Complete Guide to the NIST Cybersecurity Framework

In an era where cybersecurity and data privacy are paramount, organizations are tasked with the monumental challenge of safeguarding sensitive information, protecting intellectual property, and ensuring the uninterrupted operation of IT systems. This task has become increasingly complex in a landscape marked by sophisticated cyber threats—a fact underscored by a 2023 independent survey which revealed a significant rise in ransom payments, with the average amount paid soaring from $812,380 in 2022 to $1,542,333 in 2023.

Moreover, organizations are under the microscope when it comes to stringent regulatory compliance requirements and validation related to personal data usage, operating systems, and IT system security. Non-compliance can lead to severe repercussions, including hefty fines, erosion of customer trust, exclusion from government contract opportunities, and other detrimental impacts.

However, amidst these challenges, there is a beacon of hope: the National Institute of Standards and Technology (NIST). For almost ten years, NIST has been at the forefront of developing comprehensive cybersecurity risk management frameworks. These include the well-regarded Cybersecurity Framework (NIST CSF), which is voluntary, as well as the mandatory NIST 800-53 and NIST 800-171 standards for U.S. government contractors.

These frameworks offer invaluable guidance for Chief Information Security Officers (CISOs) tasked with crafting and implementing robust cybersecurity strategies. This guide delves into the specifics of the NIST CSF, 800-53, and 800-171, providing a treasure trove of information to address the most pressing questions about NIST and equipping you with insights you might not have considered. Additionally, we’ve included links for deeper exploration and a practical guide to preparing for a NIST compliance audit. Stay informed and ahead in the cybersecurity realm with our comprehensive overview, updated for 2024.

What Is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework (NIST CSF) emerged as a pivotal initiative by the National Institute of Standards and Technology to fortify the security of the United States’ crucial infrastructure. Its inception aimed at creating a unified set of standards, objectives, and terminologies to enhance information security and mitigate the consequences of cyberattacks. By fostering a common language, NIST CSF facilitates improved decision-making and fosters a standardized approach across different sectors, crucial for combating cyber threats like phishing and ransomware.

Introduced in 2014 and later updated to Version 1.1 in 2018, NIST CSF has undergone significant evolution. Although a draft Version 2.0 was released for public feedback in August 2023 and closed for comment in November 2023, the final release of Version 2.0 is anticipated. This framework has demonstrated remarkable flexibility, prompting NIST to recommend its adoption by organizations of all sizes and industries voluntarily.

The framework is structured around five core functions that embody the capabilities a comprehensive cybersecurity program should possess: Identify, Protect, Detect, Respond, and Recover. These functions are further broken down into categories and subcategories that detail leading information security practices, incident response strategies, and effective ransomware recovery techniques.

‘Special Publications’ take a deeper dive into specific areas

Beyond the core framework, NIST has published over 200 special documents addressing various facets of cybersecurity risk management, ranging from identity access control and protective technology management to incident response and artificial intelligence applications.

One of the most influential of these documents is NIST 800-53, designed to support organizations in complying with the Federal Information Security Modernization Act (FISMA). This set of controls is mandatory for federal agencies and their supply chain partners, including defense contractors, underlining the framework’s extensive reach and utility in establishing robust cybersecurity defenses across multiple sectors.

Top Security Control Families in NIST SP 800-53

The NIST SP 800-53 publication is a cornerstone document that delineates over 1,000 specific controls across 20 distinct control families. These families categorize the wide array of cybersecurity measures recommended for robust information security management. Below is an outline of the NIST 800-53 control families, reflecting their critical roles in safeguarding information systems:

• ​AC – Access Control: Strategies and mechanisms to limit access to information systems.
• ​PS – Personnel Security: Procedures to ensure that personnel with access to sensitive information are trustworthy.
• ​AU – Audit and Accountability: Keeping detailed logs to monitor and analyze actions that could affect security.
• ​PE – Physical and Environmental Protection: Safeguarding physical premises and the environment around critical systems.
• ​AT – Awareness and Training: Educating users and administrators about security risks and controls.
• ​PL – Planning: Development, documentation, and implementation of security plans.
• ​CA – Security Assessment and Authorization: Evaluating the effectiveness of security controls and authorizing system operations.
• ​PT – PII Processing and Transparency: Managing personal information with transparency and accountability.
• ​CM – Configuration Management: Ensuring security through controlled changes and configurations.
• ​PM – Program Management: Oversight and management of security programs.
• ​CP – Contingency Planning: Preparing for, responding to, and recovering from system disruptions.
• ​RA – Risk Assessment: Identifying and analyzing risks to organizational operations.
• ​IA – Identification and Authentication: Verifying the identity of users and devices.
• ​SC – System and Communications Protection: Protecting communications and control processes.
• ​IR – Incident Response: Responding to and managing security incidents.
• ​SI – System and Information Integrity: Ensuring accuracy and trustworthiness of system information.
• ​MA – Maintenance: Performing maintenance to ensure it does not affect security adversely.
• ​SA – System and Services Acquisition: Acquiring systems and services that meet security requirements.
• ​MP – Media Protection: Protecting digital and physical media containing sensitive information.
• ​SR – Supply Chain Risk Management: Managing risks from the supply chain to reduce vulnerabilities.

Regarded as the cybersecurity benchmark by federal agencies, NIST 800-53 also ensures compliance with the Federal Information Processing Standard Publication 200 (FIPS 200), mandatory for government entities and affiliates.

Moreover, NIST Special Publication 800-171, designed to protect Controlled Unclassified Information (CUI) in nonfederal systems and organizations, is pivotal for defense contractors engaging with the U.S. Department of Defense (DoD), further illustrating the breadth and importance of the NIST cybersecurity framework in national security and beyond.

Does the NIST Cybersecurity Framework Apply to All Businesses?

The NIST Cybersecurity Framework (CSF) is a versatile tool designed to enhance cybersecurity measures across various sectors. Initially crafted to safeguard the nation’s critical infrastructure, its applicability has broadened significantly over time. Today, the CSF is embraced by a diverse range of entities, including universities, research institutions, public corporations, and private businesses, highlighting its widespread relevance and utility.

While the CSF’s origins are rooted in protecting critical infrastructure, its comprehensive approach to cybersecurity has made it a go-to resource for organizations seeking to fortify their digital defenses. It’s important to note, however, that for the majority of businesses, adherence to the CSF remains a voluntary commitment. This flexibility allows entities of all sizes and sectors to tailor the framework’s guidelines to their specific needs, making it an invaluable asset for any organization aiming to enhance its cybersecurity posture.

What Are the NIST Framework Core Components?

The NIST Cybersecurity Framework (CSF) provides a blueprint for organizations to develop robust cybersecurity programs. It’s built around core components designed to streamline cybersecurity practices across various sectors. These core components are essential for understanding and implementing the framework effectively:

Framework Core

The Framework Core is the backbone of the NIST CSF, organizing cybersecurity activities into five primary functions that represent the lifecycle of managing cybersecurity risk:

1. 1.Identify: Develop an organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.
2. 2.Protect: Implement safeguards to ensure delivery of critical infrastructure services.
3. 3.Detect: Define the appropriate activities to identify the occurrence of a cybersecurity event.
4. 4.Respond: Specify the actions to take regarding a detected cybersecurity incident.
5. 5.Recover: Identify activities to restore any capabilities or services impaired due to a cybersecurity incident.

Each function is further divided into categories and subcategories, which outline specific objectives and actions. Informative references are also provided to offer guidance and resources for achieving these objectives.

Implementation Tiers

These tiers describe the degree to which an organization’s cybersecurity risk management practices exhibit the characteristics defined in the Framework Core, ranging from Partial (Tier 1) to Adaptive (Tier 4). They help organizations assess their approach to managing cybersecurity risk for organizational systems and guide the progression toward more sophisticated practices.

Framework Profiles

Profiles are unique alignments of an organization’s requirements, risk tolerances, and resources against the desired outcomes of the Framework Core. They enable organizations to establish a roadmap for reducing cybersecurity risk consistent with their mission, needs, and objectives.

By integrating these core components, the NIST CSF facilitates a strategic, flexible, and scalable approach to cybersecurity, allowing organizations to adapt the framework according to their specific needs, risk levels, and business environments.

The Framework Core

At the heart of the NIST CSF is the Framework Core, which is instrumental in outlining the essential functions and activities of an efficient cybersecurity program. It comprises:

• ​Functions: These are the foundational elements that organize basic cybersecurity activities into five main areas: Identify, Protect, Detect, Respond, and Recover. Each function is a high-level goal aimed at managing and mitigating cybersecurity risk.
• ​Categories: Within each function, categories provide subdivisions related to cybersecurity outcomes and activities.
• ​Subcategories: For each category, subcategories further break down specific objectives into actionable steps.
• ​Informative References: These are specific standards, guidelines, and practices that support the achievement of the subcategories.

Implementation Tiers

The CSF also introduces four implementation tiers that serve as benchmarks for assessing an organization’s cybersecurity maturity and the extent to which NIST controls are applied:

• ​Tier 1—Partial: This tier indicates an ad-hoc and reactive cybersecurity posture with limited awareness of organizational cybersecurity risk.
• ​Tier 2—Risk-Informed: At this level, an organization has a risk-informed approach but may not have fully systematic cybersecurity practices.
• ​Tier 3—Repeatable: Organizations at this tier have established and repeatable cybersecurity practices that are well-managed and informed by organizational risk.
• ​Tier 4—Adaptive: This highest tier represents a dynamic and proactive approach to cybersecurity, with practices that are adapted based on continuous risk assessment and organizational learning.

Framework Profiles

Profiles in the CSF enable organizations to map their specific security needs, objectives, risk tolerance, and resources against the desired outcomes defined in the Framework Core. This facilitates the customization of the CSF to align with an organization’s unique context, enhancing its effectiveness in achieving specific cybersecurity goals.

By understanding and leveraging these core components, organizations can systematically address cybersecurity challenges, enhance their resilience against cyber threats, and effectively communicate their cybersecurity posture across all levels of the organization.

The Five Functions of the NIST CSF

The framework core at the heart of the CSF consists of five cybersecurity functions. Those five functions then consist of 23 categories in all. The categories, in turn, consist of 108 sub-categories listing the requirements and controls necessary to satisfy each category, as well as “informative references” that provide a list of additional frameworks and other resources to consult for more information.

Keep in mind that the NIST CSF is not intended as a one-size-fits-all framework. Each organization may decide which functions, categories, and subcategories it will comply with.

The functions, with their categories and subcategories, are as follows.

1. Identify

Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.

Asset management (ID.AM):

• ​Your enterprise has identified the data, personnel, devices, systems, and facilities essential to its critical business services.
• ​Your enterprise has prioritized those assets according to their importance and the organization’s risk strategy.
• ​Your enterprise manages its assets according to their priority. This means that your organization has achieved these goals:
  • ​Taken inventory of all physical devices and systems.
  • ​Taken inventory of all software platforms and applications.
  • ​Mapped its communication and data flows.
  • ​Cataloged its external information systems.
  • ​Prioritized its resources (hardware, devices, data, time, personnel, and software) according to their classification, level of importance (criticality), and business value.
  • ​Established cybersecurity roles and responsibilities enterprise-wide and for third-party stakeholders (suppliers, customers, partners).

Business environment (ID.BE):

• ​Your teams understand the organization’s mission, objectives, stakeholders, and activities as prioritized.
• ​Your teams use this information to inform cybersecurity roles, responsibilities, and risk management decisions. This means that they have:
  • ​Identified and communicated your organization’s role in the supply chain.
  • ​Identified and communicated your organization’s place in critical infrastructure and its industry sector.
  • ​Established and communicated its priorities for the mission, business objectives, and activities.
  • ​Mapped its dependencies and critical functions for the delivery of critical services.
  • ​Established resilience requirements to support the delivery of critical services during normal operations, during an attack, under duress, and during recovery.

Governance (ID.GV):

Cybersecurity risk managers and the board know, understand, and use your enterprise security policies, procedures, and processes to manage and monitor the organization’s regulatory, legal, risk, environmental, and operational requirements.

• ​You’ve established and communicated the cybersecurity policy.
• ​Your organization has coordinated and aligned cybersecurity roles and responsibilities with internal roles and external partners.
• ​Managers understand and are overseeing compliance with legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations.
• ​Your governance and risk management processes address cybersecurity risks.

Risk assessment (ID.RA):

Your organization understands the cybersecurity risk to its operations (including mission, functions, image or reputation), assets, and people.

• ​You’ve identified and documented the vulnerabilities to your assets.
• ​You’ve arranged to get cyber threat intelligence from information-sharing forums and sources.
• ​You’ve identified and documented the threat environment, which is the threats your enterprise faces from internal and external sources.
• ​You’ve identified potential business impacts of risks and threats, as well as the likelihood of their occurring.
• ​You’ve used threats, vulnerabilities, likelihoods, and impacts to determine overall risk.
• ​You’ve identified and prioritized risk responses.

Risk management strategy (ID.RM):

Your organization has established its priorities, constraints, risk tolerances, and assumptions and uses them to support operational risk decisions.

• ​You’ve established and actively managed risk management processes, with stakeholders’ agreement.
• ​You’ve determined and clearly expressed your organization’s risk tolerance.
• ​In determining risk tolerance, you’ve considered your enterprise’s role in critical infrastructure and have considered risk analyses of your sector.

Supply chain risk management (ID.SC):

Your enterprise has set priorities, constraints, risk tolerances, and assumptions and has defined processes to identify, assess, and manage supply chain risks.

• ​You’ve identified, established, and assessed supply chain risk management processes and manage these with stakeholder agreement.
• ​You’ve identified, prioritized, and assessed the suppliers and third-party partners of your information systems, components, and services using a cyber-supply-chain risk assessment process.
• ​You use contracts with suppliers and third-party partners to meet the objectives of your cybersecurity program and cyber-supply-chain risk management plan.
• ​You routinely assess your suppliers and third-party partners using audits, test results, or other evaluations to confirm that they are meeting their contractual obligations.
• ​You plan and test response and recovery procedures with suppliers and third-party providers.

2. Protect

Assure that critical infrastructure services remain available. Categories and sub-categories are:

Identity management, authentication, and access control (PR.AC):

Only authorized users, processes, and devices can access physical and logical assets and associated facilities. How you manage this access depends on the risks associated with unauthorized access.

• ​Issue, manage, verify, revoke, and audit identities and credentials for authorized devices, users, and processes.
• ​Manage and protect physical access to assets.
• ​Manage remote access.
• ​Manage user accounts’ access permissions and administrative privileges using the principles of least privilege needed to do one’s job and separation of duties.
• ​Protect network integrity using such means as network segregation and network segmentation, as well as updated antivirus software and secure data backup.
• ​Proof and bind identities to credentials and have them asserted in interactions.
• ​Authenticate users, devices, and other assets commensurate with the risk of each transaction.

Awareness and training (PR.AT):

Your organization’s personnel and partners receive cybersecurity awareness education and are trained to perform their cybersecurity-related duties and responsibilities consistent with policies, procedures, and agreements.

• ​All users are informed and trained.
• ​Privileged users understand their roles and responsibilities.
• ​Third-party stakeholders (suppliers, customers, partners, and so forth) understand their roles and responsibilities.
• ​Senior executives understand their roles and responsibilities.
• ​Physical and cybersecurity personnel understand their roles and responsibilities.

Data security (PR.DS):

Your organization manages data in concert with its data risk strategy to protect the confidentiality, integrity, and availability of information.

• ​Your data at rest is protected.
• ​Your data is protected while in transit.
• ​You manage your assets as they are being transferred, removed, and disposed of.
• ​You maintain adequate storage capacity to ensure that your data is always available.
• ​You protect against data leaks and have established plans for recovery efforts.
• ​You verify software, firmware, and information integrity.
• ​Your development and testing environment(s) are separate from the production environment.

Information protection processes and procedures (PR.IP):

Your enterprise uses security policies that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities, processes, and procedures to manage the protection of information systems and assets.

• ​You have a baseline configuration of information technology/industrial control systems incorporating security principles (the “concept of least functionality”).
• ​You have a systems development lifecycle for managing your systems.
• ​You have processes for configuration change control.
• ​You conduct, maintain, and test information backups.
• ​Your physical operating environment for organizational assets meets policies and regulations.
• ​You destroy data according to your policies.
• ​You have improved your data protection processes.
• ​You share the effectiveness of protection technologies.
• ​You have response and recovery plans, and you manage them.
• ​You regularly test your response and recovery plans.
• ​Your human resources practices include cybersecurity measures such as deprovisioning and personnel screening.
• ​You have a vulnerability management plan.

Maintenance (PR.MA):

According to policies and procedures, your organization maintains and repairs its industrial control and information system components.

• ​You maintain and repair organizational assets and log those activities with approved and controlled tools.
• ​Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.

Protective technology (PR.PT):

You manage technical security solutions to assure that systems and assets are secure and resilient, as well as consistent with organizational policies, procedures, and agreements.

• ​You document and review audit/log records according to policy.
• ​You protect removable media and restrict its use according to policy.
• ​You configure systems to provide users with only what they need (“principle of least privilege”).
• ​Your communications and control networks are protected.
• ​You use mechanisms such as fail-safe, load balancing, and hot swap for greater resilience.

3. Detect

Develop and implement activities to identify cybersecurity events. Categories and subcategories are:

Anomalies and events (DE.AE):

The organization knows when anomalous activity occurs on your systems.

• ​You maintain and manage a baseline of network operations and expected data flows for users and systems.
• ​The organization analyzes detected events to understand attack targets and methods.
• ​Systems collect and correlate event data from multiple sources and sensors.
• ​You know the impacts of cybersecurity events.
• ​You’ve established incident alert thresholds.

Security continuous monitoring (DE.CM):

The organization continuously monitors its information systems and assets to identify cybersecurity events and verify the effectiveness of protective measures. Monitoring includes these areas:

• ​The enterprise network.
• ​The physical environment.
• ​External service providers’ activity.
• ​Employee activity.

Monitoring should check for anomalies, including:

• ​Malicious code.
• ​Unauthorized mobile code.
• ​Unauthorized users, connections, devices, and software.
• ​Vulnerabilities.

Detection process (DE.DP):

The organization maintains and tests its detection processes and procedures to ensure it is aware of anomalous events.

• ​You’ve defined roles and responsibilities for detection.
• ​Detection activities comply with requirements.
• ​The organization has tested its detection processes.
• ​Event detection information is communicated to those who need to know.
• ​You continually improve the detection processes.

4. Respond

Develop and implement responses to detected cybersecurity events.

Response planning (RS.RP):

The enterprise has developed processes and procedures for responding to cybersecurity incidents.

• ​You follow your response plan during or after an incident.

Communications (RS.CO):

You coordinate response activities with internal and external stakeholders, including law enforcement agencies.

• ​Employees know their roles and the order of operations when a response is needed.
• ​Incidents are reported according to your criteria.
• ​Your teams share information consistent with your response plans.
• ​You coordinate with stakeholders according to your response plans.
• ​You volunteer information on security incidents with external stakeholders for broader awareness.

Analysis (RS.AN):

The organization analyzes its response to cybersecurity incidents to improve and support recovery activities.

• ​You investigate detection system notifications.
• ​Your teams understand each incident’s impacts.
• ​You perform forensic analysis.
• ​You categorize incidents consistent with your response plans.
• ​You have processes for receiving, analyzing, and responding to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins or security researchers).

Mitigation (RS.MI):

The organization works to prevent the expansion of events, mitigate events’ effects, and resolve incidents.

• ​Incidents are contained.
• ​Incidents are mitigated.
• ​You mitigate newly identified vulnerabilities or document them as accepted risks.

Improvements (RS.IM):

You work to improve the organization’s responses to security threats, events, and incidents by incorporating lessons learned from current and previous detection/response activities.

• ​Your response plans incorporate lessons learned.
• ​You update response strategies as needed.

5. Recover

Develop and implement the appropriate actions to take upon detecting a cybersecurity event. Categories and sub-categories are:

Recovery planning (RC.RP):

You maintain recovery processes and procedures to ensure timely restoration of systems or assets affected by cybersecurity incidents.

• ​Recovery plans are executed during or after a cybersecurity incident.
• ​Recovery strategies are updated based on lessons learned and current risk assessments.

Improvements (RC.IM):

Recovery planning and processes are improved by incorporating lessons learned from past incidents.

• ​Recovery plans are reviewed and updated regularly.
• ​Lessons learned are integrated into recovery strategies.

Communications (RC.CO):

Coordination with internal and external parties is maintained during and after recovery from a cybersecurity incident.

• ​Recovery status is communicated to stakeholders.
• ​Coordination with external stakeholders (such as law enforcement or regulatory bodies) is maintained as needed.

---

This guide provides a comprehensive overview of the NIST Cybersecurity Framework, its core components, and the five key functions that organizations can use to build and maintain a robust cybersecurity posture.