Cybersecurity (NIST frameworks)
Domain 1 tests whether you can use NIST CSF 2.0 as an operating model rather than a checklist. Expect questions on the Core, Profiles, Tiers, and how CSF relates to NIST SP 800-53 and the RMF.
Structure of CSF 2.0
CSF 2.0 has six Functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern is cross-cutting and was added in version 2.0. The Core is hierarchical: Function → Category (e.g., ID.AM) → Subcategory (ID.AM-01) → implementation examples and informative references. Informative references map subcategories to SP 800-53 Rev. 5, ISO/IEC 27001, and CIS Controls; they are crosswalks, not requirements. Profiles describe current and target outcomes; organizational profiles are scoped to your entity, community profiles are shared templates. Tiers - Partial, Risk-Informed, Repeatable, Adaptive - describe the rigor of cybersecurity risk governance, not a maturity score or certification level.
Worked example
A SaaS provider needs customer assurance. Scope: production platform plus corporate IT. Build a current profile by rating each subcategory with evidence, using 800-53 moderate controls as informative references. Gaps appear in GV.SC (supplier risk) and DE.AE (event analysis). The target profile sets priorities; the action plan assigns owners and dates. Reasoning: start with Govern so risk appetite, roles, and oversight exist before technology fixes; rate outcomes by evidence, not aspiration.
Traps
Treating Tiers as levels to 'pass'; auditing subcategories as if they were controls; starting with Protect and skipping Govern; claiming CSF alignment proves 800-53 compliance; ignoring community profile reuse.