The National Institute of Standards and Technology, usually called NIST, is an agency that is part of the U.S. Department of Commerce. NIST provides guidelines on managing cybersecurity risk for information systems.
A multi-year collaborative effort, the NIST Cybersecurity Framework (NIST CSF) was released in 2014 under an executive order from President Barack Obama. A subsequent executive order, issued in 2017 by President Donald Trump, made compliance with the NIST CSF mandatory for all federal government agencies and all entities in their supply chain.
“To promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.”
NIST core mission
The NIST Cybersecurity Framework was initially to improve the security of U.S. critical infrastructures, defined as the assets, systems, and functions deemed vital. It defines 16 critical infrastructure sectors, including:
- Chemical
- Commercial facilities
- Communications
- Critical manufacturing
- Dams
- Defense industrial base
- Emergency services
- Energy (including utilities)
- Financial services
- Food and agriculture
- Government facilities
- Healthcare companies and public health
- Information technology
- Nuclear reactors, materials, and waste
- Transportation systems
- Water and wastewater systems
The U.S. government subsequently adopted the NIST Cybersecurity Framework as a mandatory standard to regulate security for all federal information systems in 2017.
While not mandatory for non-federal agencies and providers, the best practices, standards, and recommendations set forth in the NIST Cybersecurity Framework are also widely used to identify, detect, and respond to cyber attacks.
In addition, guidelines in the framework are also used to prevent and recover from an attack. Using the NIST Cybersecurity Framework helps non-federal organizations ensure the optimal security of systems and assures the public of their commitment to security.
The framework describes outcomes to prioritize and mitigate cybersecurity risk. Categories and subcategories include more specific technical and management outcomes that support security practices and incident response plans.
Updates to NIST CSF 2.0
Version 2.0 represents the first major update to the NIST Cybersecurity Framework. It was released in February 2024. Key drivers for the update were a desire to:
- Align and integrate with other NIST frameworks, such as the NIST Privacy Framework, NIST Risk Management Framework (RMF), and the NIST Secure Software Development Framework (SSDF)
- Broaden the applicability of the NIST CSF from critical infrastructure to all organizations regardless of sector, size, or maturity level
- Emphasize supply chain risk, cybersecurity governance, and implementation
- Enable organizations to customize the framework to suit their needs and prioritize actions based on risk, then transition from planning to action more easily
Journey to NIST CSF 2.0
The journey to NIST CSF 2.0 reflects a decade of evolving cybersecurity challenges and lessons learned. NIST CSF 2.0 supports a more holistic, risk-informed approach to cybersecurity. Though it is not specifically designed to strengthen cyber resilience, it can help organizations understand and evaluate their cyber resilience and better align security efforts with business objectives.
Identify, protect, detect, respond, recover, and govern
The five core functions established in the original NIST Cybersecurity Framework did not change between Version 1.0 and Version 2.0. They remain Identify, Protect, Detect, Respond, and Recover. NIST CSF 2.0 includes a new core function, Govern. The new Govern function was added to emphasize the importance of governance in managing cybersecurity risk.
Govern
Establish, communicate, and monitor cybersecurity risk management strategy , expectations, and policy. Included in this function are:
- Organizational context (GV.OC)
- Risk management strategy (GV.RM)
- Roles, responsibilities, and authorities (GV.RR)
- Policy (GV.PO)
- Oversight (GV.OV)
- Cybersecurity supply chain risk management (GV.SC)
Identify
Identify and assess cybersecurity risks to systems, assets, data, and resources. Included in this function are:
- Asset management (ID.AM)
- Risk assessment (ID.RA)
- Improvement (ID.IM)
Protect
Controls and procedures are applied to safeguard the organization’s assets. Included in this function are:
- Identity management, authentication, and access control (PR.AC)
- Awareness and training (PR.AT)
- Data security (PR.DS)
- Platform security (PR.PS)
- Technology infrastructure resilience (PR.IR)
Implementation tiers of NIST CSF
The NIST Cybersecurity Framework Implementation section includes four tiers that describe the degree to which an organization has implemented NIST controls and how closely its cybersecurity risk management practices follow the guidelines.
- Tier One—Partial
At Tier One, organizations may not have cybersecurity coordination or processes. Tier One organizations do not prioritize cybersecurity. - Tier Two—Risk-informed
Organizations at Tier Two of the NIST Cybersecurity Framework are aware of some risks and plan to respond to them to meet compliance requirements. However, despite these efforts, Tier Two organizations may not be aware of or addressing all security concerns quickly enough. - Tier Three—Repeatable
Tier Three organizations have clearly defined and regularly repeatable cybersecurity processes. These organizations have executive support for implementing risk management and cybersecurity best practices. Organizations that have reached Tier Three are prepared to address cybersecurity risks and threats as well as identify and remediate vulnerabilities in their environments. - Tier Four—Adaptive
At the top tier of the NIST Cybersecurity Framework, Tier Four organizations proactively implement and upgrade cybersecurity measures. These organizations use advanced adaptive cybersecurity practices to continuously assess risky behaviors and events to help protect from or adapt to threats before they happen.
Steps to implement NIST CSF
Implementing the NIST Cybersecurity Framework involves a series of strategic and operational steps. The process is designed to be flexible so that it can be used by organizations of all sizes and sectors. The main steps to implement the NIST CSF are:
- Establish leadership and governance, including:
o Identifying key stakeholders and getting executive buy-in
o Defining roles and responsibilities for cybersecurity governance
o Setting cybersecurity policies, risk tolerance, and objectives aligned with business goals - Understand the organization’s context, including:
o Identifying critical assets, data, systems, and business processes
o Understanding internal and external threats, vulnerabilities, and legal/regulatory requirements - Create a CSF Profile, which includes:
o Describing the organization’s cybersecurity current state and target state
o Reviewing applicable Community Profile for guidance - Conduct a gap analysis, including:
o Comparing the current profile to the target profile
o Identifying gaps in the CSF functions, categories, and subcategories - Develop and implement an action plan, including:
o Creating a roadmap with milestones, timelines, roles, and responsibilities
o Implementing security controls, process changes, or technology updates to close identified gaps
o Using the Implementation examples provided in the NIST CSF for guidance - Measure and monitor, including:
o Defining metrics and KPIs to track progress toward the Target Profile
o Conducting continuous monitoring of threats, vulnerabilities, and control effectiveness.
o Adjusting strategies and controls as the organization and threat landscape evolve - Communicate and review regularly, including:
o Sharing progress and updates with executives, stakeholders, and teams
o Periodically reassessing the NIST CSF Profile, especially after significant business or IT changes, security incidents, and regulatory updates
Getting started with the NIST Cybersecurity Framework
The NIST Cybersecurity Framework is one of the most widely employed cybersecurity frameworks in the U.S. However, it takes effort to implement. In addition to understanding the core functions and developing an implementation plan, it is also important to review the relevant Community Profile and examples of other NIST CSF implementations.
NIST Cybersecurity Framework use cases
Common use cases for the NIST Cybersecurity Framework (CSF) include using it to guide:
- Risk management—how to identify, assess, and prioritize cybersecurity risks to enable informed decision-making and resource allocation
- Cybersecurity program development—a foundation for building or enhancing a cybersecurity program, aligning security activities with business objectives
- Compliance and regulatory alignment—cybersecurity practices mapped to various standards (e.g., NIST SP 800-53, ISO/IEC 27001) to streamline compliance efforts
- Supply chain risk management—how to evaluate and manage third-party and vendor risks
- Communication—a common language supports clear communication between technical teams, executives, and stakeholders
- Continuous improvement—an outcome-driven approach to measure progress, adapt to changing threats and mature their cybersecurity posture over time
NIST Cybersecurity Framework examples
In addition to the NIST Cybersecurity Framework, NIST has produced more than 200 special publications focusing on specific cybersecurity risk management areas, such as risk assessments, identity access control, managing protective technology, and responding to cybersecurity events or incidents. Examples of the most frequently used NIST Cybersecurity Framework publications include the following.
NIST Special Publication (SP) 800-30
NIST SP 800-30, a Guide for Conducting Risk Assessments, provides guidance for cyber risk assessments and management. It includes controls and control baselines based on industry recommendations and standards. NIST SP 800-30 also helps organizations present cyber risk in a way that leadership teams can understand.
NIST Special Publication (SP) 800-37
NIST SP 800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, describes the Risk Management Framework (RMF). It also provides guidelines for applying the RMF to information systems and organizations. NIST SP 800-37 includes a detailed, six-step process for managing security and privacy risks.
NIST Special Publication (SP) 800-53
NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations, provides the controls required to implement the NIST Cybersecurity Framework. NIST SP 800-53 has over 1,000 controls across twenty control families.
By implementing the security controls set forth in NIST 800-53, organizations meet Federal Information Security Modernization Act (FISMA) security requirements. In addition, implementing NIST 800-53 controls meets Federal Information Processing Standard Publication 200 (FIPS 200) requirements, which are mandatory for all federal agencies and entities in their supply chain.
NIST Special Publication (SP) 800-122
NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), provides recommendations for handling PII (Personally Identifiable Information). It offers practical, context-based guidance for identifying PII.
NIST SP 800-122 also guides determining what level of protection is appropriate for each instance and recommends safeguards. In addition, NIST SP 800-122 provides direction for developing response plans for breaches involving PII.
NIST Special Publication (SP) 800-125
NIST SP 800-125, Guide to Security for Full Virtualization Technologies, provides recommendations for addressing the security challenges related to full server and desktop virtualization technologies. NIST 800-125 defines virtualization for government use and outlines requirements for securing hardening and provisioning virtual systems.
NIST Special Publication (SP) 800-171
Under NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, compliance is mandatory for every organization contracting with the U.S. Department of Defense (DoD). It covers all nonfederal information systems and organizations that are DoD contractors and process, store, or transmit Controlled Unclassified Information (CUI). Under NIST SP 800-171, these entities must meet the minimum security standards established by the Defense Federal Acquisition Regulation Supplement (DFARS) to retain their DoD contracts.
NISTIR 8170
Another NIST publication, NISTIR 8170, Approaches for Federal Agencies to Use the Cyber Security Framework, details eight approaches for using the NIST Cybersecurity Framework.
- Integrate enterprise and cybersecurity risk management by communicating with universally understood risk terms.
- Manage cybersecurity requirements using a construct that enables integration and prioritization of requirements.
- Integrate and align cybersecurity and acquisition processes by relaying requirements and priorities in common and concise language.
- Evaluate organizational cybersecurity using a standardized and straightforward measurement scale and self-assessment criteria.
- Manage the cybersecurity program by determining which outcomes necessitate common controls and apportioning work and responsibility for those outcomes.
- Maintain a comprehensive understanding of cybersecurity risk using a standard organizing structure.
- Report cybersecurity risks using a universal and understandable structure.
- Inform the tailoring process using a comprehensive reconciliation of cybersecurity requirements.
DISCLAIMER: THE INFORMATION CONTAINED IN THIS ARTICLE IS FOR INFORMATIONAL PURPOSES ONLY, AND NOTHING CONVEYED IN THIS ARTICLE IS INTENDED TO CONSTITUTE ANY FORM OF LEGAL ADVICE. SAILPOINT CANNOT GIVE SUCH ADVICE AND RECOMMENDS THAT YOU CONTACT LEGAL COUNSEL REGARDING APPLICABLE LEGAL ISSUES.
