NIST Cybersecurity Framework core functions
Domain 2 - NIST Cybersecurity Framework core functions
This domain tests the six CSF 2.0 Functions and the outcomes grouped under them. You need to recognize which Function owns an outcome and why the Functions are concurrent, not sequential.
The six Functions
- Govern (GV): cybersecurity risk governance and strategy; organizational context, risk management strategy, roles and responsibilities, policy, oversight, and supply chain risk management. Govern is cross-cutting and new in CSF 2.0.
- Identify (ID): asset management, risk assessment, and improvement.
- Protect (PR): identity and access control, awareness and training, data security, platform security, and technology infrastructure resilience.
- Detect (DE): continuous monitoring and adverse event analysis.
- Respond (RS): incident management, analysis, reporting and communication, and mitigation.
- Recover (RC): recovery plan execution and recovery communication.
How to read the hierarchy
Functions are broad outcome areas; Categories group related outcomes; Subcategories are the specific outcome statements. The Functions operate continuously and overlap. A single event will touch Govern, Identify, Protect, Detect, Respond, and Recover.
Worked example
A ransomware incident occurs. Govern sets risk appetite, roles, and supplier expectations. Identify identifies the affected asset and its business criticality. Protect had applied MFA and segregated backups. Detect notices anomalous encryption behavior. Respond contains, analyzes, and communicates. Recover restores from tested backups and communicates status. The reasoning: do not force the scenario into a single Function; map each outcome to the Function that owns it.
Traps
- Assuming the Functions run in a fixed order.
- Placing risk assessment in Protect instead of Identify.
- Forgetting that Govern is cross-cutting, not only a first step.
- Treating Detect as only tools; it also includes analysis of adverse events.