NIST Cybersecurity Foundation: Applying the framework in an organization

Domain 4 - Applying the framework in an organization

This domain tests implementation: scoping, governance, profiling, gap analysis, prioritization, and continuous improvement. Questions often ask what to do first or how to use CSF with existing programs.

A practical sequence

1. Scope the CSF use: enterprise-wide, business unit, product line, or supply chain.
2. Establish sponsorship, risk appetite, and roles; use Govern outcomes to anchor this.
3. Build a Current Profile by assessing outcomes, not by buying tools.
4. Build a Target Profile from mission, legal, regulatory, and risk requirements.
5. Perform a gap analysis and prioritize actions by risk, cost, and mission impact.
6. Use informative references to reuse existing controls and map them to Subcategories.
7. Integrate with enterprise risk management, business continuity, incident response, and supplier risk management.
8. Monitor, measure, and update profiles as risk and technology change.

Worked example

A manufacturer scopes one plant and its critical suppliers. The Current Profile shows weak supplier risk management and limited continuous monitoring. The Target Profile requires documented supplier reviews and 24/7 detection for the plant. The gap analysis prioritizes supplier reviews first because a single supplier failure could stop production. The team maps existing ISO 27001 controls to CSF outcomes, records residual gaps, and sets a review cycle. Tier targets are set for Govern and Detect, not for the entire enterprise at once.

Traps

• Trying to address every Subcategory in the first cycle.
• Treating CSF adoption as a one-time project.
• Skipping scope and governance and starting with a tool purchase.
• Assuming informative references must be implemented as written.
• Ignoring supply chain risk, which CSF 2.0 emphasizes through Govern.