NIST Cybersecurity Framework fundamentals
Domain 1 - NIST Cybersecurity Framework fundamentals
This domain tests whether you understand what the NIST Cybersecurity Framework (CSF) is for, how it is built, and what it does not do. Expect questions on the CSF's voluntary, outcome-based nature and on its core components: the CSF Core, Profiles, and Implementation Tiers.
What the CSF is - and is not
- The CSF is a voluntary, risk-based framework of outcomes. It is not a certification, a prescriptive control catalog, or a maturity model.
- CSF 2.0 (February 2024) broadened the audience from critical infrastructure to organizations of all types and sizes and added the Govern function.
- The Core is a hierarchy: Functions, Categories, Subcategories. Subcategories are outcome statements, not mandatory controls.
- Informative references - such as ISO/IEC 27001, NIST SP 800-53, and CIS Controls - are illustrative mappings. They help implementation but do not become mandatory because CSF lists them.
- Profiles describe an organization's current and target cybersecurity outcomes in context.
- Tiers characterize how cybersecurity risk governance and management practices are applied; they are not maturity levels.
Worked example
An organization says, 'We are CSF compliant because we mapped our controls to all Subcategories.' The reasoning is wrong: CSF has no compliance certificate. A correct approach scopes the organization, builds a Current Profile from the outcome statements, builds a Target Profile from risk appetite and mission needs, then performs a gap analysis.
Traps
- Treating CSF as an audit checklist or certification scheme.
- Calling Tiers 'maturity levels' or assuming Tier 4 is always the target.
- Assuming informative references are mandatory.
- Confusing a Profile (current/target outcomes) with a Tier (governance/management characteristics).