[Day 2] 3. NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) is a set of guidelines developed by the National Institute of Standards and Technology (NIST) to help organisations manage and reduce cybersecurity risks. It is widely adopted across industries for its flexibility and alignment with other cybersecurity standards. In August 2023, NIST released CSF 2.0, which includes updates to the original framework and introduces a new "Govern" function to address governance and accountability in cybersecurity.

1. Structure of the NIST CSF 2.0

Your understanding of CSF 2.0's core functions is quite accurate. However, there are actually six core functions in CSF 2.0, not five. Here is a detailed overview with corrections:

1. Govern (New)

Purpose: Establish and maintain governance frameworks to ensure accountability, risk management, and integration of cybersecurity into organizational strategy.
Key Activities:
- Define cybersecurity roles, responsibilities, and authorities.
- Align cybersecurity strategy with overall business objectives.
- Monitor and assess cybersecurity governance effectiveness.
- Incorporate regulatory and legal requirements into cybersecurity practices.

2. Identify

Purpose: Understand organizational systems, assets, data, and risks to create a solid security foundation.
Key Activities:
- Inventory critical assets and data.
- Assess business environment and dependencies.
- Evaluate risks and prioritize them based on organizational impact.

3. Protect

Purpose: Implement safeguards to limit or contain cybersecurity threats.
Key Activities:
- Access control and identity management.
- Data protection and encryption.
- Security awareness training for staff.
- Secure configurations for devices and applications.

4. Detect

Purpose: Develop the ability to identify cybersecurity events and anomalies quickly.
Key Activities:
- Monitor network traffic and system activity.
- Deploy threat detection systems and tools.
- Analyze security alerts and investigate incidents.

5. Respond

Purpose: Take action to contain and minimize the impact of cybersecurity incidents.
Key Activities:
- Develop and maintain incident response plans.
- Contain and mitigate incidents.
- Conduct post-incident reviews to improve resilience.

6. Recover

Purpose: Restore operations and services after a cybersecurity event.
Key Activities:
- Execute recovery plans and strategies.
- Communicate with stakeholders during recovery.
- Improve recovery processes based on lessons learned.

2. Key Updates in NIST CSF 2.0

Inclusion of the Govern Function: Strengthens organisational oversight and accountability in cybersecurity, addressing gaps in strategic alignment and compliance management.
Expanded Applicability: CSF 2.0 is designed to be more inclusive of organisations of all sizes and sectors, emphasising scalability and adaptability.
Alignment with Global Standards: Enhanced to align more closely with international cybersecurity standards (e.g., ISO/IEC 27001, GDPR).
Focus on Supply Chain Risk Management: Recognises the importance of securing supply chain processes as part of an organisation's cybersecurity strategy.
Improved Terminology and Structure: Makes the framework easier to use with clearer definitions and streamlined guidance.

3. Benefits of NIST CSF 2.0

Flexibility: Can be tailored to fit the needs of different industries, organisations, and risk profiles.
Scalability: Suitable for both large enterprises and small businesses.
Enhanced Governance: The "Govern" function ensures cybersecurity is embedded into the organisation’s core values and decision-making processes.
Risk-Based Approach: Encourages organisations to prioritise resources based on risk assessment outcomes.
Cross-Standard Integration: Can work alongside other frameworks like COBIT, ITIL, and ISO standards.

4. Implementation Phases

Prioritise and Scope: Define the organisation's goals, mission, and cybersecurity scope.
Orient: Understand the current cybersecurity environment, including assets and risks.
Create a Current Profile: Assess the current state of cybersecurity practices.
Conduct a Risk Assessment: Identify threats, vulnerabilities, and potential impacts.
Develop a Target Profile: Define the desired state of cybersecurity capabilities.
Analyse Gaps: Compare current and target profiles to identify improvement areas.
Implement Action Plans: Address identified gaps using prioritised steps.

5. NIST CSF 2.0 Tiers

The NIST CSF 2.0 Tiers provide a way to assess and describe an organisation’s level of cybersecurity maturity, focusing on how it integrates cybersecurity into its risk management processes and business practices. There are four tiers:

1. Tier 1: Partial

Characteristics:
- Cybersecurity activities are ad hoc and reactive.
- Limited awareness of risks; no formal policies or processes.
- Minimal integration of cybersecurity into business operations.
Governance: No dedicated oversight; roles and responsibilities are unclear.

2. Tier 2: Risk-Informed

Characteristics:
- Some risk management practices are in place.
- Cybersecurity is recognised as important, but implementation is inconsistent.
- Policies and processes exist but are not standardised or organisation-wide.
Governance: Defined roles exist, but coordination across teams is limited.

3. Tier 3: Repeatable

Characteristics:
- Cybersecurity practices are formally documented and consistently applied.
- Risk management is proactive, and decisions are based on established processes.
- Organisational policies are regularly updated and enforced.
Governance: Cybersecurity is integrated into governance and aligned with business goals.

4. Tier 4: Adaptive

Characteristics:
- Cybersecurity practices are advanced, data-driven, and continuously improved.
- Organisation adapts quickly to evolving threats and risks.
- Cybersecurity is a strategic priority, embedded in organisational culture.
Governance: Leadership drives continuous improvements and prioritises collaboration and innovation.

Extra: The addition of the "Govern" function highlights the growing recognition that cybersecurity is not just a technical challenge but also an organisational responsibility requiring executive-level oversight. With evolving threats and regulatory demands, CSF 2.0 ensures organisations remain resilient, compliant, and proactive in their cybersecurity efforts.