CYBER-06-001-P · Primer — The NIST Cybersecurity Framework

The idea in one sentence

The NIST Cybersecurity Framework organizes everything a security program does into six functions — Govern, Identify, Protect, Detect, Respond, and Recover — so an organization can talk about cyber risk in one shared language.

Why it exists

Before the framework, "are we secure?" had no common answer. The board asked in dollars, the SOC answered in alerts, the auditor answered in controls, and none of them mapped to each other. In 2013 a U.S. executive order asked NIST to build a voluntary, risk‑based common language for critical infrastructure; CSF 1.0 shipped in 2014, and CSF 2.0 in February 2024 widened it to organizations of every size and sector. The point was never a new list of controls — SP 800‑53 already has hundreds. Think of it like a family recipe book: each household (hospital, bank, water utility) writes down the same six steps for a dish, then each chef can compare their version (Current Profile) to the master recipe (Target Profile) without arguing over ingredients. The shared map lets everyone describe their security posture in the same six words, roll it up to executives, and compare where they are today (a "Current Profile") against where they need to be (a "Target Profile").

How it works

The framework has three parts. The Core is the heart: six Functions — Govern, Identify, Protect, Detect, Respond, Recover — each broken into Categories and Subcategories that name outcomes, not products. Read them as a story: Govern sets risk strategy, roles, and policy (new in 2.0, and it wraps the other five); Identify inventories your assets, data, and risks; Protect puts up the safeguards — access control, training, encryption; Detect finds the events a SIEM and EDR surface; Respond runs the incident — triage, contain, communicate; Recover restores service and folds lessons back in. Tiers (1–4, Partial to Adaptive) describe how mature and repeatable your risk practices are. Profiles apply the Core to your actual business: a Current Profile is where you stand, a Target Profile is where you're going, and the gap between them is your roadmap.

A concrete worked example: a midsize retailer with $50 M annual revenue maps its current state. In the Identify function it records 1,200 assets, of which 300 are high‑value POS devices. Its current Subcategory "Asset inventory is maintained" is at Tier 2 (Risk‑informed). The target is Tier 3 (Repeatable) requiring quarterly automated scans that cost $12 k per year. In Protect, the retailer currently encrypts data at rest for 40 % of databases; the Target Profile calls for 100 % encryption, an additional $8 k licensing expense. Summing the gaps across all six functions yields a $45 k investment plan and a projected 15 % reduction in breach likelihood, which the board can evaluate against the $2 M potential loss from a data breach. This numeric illustration shows how the Core, Tiers, and Profiles translate abstract outcomes into concrete budgeting and risk‑reduction numbers.

See it — the six CSF 2.0 Functions, with Govern wrapping the rest

flowchart LR
  G["GOVERN<br/>risk strategy & roles"] --> I["IDENTIFY<br/>assets & risk"]
  I --> P["PROTECT<br/>safeguards"]
  P --> D["DETECT<br/>find events"]
  D --> R["RESPOND<br/>contain & triage"]
  R --> RC["RECOVER<br/>restore & learn"]
  RC --> I
  G -.->|governs all| P
  G -.->|governs all| D

The one gotcha

CSF is a framework, not a checklist — the biggest mistake is treating its Subcategories as a pass/fail audit and declaring victory when every box is ticked. The Core describes outcomes ("asset inventories are maintained"), and it deliberately never tells you how or how much — that judgment is yours, driven by your risk. Two changes in 2.0 make the point: Govern was added as the sixth function precisely because organizations kept "doing security" without an owner, a risk appetite, or a policy tying it to the business — so the framework now puts strategy above the checklist. And the framework is a loop, not a line: Recover feeds lessons back into Identify. If you treat CSF as a one‑off certification, you may end up with a fully‑checked profile and still have no idea whether you are actually defended.

The one-line takeaway

Six functions, one shared language for cyber risk — govern it, don't just check it.

Where you'll meet it

CSF is the backbone your daily tools quietly plug into. Your OpenSearch, Grafana Loki, or Graylog SIEM (built on rules from Wazuh and Sigma) and your osquery, Velociraptor, or Wazuh EDR live in the Detect function; Sigma rules and the MITRE ATT&CK Navigator sharpen that detection; TheHive and Cortex run Respond. When you write an incident-response plan you'll reach for NIST SP 800-61; when you map a control you'll cross-reference SP 800-53; when CISA publishes an advisory it's tagged to CSF functions so you know which part of your program to touch. Learn the six words and every alert, runbook, and audit finding you meet has a place to live.

Named concepts: NIST CSF, CSF Functions, Govern