There are three primary components of the globally adopted NIST Cybersecurity Framework: the framework core, the profiles, and implementation tiers. While the framework details the specific control categories you need to protect your data, the profiles enable you to create a strategy for reducing risk. Implementation tiers, on the other hand, establish a baseline for cybersecurity that you can use to summarize your current capabilities.
An introduction to NIST framework implementation tiers
NIST tier definitions are often referred to as cybersecurity maturity levels, but while they share a lot in common, they are not the same thing. Instead, they are meant to serve as an internal baseline summarizing the degree to which you have adopted the controls from the framework core. There are four tiers altogether, with the fourth denoting advanced cybersecurity:
- Tier #1. Security is largely performed on an ad-hoc, reactive basis
- Tier #2. Leadership is risk-informed, but implementation is lacking
- Tier #3. NIST CSF controls have been implemented company-wide
- Tier #4. Organizations can proactively detect and predict threats
Aiming for the third tier is a realistic goal for most companies, and it is essential in the case of highly regulated industries like critical infrastructure and finance. The fourth tier corresponds to the best information security strategy possible. Fortunately, however, it is possible for small businesses to achieve top-tier cybersecurity performance by partnering with an organization that offers key services like managed detection and response (MDR) and security incident and event management (SIEM).
Determining your appetite for risk
Every business and individual decision-maker has a certain tolerance for risk. Although some companies are extremely risk-averse, such a stance can stifle innovation. In the other extreme, organizations end up leaving themselves and their clients open to the serious threat of a data breach and all the problems that come with it.
Before assessing your NIST framework tier level, you should first determine where you want to be, and which risks you are willing to take. It is important to find a good compromise between innovation and risk-management. Your appetite for risk will no doubt vary depending on how critical or a system is or how sensitive its data is.
Measuring your governance capabilities
You can’t protect what you don’t know, which is why the first step in assessing your compliance with the NIST framework is establishing your governance capabilities. Do you know precisely where your data lives and which controls are in place to protect it? Do you have a clear picture of the risks facing your business? Do you have a documented program for mitigating the risks?
These are just some of the questions you need to ask yourself when assessing your NIST tier level. If you can’t answer positively to the above examples, then there will be a clear need for improvement. To fully comply with the framework, your risk-management strategy needs to be centralized and applied across the organization.
Evaluating your protective measures
Determining your current NIST framework tier level shouldn’t be overly complicated. For the most part, it comes down to one question – what protective measures are in place to safeguard your systems and data from attack? If security measures are only applied on an ad hoc basis, then the lack of consistency alone could pose a serious threat.
Protective measures go far beyond conventional solutions like antimalware and firewalls. The ultimate goal should be to prevent threats from getting anywhere near your network in the first place. Solutions like MDR and SIEM can help with this, since they provide proactive defenses that can be applied to your entire computing infrastructure.
Review your response and recovery plans
The fourth and fifth primary categories of the NIST Cybersecurity Framework concern incident response and recovery respectively. If an incident is reported, then there must be a clear way to respond to it. People need to be familiar with their roles and responsibilities when it comes to detecting a potential threat, such as a malicious email. If people don’t know how to react if, for example, they receive a phishing email, then your response strategy is likely in the lowest tier.
The same applies to disaster recovery. Business leaders should take the view that an attack will eventually make it past the defenses, hence they should be prepared for the worst-case scenario. If there aren’t any established recovery methods beyond backing up mission-critical data on an ad-hoc basis, then your NIST framework tier level will be suitably poor.
Assessing your current NIST framework tier level ideally requires an outside perspective, which is where Charles IT comes in. Get in touch today to learn more about our compliance and data security services!
