NIST Cybersecurity Foundation key terms

A voluntary NIST publication that organizes cybersecurity outcomes into a common language of functions, categories, and subcategories, helping organizations describe, assess, and improve their management of cybersecurity risk.

Systems and assets, whether physical or virtual, so vital that their incapacity or destruction would debilitate security, national economic security, public health, or safety.

The set of desired cybersecurity outcomes, grouped into Functions, Categories, and Subcategories, presented as a common reference that is not a checklist or a prescriptive standard.

One of the five highest-level groupings of cybersecurity outcomes in the Core: Identify, Protect, Detect, Respond, and Recover. Functions organize activity at the strategic level rather than prescribing specific controls.

A subdivision of a Function that groups related cybersecurity outcomes around a common topic, such as Asset Management within Identify or Access Control within Protect.

The most granular level of the Core, describing a specific technical or management outcome that supports a Category and can be compared against an organization's current practices.

The Function focused on understanding the organization's assets, business environment, governance, risk assessment, risk strategy, and supply chain so that cybersecurity effort is directed where it matters most.

The Function covering safeguards that limit or contain the impact of a potential cybersecurity event, including access control, awareness training, data security, protective technology, and maintenance.

The Function concerned with discovering and analyzing anomalous activity, including continuous monitoring, detection processes, and maintaining visibility of events so incidents can be identified promptly.

The Function covering actions taken once an event is detected: response planning, communications, analysis, mitigation, and improvements, so impact is contained and stakeholders are informed.

The Function addressing restoration of capabilities and services impaired by an incident, including recovery planning, improvements, and coordination of communications during and after restoration.

The Identify Category concerned with inventorying physical devices, systems, data, and their business value, and managing them consistent with their importance to the organization.

The Identify Category addressing organizational cybersecurity policy, roles and responsibilities, and legal and regulatory requirements, establishing authority and accountability for cybersecurity decisions.

The Identify Category covering establishment of risk objectives, tolerances, and priorities, so cybersecurity decisions align with the organization's mission and its broader enterprise risk approach.

The Protect Category concerned with limiting access to assets and information to authorized users, processes, and devices, consistent with assessed risk and the principle of least privilege.

The Protect Category addressing protection of information at rest and in transit, including confidentiality, integrity, and availability safeguards and handling of sensitive records.

The Detect Category practice of ongoing observation of networks, systems, and physical environments, so that events and anomalies are identified quickly rather than discovered after harm occurs.

The Detect Category covering collection and analysis of data to identify unusual activity, including establishing baselines and thresholds that distinguish normal operation from potential incidents.

The Detect Category addressing maintenance and testing of detection activities, including defined roles, testing of detection mechanisms, and communication of detected events to the right people.

A documented set of roles, responsibilities, and procedures executed when an event is detected, covering analysis, containment, eradication, communication, and coordination with internal and external parties.

The Respond Category activity of containing and reducing the spread or impact of a detected event, including applying workarounds and updating response activities as new information emerges.

The Recover Category covering plans and procedures to restore systems and data after an incident, including prioritization of services and coordination with internal and external stakeholders.

The Recover Category practice of reviewing response and recovery activities after an incident and feeding identified improvements back into plans, controls, and the organization's risk decisions.

A qualitative ranking that describes how rigorous an organization's cybersecurity risk management practices are, from informal and reactive at Tier 1 to adaptive and continuous at Tier 4.

The lowest Implementation Tier, describing ad hoc, informal risk management with limited awareness of cybersecurity risk and little organizational coordination or sharing of information.

An Implementation Tier where risk management practices are approved by management but not consistently applied organization-wide, with informal and reactive sharing of risk information.

An Implementation Tier where risk management practices are formally approved and expressed as policy, applied consistently, and updated when risk changes, with regular sharing across the organization.

The highest Implementation Tier, describing an organization that adapts cybersecurity practices based on lessons learned and predictive indicators, and shares risk information continuously with partners.

A representation of the outcomes an organization has selected or achieved, used to align cybersecurity activities with business needs, risk tolerance, and available resources.

A Framework Profile describing the outcomes the organization is currently achieving, serving as a baseline against which gaps and priorities can be measured.

A Framework Profile describing the outcomes the organization intends to achieve, selected based on business needs and risk tolerance, and used to steer investment and improvement.

The comparison of the Current Profile with the Target Profile to identify missing or insufficient outcomes, which then informs prioritized action plans and resource allocation.

A prioritized list of activities, owners, and timelines created to close gaps identified in a Profile comparison and to progress toward the target state.

A mapping in the Core that points to standards, guidelines, and practices illustrating how a Subcategory outcome might be achieved, without making any of them mandatory.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, used to set the Target Profile and to prioritize which gaps to close first.

The recurring cycle of assessing the current state, setting targets, closing gaps, and repeating, which keeps the framework application aligned with a changing threat and business environment.

Visible sponsorship from executives who set risk appetite, allocate resources, and hold owners accountable, a precondition for moving beyond informal tiers and sustaining framework adoption.

Interpretations of the framework tailored to a particular industry or regulatory context, helping organizations select relevant Subcategories and informative references without altering the Core itself.