists prioritized gaps with owners, resources, timelines, and expected outcomes, ordered by risk and mission impact, and is tracked to completion.

Iterative CSF lifecycle

Framework implementation is continuous: after action-plan execution, Profiles and Tiers are revisited as threats, technology, and business objectives change, restarting the cycle.

Prioritizing by risk appetite

Gaps are prioritized using the organization's risk appetite and mission impact, not by maximizing Tier level, because a higher Tier is not automatically the right target.