The Cybersecurity Guide to Governance, Risk, and Compliance

CHAPTER 11NIST Cybersecurity Framework

“Cybersecurity is not a game of chance but a strategic battle, and the NIST CSF equips you with the intelligence and resources needed to make informed decisions, enabling you to outmaneuver threats and emerge victorious.”

The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) is a pivotal structure in cybersecurity. A thorough introduction to the NIST CSF includes its development, purpose, use cases, and overall structure. Further understanding of the NIST CSF involves delving into its core functions, categories, and implementation tiers and profiles. Practical implementation of the Framework is an important part of its application. Using real‐world case studies can provide tangible illustrations of the NIST CSF's application, aiding in a better understanding of its effectiveness.

BACKGROUND ON THE NIST CSF

Established by the NIST, an agency of the U.S. Department of Commerce, the CSF originated from Executive Order 13636 titled “Improving Critical Infrastructure Cybersecurity.” This directive, issued by President Obama in 2013, demanded a uniform security framework that would methodically address and manage cybersecurity risk cost‐effectively, aligned with business requirements, and did not impose additional regulatory requirements on organizations. This ambitious project, engaging various stakeholders from industry, academia, and government, culminated in developing the NIST CSF.

The primary objective ...