What Is NIST Cybersecurity Framework?

The NIST Cybersecurity Framework organises security activity into a small number of functions, providing a structure for describing and discussing a programme rather than a list of mandatory controls.

Its main practical value is communication. The functions are comprehensible to executives without translation, which makes it the best available vocabulary for board-level discussion of security.

The functions

Govern, added in the 2.0 revision, covering strategy, roles, policy and oversight. Identify — understanding assets, risks and dependencies. Protect — the safeguards.

Detect — finding events. Respond — acting on them. Recover — restoring capability. The addition of governance reflected the observation that programmes fail on oversight at least as often as on controls.

It is voluntary, and widely required anyway

The framework carries no legal force by itself. It is nonetheless referenced in contracts, adopted by regulators as an expected approach, and used by insurers and customers as an assessment structure.

Which means many organisations are effectively required to demonstrate alignment with something described as voluntary — a distinction that matters mainly when deciding how rigorously to evidence it.

Profiles and tiers

A current profile describes what you do today; a target profile describes where you intend to be. The gap between them is the programme, which is a considerably more useful planning artefact than a control checklist.

Tiers describe how rigorous and integrated the risk management approach is, from partial to adaptive. They are not a maturity score to be maximised — the appropriate tier depends on the organisation's risk and resources.

What it does not give you

Specific requirements. The framework says to manage asset inventory, not what your inventory process must contain, which is deliberate and frustrating for anyone wanting a checklist.

Implementation detail comes from the referenced control catalogues and from sector guidance. Using the framework for structure and a control framework for specifics is the workable combination.

Where it is genuinely strong

Board and executive reporting, because six functions are graspable. Mapping to other obligations, because published crosswalks exist for most major frameworks.

And as a structure for a programme roadmap, since the functions expose imbalance — the common finding being heavy investment in protection with very little in detect, respond and recover.

The informative references are the practical part

Each outcome in the framework maps to specific requirements in other control catalogues and standards, which is what turns a high-level function into something implementable.

Those mappings are also what make the framework useful as a translation layer: an organisation subject to several obligations can express its programme in these six functions for leadership while satisfying each specific requirement through the referenced control. That dual use is the strongest argument for adopting it alongside rather than instead of a control framework.

One caution about maturity language: the tiers describe how integrated risk management is, not how good security is, and they are not a score to be maximised. An organisation operating appropriately at a lower tier is in a better position than one claiming a higher tier it cannot evidence.

Where to start

Rate yourself across the six functions in a single sitting, honestly. The imbalance will be obvious and it is usually the right basis for the next year of investment.

See implementing version 2.0. GuardsArm delivers NIST 800-53 services.