The NIST 2.0 Cybersecurity Framework
Description
Learn to identify, protect, defend, and recover from cyber incidents
The NIST 2.0 Cybersecurity Framework delivers clear guidance on applying the gold standard NIST framework in complex, real-world situations. Drawing on her extensive cybersecurity research and reporting, author Cynthia Brumfield explains how to identify risks, defend against threats, and recover from incidents using compelling case studies.
The book examines high-profile incidents, including Microsoft's Midnight Blizzard attack, the Ticketmaster data breach, and the Columbus ransomware incident, to illustrate NIST functions, and inform readers on how to create asset inventories, implement protective measures, detect suspicious activity, respond to incidents, and establish governance policies. Each chapter provides implementation examples, references, and demystification of NIST framework controls for securing assets and managing risks.
The book includes:
- Real-world case studies from Microsoft, Ticketmaster, MGM Resorts and Caeser's Entertainment, and other organizations that illustrate practical applications of the NIST framework
- Implementation guidance covering all six NIST functions: Identify, Protect, Detect, Respond, Recover, and Govern
- Chapter summaries and quizzes that reinforce learning objectives and help readers assess their understanding
- Clear and concise explanations of how to achieve the outcomes articulated across the NIST categories and subcategories
Whether you're a student, organizational decision-maker, IT professional, public or private cybersecurity worker, or government contractor, this book provides the practical knowledge needed to implement the NIST 2.0 Framework effectively. You'll learn from real-world failures and successes to build a robust cybersecurity program.
More details
Other editions
Additional editions
Content
Chapter 1
Overview of Risk Management and the NIST Cybersecurity Framework
Overview of the Chapter and Objective
This chapter provides a succinct introduction to the concept of risk management and the NIST Cybersecurity Framework or CSF. The CSF discussion highlights the transition from NIST 1.0 to NIST 1.1 to NIST 2.0 and delivers a basic grounding in the NIST CSF structure. The chapter touches on the CSF's origins and provides a guide to the framework's core functions, categories, subcategories, implementation examples, informative references, and other key components. It is a practical walk-through of the multiple layers of the CSF that can help organizations better build and manage their cybersecurity programs.
1.1 Brief Overview of Risk Management Principles
Risk management for any organization is about scanning the environment for things that could go wrong and then developing strategies to prioritize and manage the risks of those adverse outcomes in an effective manner.
However, risk management isn't just about avoiding disaster. It's also about making your organization more resilient and ready to seize opportunities in an unpredictable world. Effective risk management transforms potential threats into avenues for growth and innovation by proactively addressing uncertainties.
Risk management is an ongoing process that is never completed. It is a continuous journey, guided by several interconnected principles that help organizations navigate challenges and build lasting strength.1
1.1.1 The Core Journey of Risk Management
At its heart, successful risk management follows a cyclical process that involves understanding, addressing, and continuously re-evaluating potential events.
1.1.1.1 Identify Risks
As we will see in Chapter 2, the first step in the risk management journey is to identify risks. It involves systematically recognizing potential events, both threats and opportunities, which could impact your objectives. This proactive step ensures your organization is not caught off guard. To do this thoroughly, organizations use various methods such as brainstorming to encourage open dialog about what might go right or wrong, interviews with subject matter experts, front-line staff, and even customers or suppliers for diverse perspectives, reviewing risk checklists and historical data from past projects or incidents, conducting process analysis to find vulnerabilities in workflows or systems, and performing a SWOT analysis (Strengths, Weaknesses, Opportunities, Threats) for a balanced view of internal and external risks.
1.1.1.2 Analyze and Evaluate Risks
Once risks are identified, the next step is to understand how likely they are to occur and how much impact they could have on your objectives. This involves using risk analysis techniques such as qualitative risk analysis, which relies on subjective judgment to categorize and prioritize risks, or quantitative analysis, which employs data, statistics, and modeling (like Monte Carlo simulations2) to estimate the actual financial or operational consequences. The evaluation step then compares the estimated severity against your organization's risk appetite and tolerance, helping to decide which risks are acceptable and which require immediate attention and action. This also ties into prioritization, ensuring resources are focused on the most critical exposures.
1.1.1.3 Control and Mitigate Risks
This step in the journey is where the insight gained in the second step translates into action, focusing on actively reducing or managing identified threats. Risk control methods can involve several strategic approaches, including eliminating or avoiding the risk altogether by removing its source, such as discontinuing a hazardous process, or reducing the likelihood or impact of the risk through measures like strengthening cybersecurity protocols or cross-training staff, transferring the risk to a third party, often through purchasing insurance or outsourcing a risky task to an expert vendor, or accepting the risk, but only after consciously acknowledging it and preparing contingency plans.
1.1.1.4 Monitor and Review Risks
Risk management requires continuous vigilance through risk monitoring strategies that track key indicators and performance metrics to spot early warning signs and ensure that existing controls remain effective. This ongoing process can include regular risk reviews to assess changes in the risk profile, continuous Data Collection using systems or dashboards for real-time insights, incident and near-miss analysis to learn from what almost went wrong, incorporating stakeholder feedback to identify blind spots, and maintaining a dynamic risk register that is regularly updated.
1.1.2 Cultivating a Resilient Organization
For risk management to work, it must be a team sport, not merely a "back-office" function. A strong risk culture successfully balances the pursuit of opportunities with the protection of the organization's value. This involves fostering accountability at all levels, encouraging effective challenges to current practices, and promoting collaboration and open communications across departments. Leaders should ensure everyone is informed of potential risks, invited to contribute their knowledge, and included in the mitigation process.
To foster this culture of risk management, robust governance is crucial, meaning responsibilities for risk management must be clearly defined and assigned. Corporate practice teaches that organizations should appoint a person with the remit for a specific risk (the "risk owner") and a person responsible for monitoring and mitigating that risk (the "risk manager").
Effective board engagement involves clearly defining oversight roles, understanding risk information, assessing strategic risks, and ensuring the risk management system has sufficient resources. Leaders should also be "wayfinding," providing clear narratives about emerging trends (like AI) to help faculty and staff embrace new technologies and manage associated risks effectively. The risk management function itself needs effective positioning within the organization, ideally led by a Chief Risk Officer who is viewed as a peer to other business leaders and has a direct reporting line to the board.
A resilient culture of risk management also relies on data-driven approaches. These kinds of approaches can include integrating automatic data feeds and leveraging tools like artificial intelligence, which can help track performance and predict changes, ensuring decisions are based on reliable reference points.
Finally, the risk landscape is constantly changing, so risk management must be dynamic. Organizations should appreciate the benefits of trial and error, as complex problems are often best tackled by being willing to change and start afresh, exhibiting ambidexterity, agility, and resilience. Finally, there is no wrong time to enhance risk management capabilities; in fact, working to improve during challenging times can make an organization emerge stronger than before. Implementing appropriate incentives that reward desired risk behaviors is also critical to reinforce this continuous improvement.
This comprehensive approach, weaving together identification, analysis, control, and continuous monitoring, supported by a strong culture, leadership, data, and adaptability, truly prepares an organization for the future.
1.2 Background on the NIST Cybersecurity Framework
On February 12, 2013, US President Barack Obama issued an executive order, Improving Critical Infrastructure Cybersecurity, that gave the Department of Commerce's National Institute of Standards and Technology (NIST) one year to gather cybersecurity standards, best practices, and guidelines and develop a voluntary cybersecurity framework to strengthen the cyber protections of critical sectors.3
One year later, NIST unveiled the framework, which has gone through two subsequent iterations.4 The first update, CSF 1.1, was released in April 2018 and included, among other things, enhanced guidance on supply chain security, more clarity on what it means for an organization to comply with the CSF and updated informative references.5
The second iteration following the initial CSF, NIST CSF 2.0, was released in February 2024.6 This latest version of the CSF, among other things, delves even more extensively into the challenging topic of supply chain security, updates the informative references again, offers implementation examples to explain how organizations can comply with the CSF and most significantly, adds a new function category, Govern, which touches on all the other categories in the framework.
The following overview of the CSF relates to the 2.0 version. The CSF itself is composed of what NIST calls a Core, or a group of cybersecurity "outcomes," or desired end-states, grouped by Functions, Categories, and Subcategories, organized according to tiers and supplemented by informative references and implementation examples (Figure 1.1).
Figure 1.1 NIST CSF core.
1.2.1 Six Basic Functions
Each of the six core functions in the NIST framework-except for the Govern function-should be viewed as stand-alone groupings of related "outcomes" or desired results that organizations should achieve in their security programs (Figure 1.2). Because every organization is different and faces different threat models, achieving the...
