Every business in existence has valuable and sensitive data at its disposal, and protecting it from the myriad threats out there has become a top priority. The National Institute of Standards and Technology (NIST) Cybersecurity Framework is thus top of mind for many organizations.
NIST CSF was originally designed with critical infrastructure in mind. Developed to drive innovation and reduce risk to some of the most essential aspects of US society and economy, it has since been adopted by organizations across many other industries.
While the common complaint holds that the NIST Cybersecurity Framework is too expensive and complicated to implement, the rise of managed security service providers (MSSPs) has made it more accessible to smaller businesses too.
The CSF is more than just a to-do list for organizations wanting to better protect their digital assets. In fact, it does not prescribe control requirements, instead focusing more on high-level requisites. This makes it far more adaptable, since the depth of security assessments is open to individual interpretation. For a list of actual security controls and measures, organizations should refer to the NIST SP 800-53, which serves as the basis for many regulatory regimes.
The CSF does provide control tiers, which align with various maturity models, such as CMMC (Cybersecurity Maturity Model Certification), but it is not the same thing in itself. That said, the control tiers – partial, risk-informed, repeatable, and adaptive – can be used as an indication of the implementation level of a given control, such as risk-management.
The NIST Cybersecurity Framework spans five function areas, each of which have categories and subcategories that go into further detail about specific security measures. These function areas are identity, protect, detect, respond, and recover. The NIST security control categories cover desired cybersecurity outcomes, which are tied to specific needs and activities.
Here is an overview of the five NIST CSF functions and their respective control categories:
This function area concerns the identity and classification of digital assets. Asset management is the first control category, followed by business environment, governance, risk assessment, risk management strategy, and supply chain risk management. In the most recent iteration of the framework, supply chain risk management has been greatly expanded upon in light of the recent rise in attacks targeting supply chains.
The protect function area also has six control areas, all of which deal with the practical steps and solutions required to protect assets against threats. These include identity management and access control, awareness and training, data security, information protection processes and procedures, maintenance, and protective technology. There are many ways organizations can implement these controls, such as managed detection and response (MDR) and security incident and event monitoring (SIEM). These fully outsourced and managed services make it much easier and more affordable to implement the NIST Cybersecurity Framework.
Organizations also need to implement a means to detect unknown threats by using solutions like AI-powered threat analysis tools. This function area includes three control categories – anomalies and events, security continuous monitoring, and detection processes. The goal is to proactively seek out more sophisticated threats, such as targeted social engineering scams and advanced persistent threats (APTs).
Responding to an incident is vital for mitigating the damage and continuously improving your security posture. This function area includes response planning, communications, analysis, mitigation, and improvements. By addressing this area, organizations will have a fully-fledged response plan in place that identifies key stakeholders and their responsibilities. It assumes what every business leader should assume – no matter how robust your security measures are, it will always still be a matter of time before an incident occurs.
The last phase of the NIST Cybersecurity Framework has three controls – recovery planning, improvements, and communications. This function area aims to address worst-case scenarios like data breaches and unscheduled downtime. Should an incident occur, the goal must be to mitigate the damage as best as possible through prompt communication and recovery.
Charles IT provides the full range of services that businesses need to become fully compliant with the NIST Cybersecurity Framework. Get in touch today to schedule your first consultation!
Editors Note: This blog was originally published on September 30, 2021 and was updated June 24, 2023 for accuracy.