Overview
What is the NIST CSF?
The NIST Cybersecurity Framework (National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF) was developed by the U.S. National Institute of Standards and Technology (NIST). It was created to strengthen and improve the management of risks to national security, the economy, and public safety and health arising from increasingly complex and interconnected critical infrastructure systems. Organizations whose security measures are not aligned with the NIST CSF may therefore risk failing to satisfy applicable bidding requirements.
What is NIST CSF 2.0?
NIST CSF 2.0, officially released on February 26, 2024, is an updated version of NIST CSF 1.0/1.1 designed to address the latest cybersecurity trends and threats. The first edition, NIST CSF 1.0, was published in 2014 and revised as NIST CSF 1.1 in 2018. NIST CSF 2.0 was then officially released on February 26, 2024. Unlike NIST CSF 1.0/1.1, NIST CSF 2.0 includes Govern as a core Function.
Figure 1. Differences Between NIST CSF 2.0 and the Previous Cybersecurity Framework
NIST CSF 2.0 also strengthens supply chain risk management. While retaining the substance of NIST CSF 1.1, it introduces new governance requirements. The framework has also been revised to remove its critical-infrastructure-specific context so that organizations of all sizes, industries, and levels of cybersecurity maturity can use it. In addition, online resources supporting implementation of the framework have been expanded.
Figure 2. Differences Between NIST CSF 1.1 and 2.0
NIST CSF Structure
The NIST CSF consists of three elements: the Core, Tiers, and Profiles. Using these three elements makes it easier for companies and organizations to analyze gaps between their current and target cybersecurity postures.
NIST CSF Components
| No | Component | Definition |
|---|---|---|
| 1 | Core | A set of cybersecurity outcomes organized into defined categories |
| 2 | Tiers | Four levels used to characterize the maturity of cybersecurity risk management practices |
| 3 | Profiles | An organization's current (As-Is) and target (To-Be) cybersecurity postures |
The NIST CSF 2.0 Core presents common cybersecurity outcomes applicable across industries and business types.
The NIST CSF 1.1 Core consisted of five Functions, 23 Categories, and 108 Subcategories. In NIST CSF 2.0, this changed to six Functions, 22 Categories, and 106 Subcategories.
Although GV (Govern) is a new Function, not all of its Categories and Subcategories are new. Many items from the NIST CSF 1.1 ID (Identify) Function—including ID.BE (Business Environment), ID.GV (Governance), ID.RA (Risk Assessment), and ID.SC (Supply Chain Risk Management)—were moved or consolidated into the new GV (Govern) Categories.
Differences Between the NIST CSF 1.1 and NIST CSF 2.0 Core Functions
| Function | Category | Subcategories | |
|---|---|---|---|
| Identify (ID) |
ID.AM | Asset Management | 6 |
| ID.BE | Business Environment | 5 | |
| ID.GV | Governance | 4 | |
| ID.RA | Risk Assessment | 6 | |
| ID.RM | Risk Management Strategy | 3 | |
| ID.SC | Supply Chain Risk Management | 5 | |
| Protect (PR) |
PR.AC | Identity Management, Authentication and Access Control | 7 |
| PR.AT | Awareness and Training | 5 | |
| PR.DS | Data Security | 8 | |
| PR.IP | Information Protection Processes and Procedures | 12 | |
| PR.MA | Maintenance | 2 | |
| PR.PT | Protective Technology | 5 | |
| Detect (DE) |
DE.AE | Anomalies and Events | 5 |
| DE.CM | Security Continuous Monitoring | 8 | |
| DE.DP | Detection Processes | 5 | |
| Respond (RS) |
RS.RP | Response Planning | 1 |
| RS.CO | Communications | 5 | |
| RS.AN | Analysis | 5 | |
| RS.MI | Mitigation | 3 | |
| RS.IM | Improvements | 2 | |
| Recover (RC) |
RC.RP | Recovery Planning | 1 |
| RC.IM | Improvements | 2 | |
| RC.CO | Communications | 3 | |
| Function | Category | Subcategories | |
|---|---|---|---|
| Govern (GV) |
GV.OC | Organizational Context | 5 |
| GV.RM | Risk Management Strategy | 7 | |
| GV.RR | Roles, Responsibilities, and Authorities | 4 | |
| GV.PO | Policy | 2 | |
| GV.OV | Oversight | 3 | |
| GV.SC | Cybersecurity Supply Chain Risk Management | 10 | |
| Identify (ID) |
ID.AM | Asset Management | 7 |
| ID.RA | Risk Assessment | 10 | |
| ID.IM | Improvement | 4 | |
| Protect (PR) |
PR.AA | Identity Management, Authentication, and Access Control | 6 |
| PR.AT | Awareness and Training | 2 | |
| PR.DS | Data Security | 4 | |
| PR.PS | Platform Security | 6 | |
| PR.IR | Technology Infrastructure Resilience | 4 | |
| Detect (DE) |
DE.CM | Continuous Monitoring | 5 |
| DE.AE | Adverse Event Analysis | 6 | |
| Respond (RS) |
RS.MA | Incident Management | 5 |
| RS.AM | Incident Analysis | 4 | |
| RS.CO | Incident Response Reporting and Communication | 2 | |
| RS.MI | Incident Mitigation | 2 | |
| Recover (RC) |
RC.RP | Incident Recovery Plan Execution | 6 |
| RC.CO | Incident Recovery Communication | 2 | |
History of the NIST CSF
Security threats are becoming increasingly diverse and complex due to factors such as the rapid rise in serious cyberattacks worldwide and the risks accompanying widespread adoption of new technologies such as generative AI. In response, countries have introduced cybersecurity laws, regulations, directives, and guidelines. Internationally recognized cybersecurity frameworks and guidelines include the NIST CSF, CIS Controls, and the ISO/IEC 27000 series. In particular, the NIST CSF provides comprehensive outcomes that address cyber resilience. Its broad applicability has led to growing adoption by public- and private-sector organizations around the world.
Timeline Leading to the Release of NIST CSF 2.0
- 2013
- National and economic security depended on the reliable operation of critical infrastructure, while cyberattacks were becoming more sophisticated and causing increasing damage each year.
U.S. President Barack Obama issued an Executive Order to strengthen critical infrastructure cybersecurity capabilities.
- 2014
- In response to the Executive Order, NIST gathered data and input from more than 3,000 participants, including experts, government agencies, and critical infrastructure organizations, and published CSF 1.0.
NIST's work was highly regarded, and the CSF became a widely supported framework among private-sector organizations and government agencies.
- 2018
- The framework was revised as CSF 1.1, with controls relating to supply chain risk management receiving particular attention.
CSF 1.1 was used not only in the United States but by a wide range of organizations worldwide to assess and improve their cybersecurity posture.
- 2024
- CSF 2.0 was officially released in February 2024, marking the first major revision in approximately ten years.
The framework was revised for organizations of all industries and sizes, further expanding its potential use as organizational guidance.
Infosec Advisory's NIST Cybersecurity Framework Compliance Services
Infosec Advisory, Inc. (hereinafter, “Infosec Advisory”) has a dedicated NIST CSF team that provides one-stop cybersecurity consulting covering everything from business risk to system operations, with support also available for NIST CSF 1.0. In addition to NIST CSF consulting experience, our team members have extensive experience supporting ISO 27001 certification.
Drawing on this expertise, we provide NIST CSF compliance consulting services customized for your organization.
NIST CSF 2.0 Compliance Process
- 1. Understand the Revisions
- We begin by identifying the changes made in NIST CSF 2.0 compared with NIST CSF 1.1.
- 2. Assess Alignment with NIST CSF 2.0
- After reviewing the revisions, we use assessment sheets and other tools to evaluate whether your current policies align with NIST CSF 2.0.
- 3. Understand Actual Operations
- We conduct interviews and other reviews to understand how policies are implemented in day-to-day operations.
- 4. Prepare Policies and Procedures
- Based on the alignment assessment and operational interview results, we prepare the necessary policies and procedures.
- 5. Conduct a Follow-Up Assessment
- We conduct a follow-up assessment to confirm that the policies and procedures are operating effectively.
Our NIST CSF Approach
- 1. Identify Critical Information Assets
-
- Inventory and identify critical information assets within scope
- Review the lifecycle of critical information assets
- Create a register of critical assets
- 2. Conduct a Risk Assessment
-
- Apply the NIST CSF checklist
- Assess and analyze business impact and risk
- Document risk assessment criteria
- 3. Conduct NIST CSF-Aligned Internal Audits
-
- Conduct security self-assessments across all departments
- Provide internal auditor training
- Conduct internal audits
- 4. Develop and Implement a Corrective Action Plan
-
- Prepare a corrective action plan
- Implement corrective actions
- 5. Monitor Progress
-
- Review the status of security operations
What is a SOC Report?
SOC stands for System and Organization Controls. A SOC report is used to confirm the effectiveness of internal controls at an outsourced service provider and the results of an independent third-party assessment.
The third party is an independent service auditor, such as an audit firm or certified public accountant. Independent service auditors conduct examinations based on standards and guidance established by organizations such as the American Institute of Certified Public Accountants (AICPA) and the Japanese Institute of Certified Public Accountants (JICPA). When assurance is obtained for outsourced services, the SOC report states the relevant conclusion.
Infosec Advisory provides assurance regarding internal controls related to security, availability, processing integrity, confidentiality, and privacy for attestation reports (SOC reports).
We provide services tailored to your requirements. Please call us to discuss how we can help.
