01 NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) is one of the most widely used cybersecurity risk-management frameworks in the world.

It provides a structured way for organizations to understand, communicate, prioritize, and improve cybersecurity risk management.

The framework is designed to help organizations answer questions such as:

What Cybersecurity Risks
Do We Face?

What Outcomes
Do We Need?

What Controls
Should We Prioritize?

Where Are
Our Gaps?

What Should
We Improve First?

How Do We
Communicate Cyber Risk
to Leadership?

The framework is intentionally flexible.

It can be used by:

Small Businesses

Large Enterprises

Government Agencies

Cloud Providers

Financial Institutions

Healthcare Organizations

Technology Companies

Critical Infrastructure

NIST CSF does not prescribe one fixed technology stack.

Instead, it provides a common structure for managing cybersecurity outcomes.

Learning Objectives

By the end of this lesson, you will be able to:

Explain the purpose of the NIST Cybersecurity Framework.
understand the structure of NIST CSF 2.0.
understand the six CSF Functions.
understand Categories and Subcategories.
understand Organizational Profiles.
understand Current and Target Profiles.
understand Implementation Tiers.
understand the Govern Function.
understand the Identify Function.
understand the Protect Function.
understand the Detect Function.
understand the Respond Function.
understand the Recover Function.
understand how CSF supports risk management.
understand how CSF supports executive governance.
understand how to perform a CSF gap assessment.
understand how to prioritize cybersecurity improvements.
understand how to map CSF outcomes to controls.
understand how CSF can support multiple compliance frameworks.
design a practical enterprise CSF operating model.

1. What Is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework is a risk-based framework for managing cybersecurity.

At a high level:

Business Objectives
      ↓
Cybersecurity Risks
      ↓
CSF Outcomes
      ↓
Controls
      ↓
Evidence
      ↓
Risk Reduction

The framework helps organizations connect cybersecurity activities with:

Business Risk

Governance

Technology

Operations

Compliance

Executive Reporting

2. Why Organizations Use NIST CSF

Cybersecurity programs often become fragmented.

Different teams may focus independently on:

Firewalls

IAM

Cloud Security

Vulnerability Management

Incident Response

Data Protection

Third-Party Risk

NIST CSF provides a common structure for bringing these areas together.

Cybersecurity Activities
      ↓
Common Framework
      ↓
Enterprise Risk View

3. NIST CSF 2.0 Structure

NIST CSF 2.0 organizes cybersecurity outcomes around six Functions:

GOVERN

IDENTIFY

PROTECT

DETECT

RESPOND

RECOVER

Conceptually:

           GOVERN
              ↓
          IDENTIFY
              ↓
           PROTECT
              ↓
           DETECT
              ↓
          RESPOND
              ↓
          RECOVER
              ↺

Govern operates across the entire cybersecurity lifecycle.

4. The Six CSF Functions

The six Functions provide the highest-level view of cybersecurity risk management.

GOVERN
How cybersecurity risk
is directed and overseen.

IDENTIFY
What assets, risks,
and dependencies exist.

PROTECT
What safeguards
reduce cybersecurity risk.

DETECT
How cybersecurity events
are identified.

RESPOND
How the organization
acts during incidents.

RECOVER
How services and capabilities
are restored.

5. Function 1 — Govern

The Govern Function establishes how cybersecurity risk is managed across the organization.

It addresses areas such as:

Risk Management Strategy

Policies

Roles

Responsibilities

Authorities

Supply Chain Risk

Legal Requirements

Oversight

Govern answers:

Who Is Accountable?

What Is Our
Risk Strategy?

What Policies
Apply?

How Much Risk
Will We Accept?

How Do Leaders
Oversee Cybersecurity?

6. Why Govern Matters

Without governance:

Security Tools
      ↓
Security Activities
      ↓
No Clear Ownership
      ↓
No Risk Prioritization

With governance:

Business Strategy
      ↓
Risk Appetite
      ↓
Cybersecurity Strategy
      ↓
Controls
      ↓
Measurement

7. Governance Outcomes

A mature governance program may define:

Cybersecurity Policies

Risk Appetite

Risk Owners

Control Owners

Security Roles

Executive Oversight

Third-Party Expectations

Regulatory Obligations

8. Example — Governance

Scenario:

Critical Cloud Services
Support Customer Transactions

Governance may establish:

Risk Owner:
CTO

Cybersecurity Owner:
CISO

Risk Appetite:
Low Service Disruption

Required Controls:
MFA
Logging
Encryption
Resilience

9. Function 2 — Identify

The Identify Function focuses on understanding what the organization needs to protect and the cybersecurity risks affecting it.

This may include:

Assets

Data

Systems

Services

Business Processes

Dependencies

Threats

Vulnerabilities

Risks

10. Asset Management

Organizations cannot protect assets they do not know exist.

Identify:

Applications

Servers

Endpoints

Cloud Accounts

Databases

Network Devices

SaaS Platforms

Vendors

11. Asset Inventory Example

Enterprise
   │
   ├── Applications
   ├── Cloud Accounts
   ├── Endpoints
   ├── Databases
   ├── Networks
   └── Vendors

12. Asset Criticality

Assets should be prioritized based on:

Business Importance

Data Sensitivity

Availability Requirements

Regulatory Impact

Customer Impact

Example:

Tier 1
Critical

Tier 2
High

Tier 3
Moderate

Tier 4
Low

13. Risk Assessment

Identify also includes cybersecurity risk assessment.

Example:

Threat
      ↓
Vulnerability
      ↓
Asset
      ↓
Business Impact
      ↓
Cyber Risk

14. Example Risk

Threat:
Credential Theft

Asset:
Cloud Admin Account

Weakness:
No MFA

Risk:
Unauthorized Cloud Access

Impact:
Data Exposure
Service Disruption

15. Supply Chain Identification

Organizations must also understand:

Critical Vendors

Cloud Providers

Software Suppliers

Managed Service Providers

Data Processors

These dependencies can create cybersecurity risk.

16. Function 3 — Protect

The Protect Function focuses on safeguards that reduce cybersecurity risk.

Typical areas include:

Identity Management

Access Control

Awareness Training

Data Security

Platform Security

Technology Resilience

17. Identity Protection

Examples:

MFA

Least Privilege

Privileged Access Management

Access Reviews

Account Lifecycle Management

18. Example

Risk:

Privileged Account
Compromise

Protective controls:

MFA

PAM

Conditional Access

Strong Authentication

Least Privilege

19. Data Security

Protective measures may include:

Encryption

Data Classification

DLP

Backup

Secure Disposal

Access Restrictions

20. Platform Security

Examples:

Secure Configuration

Patch Management

Endpoint Security

Network Segmentation

Cloud Security

Application Security

21. Security Awareness

Human risk also requires protection.

Examples:

Security Training

Phishing Awareness

Role-Based Training

Secure Development Training

22. Resilience

Protection also includes:

Backups

Redundancy

Failover

Capacity Management

Recovery Preparation

23. Function 4 — Detect

The Detect Function focuses on finding cybersecurity events.

Typical capabilities include:

Logging

Security Monitoring

Threat Detection

Anomaly Detection

Continuous Monitoring

24. Detection Architecture

Endpoints ────────┐
Cloud ────────────┤
Network ──────────┤
Identity ─────────┤
Applications ─────┘
                  ↓
                 SIEM
                  ↓
              Detection
                  ↓
                Alert

25. Logging

Organizations should identify what requires logging.

Examples:

Authentication

Administrative Activity

Cloud Changes

Security Events

Application Events

Network Traffic

26. Detection Use Case

Example:

Multiple Failed Logins
      ↓
Successful Admin Login
      ↓
Unusual Geography
      ↓
Alert

27. Continuous Monitoring

Detection should not depend solely on occasional reviews.

Monitor:

Identity

Endpoints

Cloud

Networks

Applications

Vulnerabilities

28. Detection Coverage

Organizations should ask:

What Are
We Monitoring?

What Are
We Not Monitoring?

Are Critical Assets
Covered?

Are Logs
Available?

29. Function 5 — Respond

The Respond Function focuses on actions taken after a cybersecurity incident is identified.

Common areas include:

Incident Management

Analysis

Communication

Containment

Mitigation

Reporting

30. Incident Response Lifecycle

Alert
      ↓
Triage
      ↓
Investigation
      ↓
Containment
      ↓
Eradication
      ↓
Recovery
      ↓
Lessons Learned

31. Response Planning

Organizations should maintain:

Incident Response Plan

Roles

Escalation Paths

Communication Plans

Technical Runbooks

External Contacts

32. Incident Analysis

During response, teams determine:

What Happened?

What Systems
Are Affected?

What Data
Is Affected?

How Did
It Happen?

What Is
the Business Impact?

33. Communication

Incident response may involve:

Security

IT

Legal

Privacy

Executives

Customers

Regulators

Law Enforcement

depending on the incident.

34. Mitigation

Actions may include:

Disable Accounts

Isolate Endpoints

Block Indicators

Patch Systems

Remove Malware

Restrict Network Access

35. Function 6 — Recover

The Recover Function focuses on restoring services and improving resilience after incidents.

Typical areas include:

Recovery Planning

Restoration

Communication

Lessons Learned

Improvement

36. Recovery Example

Incident
      ↓
Containment
      ↓
Systems Restored
      ↓
Data Validated
      ↓
Service Resumed
      ↓
Monitoring Increased

37. Recovery Objectives

Recovery activities should align with:

RTO

RPO

Business Priorities

Criticality

Dependency Mapping

38. Recovery Time Objective

RTO asks:

How Quickly
Must the Service
Be Restored?

39. Recovery Point Objective

RPO asks:

How Much Data Loss
Can the Organization
Accept?

40. Recovery Improvement

Recovery should feed lessons back into:

Govern

Identify

Protect

Detect

Respond

This creates continuous improvement.

41. CSF Categories

Each Function contains Categories.

Categories group related cybersecurity outcomes.

Conceptually:

Function
      ↓
Category
      ↓
Subcategory

42. CSF Subcategories

Subcategories describe more specific outcomes.

They help organizations define:

Desired Cybersecurity Outcomes

rather than prescribing one specific product.

43. Outcome-Based Design

NIST CSF generally asks:

What Outcome
Should Exist?

rather than:

Which Product
Must You Buy?

This makes it technology-neutral.

44. Example Outcome

Outcome:

Access to systems
is managed based
on risk.

Possible implementation:

RBAC

MFA

PAM

Access Reviews

Conditional Access

45. Organizational Profiles

A CSF Organizational Profile describes how an organization applies CSF outcomes.

Profiles help answer:

Where Are We Now?

Where Do We
Want to Be?

46. Current Profile

The Current Profile represents:

Current Cybersecurity
State

Example:

MFA
Partially Implemented

Logging
Implemented

Vendor Monitoring
Weak

Recovery Testing
Partial

47. Target Profile

The Target Profile represents:

Desired Cybersecurity
State

Example:

MFA
Fully Implemented

Logging
Centralized

Vendor Monitoring
Continuous

Recovery Testing
Quarterly

48. Current vs Target

Current Profile
      ↓
Gap
      ↓
Target Profile

49. Gap Analysis

Example:

Outcome	Current	Target	Gap
Privileged MFA	Partial	Full	High
Central Logging	Full	Full	None
Vendor Monitoring	Weak	Mature	High
Recovery Testing	Annual	Quarterly	Medium

50. Prioritizing Gaps

Not all gaps have equal priority.

Consider:

Business Risk

Asset Criticality

Threat Exposure

Regulatory Requirements

Risk Appetite

Cost

Dependencies

51. Example Prioritization

Gap A:

Privileged MFA
Missing

Gap B:

Minor Documentation
Formatting Issue

Both are gaps.

But the first likely carries much higher cybersecurity risk.

52. Implementation Tiers

CSF Implementation Tiers describe characteristics of how cybersecurity risk is managed.

They help organizations understand the maturity and consistency of their approach.

Conceptually:

Tier 1
Partial

Tier 2
Risk Informed

Tier 3
Repeatable

Tier 4
Adaptive

53. Tier 1 — Partial

Characteristics may include:

Ad Hoc

Reactive

Limited Governance

Inconsistent Processes

54. Tier 2 — Risk Informed

Characteristics may include:

Risk Awareness

Some Defined Practices

Not Fully Standardized

55. Tier 3 — Repeatable

Characteristics may include:

Formal Policies

Consistent Processes

Organization-Wide Practices

Repeatable Risk Management

56. Tier 4 — Adaptive

Characteristics may include:

Continuous Improvement

Threat-Informed Decisions

Adaptive Controls

Integrated Risk Management

57. Tiers Are Not Simple Maturity Scores

Do not assume:

Every Organization
Must Reach Tier 4

Organizations should select appropriate practices based on:

Risk

Business Need

Resources

Threat Environment

58. CSF and Enterprise Risk Management

NIST CSF should connect cybersecurity to enterprise risk.

Business Objective
      ↓
Cyber Risk
      ↓
CSF Outcome
      ↓
Control
      ↓
KRI / KCI
      ↓
Executive Reporting

59. Example

Business objective:

Maintain Customer
SaaS Availability

Risk:

Ransomware
Disruption

Relevant CSF areas:

Govern

Protect

Detect

Respond

Recover

60. Risk Register Integration

A risk record may include:

Risk ID

CSF Function

CSF Outcome

Control

Owner

Residual Risk

Treatment

61. CSF and Risk Appetite

Example:

Risk:
Privileged Account Compromise

Residual Risk:
High

Risk Appetite:
Low

CSF gap:

Privileged Access
Protection
Incomplete

Treatment:

Deploy PAM
+
Enforce MFA

62. CSF and Control Libraries

Organizations can map CSF outcomes to enterprise controls.

Example:

CSF Outcome
      ↓
IAM-001
Privileged MFA

IAM-002
Access Review

IAM-003
PAM

63. Common Control Model

One control can support multiple frameworks.

              NIST CSF
                 ↑
                 |
ISO 27001 ← IAM-001 → PCI DSS
                 |
                 ↓
               SOC 2

64. Benefits of Mapping

This reduces:

Duplicate Controls

Duplicate Testing

Duplicate Evidence

Duplicate Remediation

65. CSF and ISO 27001

NIST CSF and ISO 27001 have different purposes but can complement each other.

Simplified:

NIST CSF
→ Cybersecurity Risk Outcomes

ISO 27001
→ Information Security
Management System

Organizations may map controls between them.

66. CSF and CIS Controls

CIS Controls provide more prescriptive security safeguards.

Conceptually:

NIST CSF
What Outcomes
Should We Achieve?

CIS Controls
What Security Safeguards
Can Help?

67. CSF and NIST RMF

NIST CSF provides high-level cybersecurity risk outcomes.

The Risk Management Framework provides a structured lifecycle for managing security and privacy risk for systems and organizations.

They can be complementary.

68. CSF and SOC 2

A SOC 2 program may use CSF to help organize cybersecurity capabilities while mapping controls to applicable Trust Services Criteria.

69. CSF and PCI DSS

PCI DSS contains specific payment-card security requirements.

NIST CSF can help place those controls into a broader cybersecurity-risk-management model.

70. CSF and Cloud Security

CSF outcomes can be implemented across:

AWS

Azure

Google Cloud

SaaS

Hybrid Infrastructure

71. Example — Cloud Identity

CSF outcome:

Access Is
Appropriately Managed

Implementation:

Cloud IAM

MFA

PAM

Least Privilege

Access Reviews

72. Example — Cloud Logging

CSF outcome:

Cybersecurity Events
Are Detected

Implementation:

CloudTrail

Azure Activity Logs

Cloud Audit Logs

SIEM

73. Example — Cloud Recovery

CSF outcome:

Services Are
Restored

Implementation:

Backups

Multi-Region Architecture

Disaster Recovery

Recovery Testing

74. CSF and Third-Party Risk

The framework also addresses cybersecurity supply-chain risk.

Organizations should consider:

Vendor Criticality

Security Requirements

Due Diligence

Contractual Controls

Monitoring

Incident Coordination

75. Third-Party Example

Critical vendor:

Payment Provider

Risk:

Vendor Security Breach

CSF approach:

Govern
Define Supplier Requirements

Identify
Understand Dependency

Protect
Require Safeguards

Detect
Monitor Security Signals

Respond
Coordinate Incidents

Recover
Plan Service Continuity

76. CSF Gap Assessment

A practical CSF assessment can follow:

Define Scope
      ↓
Select Outcomes
      ↓
Assess Current State
      ↓
Define Target State
      ↓
Identify Gaps
      ↓
Prioritize
      ↓
Create Improvement Plan

77. Step 1 — Define Scope

Scope may include:

Enterprise

Business Unit

Application

Cloud Platform

Product

Critical Service

78. Step 2 — Identify Relevant Outcomes

Not every outcome needs identical implementation everywhere.

Select based on:

Business Context

Risk

Criticality

Regulation

Threat Exposure

79. Step 3 — Assess Current State

Possible rating approach:

Not Implemented

Partially Implemented

Implemented

Optimized

The organization may define its own consistent assessment scale.

80. Step 4 — Define Target State

Target state should reflect:

Risk Appetite

Business Requirements

Regulatory Obligations

Threat Environment

Resources

81. Step 5 — Identify Gap

Example:

Current:
Access Reviews
Annual

Target:
Quarterly

Gap:

Review Frequency
Insufficient

82. Step 6 — Assess Risk

Ask:

What Happens
If We Do Not
Close the Gap?

83. Step 7 — Create Improvement Action

Document:

Gap

Risk

Action

Owner

Due Date

Priority

Status

84. CSF Improvement Register

Example:

Gap	Risk	Action	Owner	Priority
Admin MFA incomplete	Account compromise	Enforce MFA	IAM	Critical
Vendor monitoring weak	Supply chain breach	Continuous monitoring	TPRM	High
Recovery tests annual	Recovery failure	Quarterly testing	IT Ops	High

85. Prioritize Improvement Roadmap

Use:

Risk
      +
Criticality
      +
Effort
      +
Dependencies

86. Quick Wins

Examples may include:

Enable MFA

Disable Dormant Accounts

Centralize Logging

Fix Public Exposure

87. Strategic Improvements

Examples may include:

PAM Deployment

Zero Trust Program

Enterprise Asset Inventory

Multi-Region Recovery

Security Data Platform

88. CSF Metrics

Organizations can define metrics tied to CSF outcomes.

Examples:

MFA Coverage

Asset Inventory Coverage

Logging Coverage

Critical Vulnerabilities Past SLA

Incident Response Time

Recovery Test Success

89. KRI Example

Risk:

Privileged Account
Compromise

KRI:

Privileged Accounts
Without MFA

Target:

90. KCI Example

Control:

Privileged MFA

KCI:

MFA Coverage

Target:

100%

91. CSF Dashboard

An executive dashboard may include:

Governance Health

Asset Visibility

Protection Coverage

Detection Coverage

Incident Readiness

Recovery Readiness

92. Function-Level Dashboard

Example:

Function	Status
Govern	Moderate
Identify	Strong
Protect	Moderate
Detect	Strong
Respond	Moderate
Recover	Weak

93. Function Scores Require Context

Avoid treating CSF as:

One Percentage
=
Cybersecurity Risk

A strong average can hide a critical weakness.

Example:

Overall:
90%

but:

Recovery:
45%

for critical services.

94. Executive Reporting

Executives need:

Material Gaps

Risk

Trend

Owner

Treatment

Decision Required

not hundreds of subcategory rows.

95. Example Executive Narrative

Recovery capability remains
below the target CSF profile
for critical customer services.

Two Tier-1 applications have
not completed recovery testing
within the approved period.

Residual resilience risk remains
above appetite.

IT Operations is implementing
quarterly recovery exercises,
with completion targeted for Q4.

96. Continuous Improvement

CSF should not be treated as:

Assessment
      ↓
Finished

Use:

Assess
      ↓
Improve
      ↓
Measure
      ↓
Reassess
      ↺

97. Triggered Reassessment

Reassess after:

Major Incident

Acquisition

Cloud Migration

New Regulation

Significant Architecture Change

Critical Vendor Change

98. CSF and Continuous Compliance

Some CSF outcomes can be continuously monitored.

Examples:

MFA

Logging

Encryption

Vulnerability Management

Endpoint Coverage

Cloud Configuration

99. Example Continuous Monitoring

CSF Outcome
      ↓
IAM-001
      ↓
Identity Provider
      ↓
Daily MFA Test
      ↓
Control Health

100. CSF Does Not Replace Risk Judgment

A framework result such as:

Protect:
85%

does not automatically tell you:

Residual Cyber Risk

Professional risk analysis remains necessary.

101. CSF Does Not Equal Certification

NIST CSF is primarily a cybersecurity risk-management framework.

Using the framework does not automatically mean:

Certified

or:

Compliant with
Every Regulation

102. CSF Is Not a Checklist-Only Framework

Weak approach:

Subcategory
      ↓
Yes / No
      ↓
Done

Better:

Outcome
      ↓
Business Risk
      ↓
Control
      ↓
Evidence
      ↓
Effectiveness
      ↓
Improvement

103. Common Mistake — Start With Controls Without Scope

First understand:

What Business
Are We Protecting?

104. Common Mistake — Treat All Outcomes Equally

Prioritize based on:

Risk

Criticality

Threat

Business Impact

105. Common Mistake — Aim for Perfect Scores

The objective is:

Manage Cybersecurity
Risk Effectively

not:

Score 100%
Everywhere

106. Common Mistake — Ignore Govern

Technical teams may focus on:

Protect

Detect

while ignoring:

Govern

This can create strong tools but weak accountability.

107. Common Mistake — Weak Asset Inventory

If assets are unknown:

Identify
=
Weak

and many other functions become unreliable.

108. Common Mistake — Protect Without Detect

Strong preventive controls do not eliminate the need for monitoring.

109. Common Mistake — Detect Without Respond

Alerts without response capability create:

Visibility
Without Action

110. Common Mistake — Respond Without Recover

Containing an incident is not the same as restoring critical services.

111. Common Mistake — Ignore Third Parties

Critical suppliers may materially affect cybersecurity risk.

112. Common Mistake — No Target Profile

Without a target:

Gap
Cannot Be
Clearly Defined

113. Common Mistake — Improvement Plan Without Owner

Every action should have:

Owner

Priority

Due Date

Status

114. Common Mistake — Framework Assessment Becomes Annual Exercise

Use CSF as an ongoing risk-management model.

115. End-to-End Example — Ransomware

Business objective:

Maintain Critical
Customer Services

Risk:

Ransomware
Disruption

Govern

Define Risk Appetite

Assign Ownership

Approve Resilience Strategy

Identify

Identify Critical Assets

Identify Dependencies

Assess Ransomware Risk

Protect

EDR

MFA

Segmentation

Patch Management

Backups

Detect

EDR Alerts

SIEM

Behavior Analytics

Respond

Contain Malware

Isolate Systems

Activate Incident Response

Recover

Restore Systems

Validate Data

Resume Services

Review Lessons

116. End-to-End Example — Privileged Access

Risk:

Privileged Account
Compromise

Current Profile:

MFA:
Partial

PAM:
Not Implemented

Access Reviews:
Annual

Target Profile:

MFA:
100%

PAM:
Implemented

Access Reviews:
Quarterly

Gap:

MFA Coverage

PAM

Review Frequency

Improvement:

IAM Program

117. End-to-End Example — Vendor Risk

Risk:

Critical SaaS
Provider Breach

Current:

Initial Assessment Only

Target:

Risk Tiering

Annual Assessment

Incident Monitoring

Contract Requirements

Continuous Monitoring

118. End-to-End Example — Recovery

Current:

Annual Backup Check

Target:

Quarterly Recovery Test

Critical Service RTO Testing

Dependency Validation

The gap may materially affect:

Recover

119. Enterprise CSF Operating Model

A mature operating model may look like:

Board / Executives
      ↓
Cyber Risk Governance
      ↓
NIST CSF Profile
      ↓
Enterprise Controls
      ↓
Technology Implementation
      ↓
Monitoring
      ↓
Metrics
      ↓
Risk Reporting
      ↓
Improvement

120. CSF Implementation Roadmap

A practical implementation may follow:

Phase 1
Business Context

Phase 2
Scope

Phase 3
Current Profile

Phase 4
Risk Assessment

Phase 5
Target Profile

Phase 6
Gap Analysis

Phase 7
Prioritization

Phase 8
Improvement Plan

Phase 9
Metrics

Phase 10
Continuous Improvement

Phase 1 — Business Context

Understand:

Mission

Products

Critical Services

Customers

Regulation

Threat Environment

Phase 2 — Scope

Define:

Business Units

Applications

Cloud

Locations

Vendors

Data

Phase 3 — Current Profile

Assess current outcomes.

Phase 4 — Risk Assessment

Determine:

Threats

Weaknesses

Impacts

Residual Risk

Phase 5 — Target Profile

Define desired state based on risk.

Phase 6 — Gap Analysis

Compare:

Current
      vs
Target

Phase 7 — Prioritize

Use:

Risk

Criticality

Effort

Dependencies

Phase 8 — Improvement Plan

Assign:

Action

Owner

Funding

Due Date

Priority

Phase 9 — Metrics

Define:

KRIs

KCIs

KPIs

Phase 10 — Continuous Improvement

Repeat assessment as the environment changes.

NIST CSF Assessment Checklist

Govern

cybersecurity governance defined.
roles and responsibilities assigned.
risk-management strategy documented.
risk appetite established.
policies maintained.
supply-chain governance established.
legal and regulatory obligations identified.
executive oversight established.

Identify

assets inventoried.
applications inventoried.
cloud resources inventoried.
data identified.
vendors identified.
dependencies understood.
risks assessed.
critical assets prioritized.

Protect

IAM controls implemented.
MFA implemented.
privileged access governed.
awareness training maintained.
data protected.
secure configuration maintained.
vulnerabilities managed.
resilience safeguards implemented.

Detect

logging enabled.
critical systems monitored.
anomalies detected.
security alerts managed.
monitoring coverage understood.
detection processes tested.

Respond

incident-response plan maintained.
roles defined.
escalation established.
investigation procedures maintained.
communication processes defined.
containment procedures maintained.
exercises performed.

Recover

recovery plans documented.
backups maintained.
RTOs defined.
RPOs defined.
recovery exercises performed.
critical dependencies tested.
lessons learned incorporated.

NIST CSF Deliverables

After completing this lesson, you should be able to design:

01 NIST CSF Scope Document

02 Business Context Assessment

03 CSF Current Profile

04 CSF Target Profile

05 CSF Gap Assessment

06 Cyber Risk Register

07 CSF-to-Control Mapping

08 CSF-to-Framework Mapping

09 CSF Improvement Register

10 CSF Prioritization Matrix

11 CSF KRI Catalogue

12 CSF KCI Catalogue

13 Function-Level Dashboard

14 Risk Appetite Mapping

15 Third-Party CSF Assessment

16 Cloud CSF Assessment

17 Incident Readiness Assessment

18 Recovery Readiness Assessment

19 Executive CSF Dashboard

20 CSF Continuous Improvement Roadmap

Practical Activity — Build a CSF Current Profile

Your organization operates:

AWS

Azure

Microsoft 365

Customer SaaS

Remote Workforce

Critical SaaS Vendors

Assess:

Govern

Identify

Protect

Detect

Respond

Recover

using:

Strong

Moderate

Weak

For every rating, document:

Evidence

Gap

Risk

Practical Activity — Build a Target Profile

For each Function define:

Current State

Target State

Gap

Owner

Priority

Example:

Function:
Recover

Current:
Annual Recovery Testing

Target:
Quarterly Tier-1
Recovery Testing

Gap:
Testing Frequency

Owner:
IT Operations

Priority:
High

Practical Activity — Map Controls

Map these controls:

Privileged MFA

Cloud Logging

Vulnerability Management

Incident Response

Backup & Recovery

Vendor Assessment

to relevant NIST CSF outcomes.

Then map the same controls to:

ISO 27001

SOC 2

PCI DSS

where appropriate.

Practical Activity — Prioritize CSF Gaps

You identify:

15 CSF Gaps

including:

Privileged MFA Missing

Weak Asset Inventory

Recovery Testing Incomplete

Vendor Monitoring Weak

Policy Review Overdue

Minor Documentation Gap

Prioritize using:

Business Risk

Control Criticality

Threat Exposure

Regulatory Impact

Effort

Practical Activity — Build Executive CSF Dashboard

Display:

Function Health

Top CSF Gaps

Critical Risks

Risk Appetite Breaches

Improvement Actions

Overdue Actions

Example:

GOVERN     Moderate

IDENTIFY   Strong

PROTECT    Moderate

DETECT     Strong

RESPOND    Moderate

RECOVER    Weak

Then identify:

What Requires
Leadership Attention?

NIST CSF GRC Mindset

When applying NIST CSF, ask:

What Business
Are We Protecting?

What Services
Are Critical?

What Cyber Risks
Could Affect Them?

Who Owns
Those Risks?

What Is
Our Risk Appetite?

What CSF Outcomes
Matter Most?

What Is
Our Current Profile?

What Should
Our Target Profile Be?

What Gaps
Exist?

Which Gaps
Create Material Risk?

What Controls
Address Them?

Who Owns
Those Controls?

What Evidence
Shows They Work?

How Do We
Measure Effectiveness?

What KRIs
Show Risk Increasing?

What KCIs
Show Controls Weakening?

Are Our
Critical Assets Known?

Are We
Protecting Them?

Can We
Detect Attacks?

Can We
Respond Effectively?

Can We
Recover Critical Services?

Are Third Parties
Included?

Are Risks
Within Appetite?

What Improvements
Should Come First?

What Does
Leadership Need
to Decide?

Are We
Using CSF
as a Checklist?

Or Are We
Using It to
Manage Cyber Risk?

That is the mindset of a GRC professional using the NIST Cybersecurity Framework.

Key Takeaways

NIST CSF is a cybersecurity risk-management framework.
CSF 2.0 is organized around Govern, Identify, Protect, Detect, Respond, and Recover.
Govern provides enterprise direction and oversight across the cybersecurity lifecycle.
Identify helps organizations understand assets, dependencies, and cybersecurity risk.
Protect focuses on safeguards that reduce cybersecurity exposure.
Detect focuses on monitoring and identifying cybersecurity events.
Respond focuses on managing cybersecurity incidents.
Recover focuses on restoring services and improving resilience.
CSF is outcome-based rather than tied to specific technologies.
Organizational Profiles help compare current and desired cybersecurity states.
Current Profiles describe present capabilities.
Target Profiles describe desired cybersecurity outcomes.
Gap analysis identifies differences between Current and Target Profiles.
Gaps should be prioritized based on risk rather than simple completion percentages.
Implementation Tiers describe characteristics of how cybersecurity risk is managed.
Tier 4 is not automatically the required target for every organization.
CSF should connect cybersecurity controls to enterprise risks and business objectives.
CSF outcomes can be mapped to enterprise common controls.
Common controls can support CSF alongside ISO 27001, SOC 2, PCI DSS, and other requirements.
CSF can support cloud, third-party, resilience, identity, and incident-management programs.
CSF assessment should include evidence and control effectiveness rather than only yes/no responses.
Executive reporting should focus on material gaps, trends, ownership, treatment, and decisions.
CSF does not automatically provide certification.
Strong average scores can hide critical weaknesses.
Continuous monitoring can provide ongoing evidence for selected CSF outcomes.
CSF should operate as a continuous risk-management and improvement model.

Knowledge Check

Before continuing, make sure you can answer:

What is NIST CSF?
What is the primary purpose of NIST CSF?
What are the six CSF 2.0 Functions?
What is the purpose of Govern?
What activities belong under Identify?
What activities belong under Protect?
What activities belong under Detect?
What activities belong under Respond?
What activities belong under Recover?
Why is asset inventory important?
Why should asset criticality be defined?
What is a cybersecurity risk scenario?
What is an Organizational Profile?
What is a Current Profile?
What is a Target Profile?
What is CSF gap analysis?
How should CSF gaps be prioritized?
What are CSF Implementation Tiers?
What characterizes Tier 1?
What characterizes Tier 2?
What characterizes Tier 3?
What characterizes Tier 4?
Why should tiers not be treated as simple maturity scores?
How can CSF connect with enterprise risk management?
How can CSF connect with risk appetite?
How can CSF outcomes map to enterprise controls?
How can common controls support multiple frameworks?
How does NIST CSF differ from ISO 27001?
How can CIS Controls complement NIST CSF?
How does NIST RMF differ from NIST CSF?
How can CSF support cloud-security governance?
How can CSF support third-party risk?
What is a CSF Current-to-Target gap?
Why should CSF assessments include evidence?
What KRIs can support CSF reporting?
What KCIs can support CSF reporting?
Why can overall CSF scores be misleading?
Why is continuous improvement important?
When should a CSF reassessment occur?
How should executives use CSF reporting?

What’s Next?

➡️ Next: 02 — NIST Risk Management Framework (RMF)

In the next lesson, you will move from the broad cybersecurity-risk outcomes of NIST CSF into the more structured NIST Risk Management Framework.

You will learn how RMF organizes security and privacy risk management through a lifecycle involving:

PREPARE
      ↓
CATEGORIZE
      ↓
SELECT
      ↓
IMPLEMENT
      ↓
ASSESS
      ↓
AUTHORIZE
      ↓
MONITOR

You will explore how organizations connect:

Systems

Information Types

Impact Levels

Security Controls

Control Implementation

Assessment

Risk Acceptance

Authorization

Continuous Monitoring

into a disciplined system-level risk-management process.

➡️ Next: 02 — NIST Risk Management Framework (RMF)