What is NIST CSF?

The organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.

The GOVERN Function provides outcomes to inform what an organization may do to achieve and prioritize the outcomes of the other five Functions in the context of its mission and stakeholder expectations.

Governance activities are critical for incorporating cybersecurity into an organization’s broader enterprise risk management (ERM) strategy.

The organization’s current cybersecurity risks are understood.

Understanding the organization’s assets (e.g., data, hardware, software, systems, facilities, services, people), suppliers, and related cybersecurity risks enables an organization to prioritize its efforts consistent with its risk management strategy and the mission needs identified under GOVERN.

This Function also includes the identification of improvement opportunities for the organization’s policies, plans, processes, procedures, and practices that support cybersecurity risk management to inform efforts under all six Functions.

Safeguards to manage the organization’s cybersecurity risks are used.

Once assets and risks are identified and prioritized, PROTECT supports the ability to secure those assets to prevent or lower the likelihood and impact of adverse cybersecurity events, as well as to increase the likelihood and impact of taking advantage of opportunities.

Outcomes covered by this Function include identity management, authentication, and access control; awareness and training; data security; platform security (i.e., securing the hardware, software, and services of physical and virtual platforms); and the resilience of technology infrastructure.

Possible cybersecurity attacks and compromises are found and analyzed.

DETECT enables the timely discovery and analysis of anomalies, indicators of compromise, and other potentially adverse events that may indicate that cybersecurity attacks and incidents are occurring.

This Function supports successful incident response and recovery activities.

Actions regarding a detected cybersecurity incident are taken.

RESPOND supports the ability to contain the effects of cybersecurity incidents.

Outcomes within this Function cover incident management, analysis, mitigation, reporting, and communication.

Assets and operations affected by a cybersecurity incident are restored.

RECOVER supports the timely restoration of normal operations to reduce the effects of cybersecurity incidents and enable appropriate communication during recovery efforts.