NIST Cybersecurity Foundation study plan

Define the five core functions of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover) and state the purpose of each in your own words

Explain how the Framework is organized into the Core, Implementation Tiers, and Profiles, and describe how the three parts relate to one another

Map each of the five core functions to at least two Categories and two Subcategories from the Framework Core, writing out the identifiers (for example ID.AM, PR.AC, DE.CM)

Distinguish the Framework's voluntary, outcome-based nature from prescriptive compliance regimes, and list at least three benefits an organization gains from adopting it

Break down the Identify function into its Categories (Asset Management, Business Environment, Governance, Risk Assessment, Risk Management Strategy, Supply Chain Risk Management) and describe the outcome each Category targets

Break down the Protect function into its Categories (Identity Management and Access Control, Awareness and Training, Data Security, Information Protection Processes and Procedures, Maintenance, Protective Technology) and give a concrete control example for each

Contrast the Detect function's Categories (Anomalies and Events, Security Continuous Monitoring, Detection Processes) and explain how detection outcomes depend on Identify and Protect activities

Explain how Respond (Response Planning, Communications, Analysis, Mitigation, Improvements) and Recover (Recovery Planning, Improvements, Communications) close the loop after an incident

Explain what an Implementation Tier is and why Tiers describe the rigor of cybersecurity risk management rather than the maturity of specific controls

Describe each of the four Tiers (Partial, Risk-Informed, Repeatable, Adaptive) in terms of risk management process, integrated risk management program, and external participation

Identify the characteristics that distinguish Tier 2 from Tier 3 and Tier 3 from Tier 4, and give an example scenario that would justify each Tier

Explain what a Framework Profile is, differentiate a Current Profile from a Target Profile, and describe how the gap between them drives prioritized action

Construct a prioritized action plan from the gap between a Current Profile and a Target Profile, ranking gaps by risk and by cost or feasibility

Justify a Tier selection for a given organization using factors such as regulatory exposure, business criticality, and available resources

Explain how Profiles can be used for different purposes, including organizational Profiles, sector-specific Profiles, and supply chain Profiles

Describe how an organization communicates Tier and Profile results to executives and to external partners without overstating its posture

Outline the steps to establish a Framework implementation program, starting with identifying business objectives, stakeholders, and the scope of systems and assets

Describe how to orient the organization by mapping existing practices and controls to Framework Subcategories to build an initial Current Profile

Explain how to create a Target Profile that reflects the organization's risk appetite and business requirements

Determine how to assess, prioritize, and plan actions for closing gaps, including how to sequence quick wins against longer-term initiatives

Describe how to integrate the Framework with existing risk management, audit, and compliance activities instead of running it as a parallel program

Explain how to measure and report progress using Framework-based metrics and how to feed results back into continuous improvement

Identify common adoption pitfalls, such as treating the Framework as a checklist, over-scoping the initial effort, or neglecting executive sponsorship, and propose a mitigation for each

Explain how the Framework relates to other NIST publications and standards without claiming that it replaces them

Review all four domains using a consolidated outline and identify the three weakest areas based on practice question performance

Re-derive the five functions and their Categories from memory and check accuracy against your week 2 mapping table

Re-explain the four Tiers and the Current versus Target Profile distinction in writing without consulting notes

Practice applying the Framework to two short scenario descriptions by selecting relevant Subcategories and recommending a Tier

Re-teach the weakest concepts from the week 7 error log by writing short explanations in your own words for each missed item

Complete a full timed practice exam and compare the domain-level score breakdown against the week 7 baseline

Synthesize the entire Framework into a single one-page reference sheet covering functions, Categories, Tiers, and Profiles

Finalize a personal exam-day strategy covering time allocation, flagging and returning to uncertain items, and handling scenario questions that combine multiple domains