NIST Cybersecurity Framework

NIST Cybersecurity Framework. The NIST Cybersecurity Framework is a voluntary set of guidelines, standards, and best practices developed by the National Institute of Standards and Technology to help organizations manage and reduce cybersecurity risk. Established through collaboration between industry and government following Executive Order 13636, it provides a common language for addressing threats and improving resilience across critical infrastructure sectors. The framework is widely adopted by entities ranging from private corporations to federal agencies like the Department of Homeland Security.

Overview

The development of the framework was initiated by President Barack Obama in 2013, responding to increasing threats to the nation's economic security and public safety. The National Institute of Standards and Technology led its creation, incorporating extensive input from stakeholders across industries such as energy, financial services, and healthcare. It was first published as Version 1.0 in February 2014, with an updated Version 1.1 released in April 2018. The framework is designed to be flexible and adaptable, complementing existing risk management processes and standards like ISO/IEC 27001 and the Payment Card Industry Data Security Standard. Its core objective is to promote the protection and resilience of systems against adversaries like advanced persistent threat actors.

Core Functions

The framework is organized around five concurrent and continuous Core Functions: Identify, Protect, Detect, Respond, and Recover. The **Identify** function helps organizations develop an understanding of their business environment, assets, and cybersecurity risk to systems and data. The **Protect** function outlines safeguards, such as access control and data security measures, to ensure delivery of critical services. The **Detect** function enables the timely discovery of cybersecurity events through activities like security monitoring and anomaly detection. The **Respond** function contains actions to take after an incident, including analysis, mitigation, and communication. Finally, the **Recover** function supports timely resilience and restoration of capabilities impaired during an event, involving recovery planning and improvements.

Implementation Tiers

Implementation Tiers provide context on how an organization views cybersecurity risk and the processes in place to manage it. They range from Tier 1 (Partial) to Tier 4 (Adaptive). Tier 1 indicates an organization's risk management practices are not formalized, and responses to incidents are often ad-hoc. Tier 2 (Risk Informed) sees organizational approval of risk management practices but they may not be established as organization-wide policy. Tier 3 (Repeatable) organizations have formally approved policies that are regularly updated based on threat intelligence and industry standards. Tier 4 represents an adaptive culture where practices are continuously improved through advanced predictive analysis and integrated with enterprise-wide risk management, often informed by organizations like MITRE or the Information Systems Audit and Control Association.

Profiles

A Profile represents the alignment of the framework's Core Functions and categories with an organization's business requirements, risk tolerance, and resources. Organizations create a **Current Profile** to assess their present cybersecurity posture and a **Target Profile** to describe their desired outcomes. The gap between these profiles then drives prioritization and measurement of progress toward risk management goals. Profiles enable customization for specific sectors, such as the energy sector using guidelines from the North American Electric Reliability Corporation or the financial sector referencing the Federal Financial Institutions Examination Council. This allows for tailored application alongside regulations like the Health Insurance Portability and Accountability Act.

Adoption and Impact

Since its release, the framework has seen broad domestic and international adoption. Within the United States, it is used by numerous federal agencies including the Department of Defense and has been incorporated into regulations for entities like the Federal Aviation Administration. Internationally, it has influenced standards in countries like Japan, Italy, and Israel, and organizations such as the International Organization for Standardization. Its impact is evident in its role in shaping legislation like the Cybersecurity Information Sharing Act and in providing a foundation for services from firms like IBM Security and Mandiant. The framework's emphasis on voluntary consensus standards and public-private partnerships is considered a landmark in cybersecurity policy.

Category:Computer security Category:National Institute of Standards and Technology Category:Risk management Category:Computer security standards Category:Computer security organizations