NIST CSF
NIST Cybersecurity Framework
A voluntary framework consisting of standards, guidelines, and best practices to manage cybersecurity risk. Version 2.0 added the Govern function to emphasize organizational governance.
GOVERN
Organizational Context
Organizational Context
The organizational mission is understood and informs cybersecurity risk management.
Risk Management Strategy
Risk Management Strategy
Risk management objectives are established and agreed to by organizational stakeholders.
Policy
Policy
Policy for managing cybersecurity risks is established based on organizational context.
IDENTIFY
Asset Management
Asset Management
Inventories of hardware managed by the organization are maintained.
Software Inventory
Asset Management
Inventories of software, services, and systems managed by the organization are maintained.
Risk Assessment
Risk Assessment
Vulnerabilities in assets are identified, validated, and recorded.
Cyber Threat Intelligence
Risk Assessment
Cyber threat intelligence is received from information sharing forums and sources.
PROTECT
Identity Management
Identity Management & Access Control
Identities and credentials for authorized users, services, and hardware are managed.
Access Control
Identity Management & Access Control
Access to assets is managed, incorporating the principles of least privilege and separation of duties.
Data Security at Rest
Data Security
The confidentiality, integrity, and availability of data-at-rest are protected.
Data Security in Transit
Data Security
The confidentiality, integrity, and availability of data-in-transit are protected.
Configuration Management
Platform Security
Configuration management practices are established and applied.
DETECT
Continuous Monitoring
Continuous Monitoring
Networks and network services are monitored to find potentially adverse events.
External Service Monitoring
Continuous Monitoring
External service provider activities and services are monitored to find potentially adverse events.
Adverse Event Analysis
Adverse Event Analysis
Potentially adverse events are analyzed to better characterize the events.
RESPOND
Incident Management
Incident Management
The incident response plan is executed in coordination with relevant third parties once an incident is declared.
Incident Reporting
Incident Response Reporting & Communication
Internal and external stakeholders are notified of incidents.
Incident Analysis
Incident Analysis
Analysis is performed to establish what has taken place during an incident and the root cause of the incident.
RECOVER
Recovery Plan
Incident Recovery Plan Execution
The recovery portion of the incident response plan is executed once initiated from the incident response process.
Recovery Communication
Incident Recovery Communication
Recovery activities and progress in restoring operational capabilities are communicated to designated stakeholders.