NIST CSF 2.0 - Your essential introduction to managing cybersecurity risks

CHAPTER 6: IMPLEMENTING THE FRAMEWORK

Version 2.0 of the CSF does not provide a formal implementation process, preferring instead to let the implementing organization decide how best to approach the project. However, the seven-step process provided in CSF version 1.1 remains a valid and appropriate way of implementing the framework for organizations that are not sure where to begin.

The seven-step implementation process is:

1. Determine objectives, priorities, and scope

2. Identify assets and risks

3. Create a current profile

4. Conduct a risk assessment

5. Create a target profile

6. Perform a gap analysis and develop an action plan

7. Implement the action plan

Step 1: Determine objectives, priorities, and scope

First, the organization identifies ...