NIST Cybersecurity Lead Implementer cheat sheet

NIST CSF 2.0 has six Functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), Recover (RC); Govern was added in 2.0 and sits at the center of the wheel.

CSF 2.0 Categories are numbered by Function (e.g., GV.OC Organizational Context, ID.AM Asset Management, PR.AA Identity Management and Access Control); Subcategories are the outcome statements used for gap assessment.

CSF Implementation Tiers (1 Partial, 2 Risk Informed, 3 Repeatable, 4 Adaptive) describe the rigor of cybersecurity risk governance and are NOT a maturity scorecard of individual controls.

CSF Profiles (Current and Target) map organizational outcomes to the Framework; a Community Profile is a baseline published for a shared sector or use case.

NIST RMF steps in order: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor (SP 800-37 Rev. 2); Prepare was added in Rev. 2 and precedes Categorize.

FIPS 199 impact levels (Low/Moderate/High) are derived from the high-water mark of confidentiality, integrity, and availability impacts on organizational operations, assets, or individuals.

SP 800-53 Rev. 5 organizes controls into 20 families with a two-letter identifier (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, RA, SA, SC, SI, SR, PT); PT (PII Processing) and SR (Supply Chain) were added in Rev. 5.

SP 800-53A assessment procedures produce findings of Satisfied, Other than Satisfied, or Not Applicable per control; a control baseline is the set of controls selected for a given impact level.

A cybersecurity program charter must name the accountable executive, scope boundaries, delegated authority, and reporting line; without an accountable owner, risk acceptance is unenforceable.

Three-lines model: first line owns and operates controls, second line sets policy and oversees risk, third line (internal audit) provides independent assurance; the implementer typically sits in the first or second line.

Policy hierarchy: Policy (mandatory intent) → Standard (specific mandatory requirements) → Procedure (step-by-step) → Guideline (recommended); exceptions require documented, time-bound risk acceptance.

Performance measurement distinguishes metrics (lagging, outcome-based, e.g., mean time to remediate) from indicators (leading, predictive, e.g., patch SLA compliance rate).

A corrective action plan (POA&M) entry needs a weakness description, root cause, owner, milestone dates, resources, and a risk rating; open POA&M items are the primary input to authorization decisions.

Security awareness programs are measured by behavior change (phishing simulation click and report rates, policy attestation completion), not by training hours delivered.

Business continuity and disaster recovery are management-owned: define RTO (time to restore) and RPO (tolerable data loss) per process, then test at least annually with documented lessons learned.

Third-party risk management requires tiering vendors by data sensitivity and access, contract clauses for breach notification and audit rights, and periodic reassessment proportional to tier.

Risk = likelihood × impact (qualitative) or annualized loss expectancy (ALE) = single loss expectancy (SLE) × annualized rate of occurrence (ARO); SLE = asset value × exposure factor.

Risk treatment options are exactly four: mitigate, transfer, avoid, accept; residual risk after treatment must be explicitly accepted by an accountable owner with authority.

Risk register entries include asset/process, threat, vulnerability, existing controls, inherent risk, residual risk, treatment plan, owner, and review date.

NIST SP 800-30 Rev. 1 risk assessment steps: prepare for assessment, conduct assessment (identify threat sources/events, vulnerabilities, determine likelihood, determine impact, determine risk), communicate results, maintain assessment.

Compliance mapping: a single control can satisfy multiple frameworks (e.g., CSF PR.AA maps to 800-53 AC family and ISO 27001 Annex A access controls); use a control crosswalk rather than duplicate controls.

Authorization (A&A) evidence set: system security plan (SSP), security assessment report (SAR), plan of action and milestones (POA&M), and the authorization decision memo signed by the authorizing official.

Continuous monitoring (RMF step 7) requires defined metrics, ongoing control assessments, and change-driven reassessment triggers; authorization is time-bound and must be re-examined at least annually.

Evidence for audits must be contemporaneous, attributable, and retained per retention schedule; screenshots without timestamps or owner are weak evidence and commonly rejected.