NIST Cybersecurity Framework: A Comprehensive Guide

Introduction

Organizations of all types and sizes face unrelenting threats from malicious actors, including organized cybercrime, corporate espionage, and state-sponsored attackers. Supply chain attacks are on the increase, and supply chains have become an ungovernable size without proper strategy.

The NIST Cybersecurity Framework, or NIST CSF, is a set of recommendations that combine industry standards and best practices to help guide organizations on how to manage risk.

It’s the most widely adopted framework in the United States. It is even the basis of many regulatory regimes, such as the Cybersecurity Maturity Model Certification in the U.S. defense sector.

Every business owes it to themselves, their stakeholders, and their customers to take a proactive stance on IT security and risk management, which is why the NIST Cybersecurity Framework has been adopted globally as the gold standard for information security. Read on to discover how adopting the NIST Cybersecurity Framework can bolster your cybersecurity efforts and open new business opportunities.

Overview of NIST

Widely viewed as the global standard for best practices in the sector, The NIST cybersecurity framework (NIST CSF) offers guidance on ways organizations can mitigate information security risks. It is revised consistently to reflect the most pressing challenges facing today’s business leaders and cybersecurity teams. As the basis for many government- and industry-mandated compliance organizations, the NIST CSF is a thorough and exceptional tool to guard against security threats. The framework is maintained by the National Institute of Standards and Technology, a U.S.-based government organization that seeks to promote innovation without adding unnecessary risk. Though originally developed with U.S. organizations in mind, it serves as a point of reference for many other frameworks and regulatory regimes around the world.

History of the NIST Cybersecurity Framework

The first version of the framework, aimed at the critical infrastructure sector, was published in 2014. When a newer draft version was released in 2017, public comments were gathered before finally being released in 2018. As a result, notable changes in this latest iteration include extra details on supply chain risk management and guidance on how to work with external stakeholders when mitigating or disclosing vulnerabilities. Intentionally broad, the framework itself is centered on these five core functions of information security, which we will address in greater detail in Chapter Three:

Identify

This function involves taking inventory of assets that need to be protected, such as servers, virtual machines, endpoints, and networking components. It also focuses on data classification, risk management, and asset vulnerabilities.

Protect

This function outlines how well appropriate information security safeguards align with business priorities and environments and information classification levels. Examples of common safeguards include multifactor authentication and endpoint encryption.

Detect

Because conventional protective measures are not enough in an era of increasingly sophisticated attacks, this function explores how organizations provide the means to proactively detect potential threats. This may include intrusion detection systems (IDS) and managed detection and response (MDR).

Respond

Key roles must be assigned and actions identified should security become compromised. This function centers around what happens when a potential security incident is detected and ensuring that organizations have a documented set of procedures for management.

Recover

This function deals with the mitigation strategies needed to restore affected capabilities and services with minimal damage to the organization when security incidents result in unscheduled downtime.

Today the framework serves as the basis for cybersecurity programs in many industries, especially those in more regulated sectors such as finance, healthcare, and defense. For example, defense contractors are governed by the Defense Federal Acquisition Regulation (DFARS) and the Cybersecurity Maturity Model Certification (CMMC), which use the NIST SP 800-171 framework as a basis for their own cybersecurity standards. The NIST Privacy Framework can also serve as a basis for achieving compliance with global information privacy regulations, such as CCPA and GDPR. In the healthcare sector, HITECH legislation requires adoption of NIST and other widely recognized cybersecurity standards. The reality is that many types of businesses, of any size, can benefit from adopting the practices outlined in the framework.

How the NIST Cybersecurity Framework Helps Small Businesses

The mistake that many small businesses make is not considering themselves reasonable targets for more advanced attacks, such as advanced persistent threats (APTs). Because of this misperception, they often have only minimal cybersecurity controls in place to protect against everyday threats such as mass phishing scams and common forms of malware. The truth is that every organization, no matter the size, is a potential target. In fact, small businesses present something of a sweet spot for attackers, who usually view them as easy targets that nonetheless have a lot of data worth stealing. Even small businesses need enterprise-grade security. For small businesses that achieve full compliance with the NIST Cybersecurity Framework and the NIST Privacy Framework, they make themselves more attractive to potential customers, investors, and suppliers. While achieving compliance might seem like a significant investment, it opens the door to many new business opportunities while greatly reducing the risk facing the organization. In sum, it’s a good move for the business’s financial health and reputation. The NIST Cybersecurity Framework details the various processes and technical measures that need to be applied to detect, respond to, and recover from security-related incidents. Importantly, achieving NIST small business compliance with the help of the right partners can help to attain the same level of security maturity as large enterprises. For example, a fully managed detection and response (MDR) service can proactively detect and respond to potential threats before they make it past the business’s last line of defenses. Another powerful solution is Security Incident and Event Management (SIEM), which provides in-depth forensic analysis and a complete audit of security-related events across the entire technology environment. Like MDR, this service can also be outsourced and managed externally.

Five Useful Resources for Small Businesses

We understand that full compliance with the framework can be complicated, time-consuming, and costly. Fortunately, NIST provides an array of helpful resources to help make the process a little less difficult. Let’s review them here.

Official publications

Start with the institute’s official publications, including of course the NIST Cybersecurity Framework documentation itself. In addition to the official framework, there are over a thousand other publications on the topic of cybersecurity aimed at different technology environments and industries.

Information technology laboratory

This is the best resource center for specific guidelines on all key areas of cybersecurity. The library resources are conveniently divided into three main series. For example, the 500 series details cybersecurity controls and standards all businesses should adhere to, such as multifactor authentication and cloud computing safety. The 800 series provides resources to help businesses align with U.S. government information security standards. Finally, the 1800 series provides operational resources, including guidance on creating your own internal cybersecurity policies and standards.

Cybersecurity priority areas

NIST currently lists five priority areas: cybersecurity, the internet of things, artificial intelligence, reliable computing, and future computing technologies. Of these, only the first three are currently available, with the remaining two coming soon. These priority areas are intended to encourage innovation without adding risk.

Computer security resource center

This is a one-stop shop for everything related to IT security. It is regularly updated to reflect current threats and trends, such as ransomware and operational technology vulnerabilities. In addition to news and updates, you’ll find numerous publications, projects impacting information security, and a list of events you can participate in.

Small business center

The Small Business Center provides a variety of useful materials that take into consideration the unique challenges and limitations of small businesses. There is a complete introduction to cybersecurity intended for novices, extensive planning guides to help you assess your current security measures, training materials, and guidance by topic area.The Small Business Center provides a variety of useful materials that take into consideration the unique challenges and limitations of small businesses. There is a complete introduction to cybersecurity intended for novices, extensive planning guides to help you assess your current security measures, training materials, and guidance by topic area.

Why Following NIST CSF Is Important

The NIST Cybersecurity Framework is the product of many years of research and contributions from numerous leading authorities in the information security sector. As such, it encapsulates the wisdom and experience of the crowd, which is especially important now that technology is everywhere and the threat against it has become increasingly complex as well. This means the framework addresses common oversights and helps business leaders to understand all perspectives on security.

In addition to these obvious benefits of bolstering your cybersecurity plan, here are some other reasons that you may not have considered:

1. Attract high-value customers

Information security is much more than a necessity or a costly obligation. Attaining a high degree of security is now a major part of the value proposition. This is especially true for sectors such as defense, healthcare, and legal, in which a brand’s reputation depends heavily on the organization’s ability to protect its clients’ sensitive data. With improved cybersecurity comes a positive ripple effect across supply chains. This makes your organization more attractive to potential suppliers, customers, and investors.

2. Achieve security alignment

No longer is there a disconnect between the demands of cybersecurity and broader business goals and priorities. More experts now realize the truth: cybersecurity is everyone’s responsibility, and business success depends on it. The NIST Cybersecurity Framework addresses the needs of risk management and alignment with business needs. Since corporate executives understand this very well, security budgets can be better justified and allocated accordingly.

NIST CSF Requirements Evolve with The Times

Just as your business adapts to changing external factors, so does the NIST Cybersecurity framework. For instance, the increase in supply chain attacks in recent years, particularly during the coronavirus pandemic, means that organizations must pay closer attention to vulnerabilities to their vendors, partners, and other external stakeholders. It’s becoming clear that more attacks are originating from third-party organizations. The latest NIST Cybersecurity Framework provides guidance on working with supply chain stakeholders when conducting risk assessments and optimizing vulnerability disclosure processes. While still compatible with the first edition of the framework, the latest version was announced and made public in April 2018. While version 1.1 of the NIST Cybersecurity Framework brings several new additions to address supply chain risk management, it’s also updated to reflect the most pertinent challenges facing business leaders today. By encompassing the five control areas in total – identification, protection, detection, response, and recovery – the framework establishes a baseline of best practices to help you develop a complete process for dealing with the lifecycle of any given cyberthreat or other incident. One of the reasons the CSF is so adaptable is that the depth of security assessments is open to individual interpretation. The CSF is more than just a to-do list for organizations wanting to better protect their digital assets. It does not prescribe control requirements; Instead, it focuses on high-level requisites.

Using the NIST CSF Tiers as a Gauge

When implementing the NIST CSF, businesses may have confusion over the fact that the framework refers to both tiers and maturity levels. The tiers are intended to offer guidance on how organizations currently interact and coordinate cybersecurity and operational risk management. Their main purpose is to evaluate current activities and determine sufficiency given their regulatory environment and willingness to assume a given level of risk. As such, organizations should regularly assess their readiness to tackle new and emerging threats, as well as old ones. Although the NIST Cybersecurity Framework should not be taken as a maturity model, using a self-assessment tool can businesses keep track of their security program and identify the areas in need of improvement. Companies can move up the four tiers by continuously improving their security maturity to the point their approach becomes proactive enough to counter more advanced threats. Here are the four tiers, which we will discuss in-depth in Chapter Five:

The tiers can provide an exceptional way to benchmark your existing security measures. And by obtaining an outside view, you may well uncover issues you didn’t know existed –– a critical safety measure during a time when external threats pose the most risk.

It’s easy to see how this assessment tool can offer benefits. However, other relevant advantages should be considered as well.

Benefits of NIST Cybersecurity Framework

Regardless of whether your company reaches Tier 4 right away, utilizing the NIST CSF is a strong step toward unifying business leadership and IT security. Without alignment between the needs of business leaders and the demands of cybersecurity, cybersecurity teams have traditionally found themselves operating in bubbles. Consequently, security leaders were often viewed as those who said no to innovation.

The NIST CSF can improve the relationship between business and cybersecurity and equip security leaders to become better communicators. To unify everyone this way, the CSF is heavily focused on risk management – a concept business leaders understand very well.

Unlike other cybersecurity frameworks that address only security measures, the NIST framework addresses the entire incident lifecycle, including what to do in the event of a successful attack. In short, it helps organizations prepare for practically any scenario.

Even smaller businesses can realize this benefit. Unlike large companies with fully staffed in-house IT security teams, smaller businesses can overcome these challenges by working with the right technical partners, such as security consultants and managed security services firms. MSPs can provide valuable services to support and provide counsel about very specific concerns, such as defending against ransomware or providing exceptional cloud security.

Defending Against Ransomware

As cyber extortion becomes more common, NIST has responded by publishing a new draft on protecting against ransomware, which serves to complement the CSF. The addition to the framework features the ransomware profile, which can help organizations determine their state of readiness in effectively tackling the nightmare of cyber extortion.

Some businesses falsely assume that ransomware can easily be countered by antivirus software, but they have not taken into consideration the continuing rise of new variants. Additionally, these attacks are often carried out in conjunction with highly targeted social engineering scams, such as business email compromise (BEC) attacks. Many of these attacks can evade standard security controls, which is why the NIST Cybersecurity Framework recommended controls go beyond antivirus software.

While antivirus software should be used at all times and updated automatically, it should also be set to automatically scan email attachments and external media. That being said, most ransomware exploits vulnerabilities in outdated or unsupported operating systems.

Complicating matters further, the risks of ransomware attacks are even greater now that so many people are working from home and using their own devices for work. Because of this, organizations need to implement strict policies governing the use of third-party apps. In a perfect situation, no sensitive company data would be stored on employee-owned devices in the first place. Ideally, employee devices should only be access points to company apps and data hosted in the cloud. This approach allows administrators to restrict access by using standard user accounts without administrative privileges while also ensuring full visibility into their data.

Another crucial control area that the NIST Cybersecurity Framework deals with is security awareness training. Remote workers and everyone on your team should undergo regular awareness training so that they understand the risks and how they are spread.

Lastly, the latest ransomware profile also outlines concrete steps that organizations can take to recover from a ransomware attack. These steps focus on incident recovery planning, communications, and backup and restoration.

Though any organization can use these guidelines, ones that have already implemented the broader NIST Cybersecurity Framework can be most successful. Finding a dependable technology and security partner is essential for small businesses to achieve the same level of protection that big enterprises can accomplish.

Ensuring Safer Cloud Security

In this era of remote work and hyperconnectivity, cloud computing is essential for businesses. Yet cloud computing also carries its own set of security concerns. Simple logic tells us that the ability for your employees to access business-critical apps and data from anywhere and on any device means that bad actors also can do the same.

When the first version of the NIST CSF was released, cloud computing was relatively new and had yet to be widely used across all industries. Now that the era of cloud computing has arrived, the latest edition, along with the supporting documentation from NIST, provides guidance for external cloud infrastructure. While the framework does not cover all the important issues regarding cloud security, such as auditing and shared responsibility, it does lay out the critical foundations. Because most organizations still rely heavily on internal infrastructure, including networking hardware and endpoints, these systems need protecting just as they always did. Compliance with the framework helps secure both internal and external infrastructure, whereas many competing frameworks focus on only one or the other.

Just like the framework itself, cybersecurity should not live in isolation. Instead, it needs to be deeply integrated with your comprehensive strategy. Far from just being a necessary evil, it is now a critical part of a company’s value proposition. Let’s take a closer look at how the core functions serve to strengthen cybersecurity.

NIST Core Functions

To fully understand how the NIST CSF can benefit your company, it’s helpful to start by viewing the framework’s core functions.

As one of the world’s leading authorities on information security, NIST draws from numerous best practices, regulatory standards, and other frameworks. The Framework Core is broken down into five function areas, 23 categories, and 108 subcategories and dozens of resources, such as national and international standards and compliance regimes. The function areas are at the top of this hierarchy and are meant to highlight the role of each individual stage of the risk-management lifecycle.

Keep in mind that these core functions span the entire incident lifecycle, from identifying potential threats and assets to disaster response planning.

The NIST framework is highly versatile. It does not prescribe any specific products or services, which also means it is vendor-agnostic. As such, organizations can implement the framework in any way they want.

To become fully compliant with the framework, businesses need to achieve all desired outcomes across all five of the NIST CSF core functions. Let’s review these outcomes and explore what they entail with greater detail below:

1. Identify

As noted earlier, the first step toward executing an inclusive cybersecurity strategy is to identify the assets you want to protect and document the risks facing them. Asset Management is the very first part of the process, followed by Business Environment analysis. This core function then addresses Governance, Risk Management, and Risk Management Strategy. Finally, the latest iteration of the framework has greatly expanded upon the Supply Chain Risk Management category to help counter growing threats to today’s supply chains.

2. Protect

Protection of the digital assets identified in the previous core function is the goal of this step. The objective is to ensure all possible measures are in place to protect against threats either old or new and to ensure the continued delivery of business-critical services. The categories include Access Control, Awareness and Training, Data Security, Maintenance, and Proactive Technology. There is a major emphasis on the importance of proactive cybersecurity, rather than just relying on conventional reactive measures, such as antivirus scanners.

3. Detect

Inherently, protecting against threats demands the ability to detect them in the first place. Detection is paramount in the case of new and emerging threats that are not likely to be prevented by usual antivirus or firewall solutions. This function area has three categories: Anomalies and Events, Security Continuous Monitoring, and Detection Processes. Detection areas such as these are where technical solutions such as security incident and event management (SIEM) and managed detection and response (MDR) come into play.

4. Respond

This function area addresses incident response, with the goal of mitigating risks and preventing incidents that could result in serious damage. Remember, the NIST CSF rests on the fact that incidents will occur, no matter how robust your protective measures are. The five categories in this area are Response Planning, Communications, Analysis, Mitigation, and Improvements. This function focuses heavily on continuous improvement by leveraging the power of analytics to boost resilience to future incidents.

5. Recover

The fifth and final function, a focus on recovery, is one that every organization must be prepared for, like it or not. It covers how to recover from a data breach or ransomware attack. The goal is to prevent the incident from worsening and to minimize lasting damage to the business. The three categories are Recovery Planning, Improvements, and Communications. Disaster recovery measures should be properly coordinated and based on the organization’s ability to tolerate a certain degree of risk.

This core framework comprises five function areas intended to address the incident lifecycle from proactively preventing threats to recovering from an incident.

To fully utilize the function areas, you’ll need to examine how they are further divided into control categories, of which there are 23 in total.

NIST CSF Categories & Controls

Compliance with NIST SP 800 53 is mandatory for federal agencies and organizations making up the Defense Industrial Base. That being said, the NIST Cybersecurity Framework controls set the standards for security, and even though the controls were originally released with critical infrastructure in mind, they have since been widely adopted across multiple industry sectors.

Across the five NIST cybersecurity framework phases there are 23 control categories. The categories are then divided into more specific control subcategories, of which there are 108.

These controls address everything from identifying what needs to be protected to responding to and recovering from an incident. Unlike other cybersecurity frameworks that focus primarily on protective measures and detection capabilities, the NIST Cybersecurity Framework focuses on the entire lifecycle of incident management routines.

By taking a unified approach to the overall process, while still giving organizations control over how they implement the 23 control categories, this framework provides flexibility. Each control category has its own subcategories that provide actionable advice and resources to help organizations achieve the best outcomes and bolster cybersecurity.

For example, the control category Identity Management and Asset Control under the Protect function area contains seven subcategories, along with their respective resources. Resources include references to other standards and frameworks, such as the NIST Special Publication 800-53.

When adapting the framework to the unique needs of your organization, the first thing to do is build out your cybersecurity profile. This profile will reveal the alignment between the requirements and objectives of your organization and its existing resources and appetite for risk. It will serve as the foundation for your requirements and controls.

Before prioritizing remediation based on severity, available budget, and business priorities, most organizations start with a cybersecurity gap analysis that looks for potential weak spots in their environment. Importantly, a NIST CSF gap analysis should encompass all relevant subcategories and consist of a profile of their current state and the target profile. Additionally, the target profile should include a prioritized implementation plan complete with a list of responsible parties and timeframes.

Key Points about the NIST Cybersecurity Framework

Here is an overview of what organizations need to understand about the key NIST CSF controls:

Building a complete inventory of your computing assets, including all networking components and data-bearing devices, is the first step toward implementation.

Then, leaders should build out their risk profiles and prioritize their remediation strategies. The NIST Cybersecurity Framework mapping process can be difficult and time-consuming, considering the current complex hybrid and multi-cloud computing environments. Still, it is an essential step— you cannot expect to protect what you don’t know about.

The second and third function areas of the framework cover protective measures and detective measures, respectively.

Protective measures include categories such as identity management and authentication and access control, awareness and training, and data security. Precisely how companies deal with these measures is a choice, but common methods include anti-malware, intrusion detection and prevention, and enterprise-grade firewalls.

The Detection function includes areas such as continuous monitoring, detection processes, and the management of anomalies and events. These functions can be outsourced in the form of managed detection and response (MDR) or security incident and event monitoring (SIEM) services.

Lastly, the fourth and fifth function areas of the framework concern how organizations respond to an incident and how they recover from a disaster.

Incident response plans primarily serve to stop attacks in progress and mitigate their effects. By contrast, recovery places an emphasis on what to do in a worst-case scenario, such as a data breach. Every organization, no matter the sophistication of its prevention and detection measures, should take the view that it is not a matter of if a disaster will happen, but when.

In the dynamic and unpredictable world of information security, the only constant is change. No business can afford to rely on the same processes for years on end, which is why it is necessary to continually revisit the controls.

Mapping NIST CSF Controls

While the NIST CSF controls set the standards for information security, which controls you apply and how you apply them depend on your unique business environment. Control mapping is the process of uniting two or more compliance domains or sets of business requirements to build a strategy that aligns to your distinct needs. Important factors to consider are your appetite for risk, the nature of your technology infrastructure, and your industry. There are countless NIST Cybersecurity Framework examples out there. However, while it is always a good idea to see what other businesses similar to yours are doing, keep in mind that no two information security environments look exactly the same. Thus, NIST Cybersecurity Framework mapping is ultimately an individual effort. As companies get ready for a security and compliance audit, the mapping controls can provide full visibility into the security environment. This visibility is extremely useful for organizations preparing to earn their Cybersecurity Maturity Model Certification (CMMC), for example. In the end, control mapping gives organizations a cohesive and relevant way to ensure they meet the required business outcomes covered by the NIST Cybersecurity Framework. To get started with the process, you should obtain the help of an expert security and compliance consultant who will guide you through each stage and function area of the framework and offer advice and solutions tailored to the unique needs and characteristics of your business. Some businesses find that starting with a checklist can help them plan for the conversation with an outside security consultant.

NIST CSF Control Checklist

As discussed, the NIST CSF controls span five function areas, 23 categories, and 108 subcategories to ensure comprehensive coverage. Use this checklist to help make sure you are prepared.