WindlassConsulting

What is the NIST Cybersecurity Framework? CSF 2.0 explained

  • NIST CSF
  • Standards
  • Cybersecurity governance
  • OT security

The NIST Cybersecurity Framework, usually shortened to CSF, is a voluntary framework for organizing and describing a cybersecurity program. It doesn’t prescribe specific technical controls. What it gives you is a common structure for what the program covers, where it stands today and where it wants to be. Version 2.0 came out in February 2024.

Where it came from

Executive Order 13636 (February 2013) directed NIST to develop a voluntary framework for reducing cyber risk to critical infrastructure. NIST published version 1.0 on February 12, 2014, and version 1.1 followed in 2018. Through 1.1 the document was titled the Framework for Improving Critical Infrastructure Cybersecurity. CSF 2.0 dropped that title, was written for organizations of every size, and added a sixth function.

The six functions

The core is six functions. Each divides into categories and subcategories that describe outcomes:

  • Govern: set the organization’s cybersecurity strategy, expectations, roles and policy, and oversee how well they are carried out.
  • Identify: understand the assets, suppliers and risks the program has to manage.
  • Protect: put safeguards in place to reduce the likelihood and impact of an incident.
  • Detect: find and analyze possible attacks and compromises.
  • Respond: take action once an incident is detected.
  • Recover: restore the assets and operations an incident affected.

Version 2.0 added Govern. NIST describes it as covering strategy, expectations and policy, roles, responsibilities and authorities, and oversight of the strategy. Leadership’s role is now part of the program’s structure.

Profiles and tiers

Two more components turn the core into something you can use.

An organizational profile records the outcomes a program has achieved today (the current profile) and the ones it intends to achieve (the target profile). The gap between them becomes the plan.

Tiers characterize the rigor of an organization’s cybersecurity risk governance and management practices: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). They run from informal, ad hoc responses to approaches that are agile and risk informed. An organization can use them to inform its current and target profiles.

Is it a requirement?

NIST describes the CSF as a framework organizations may adopt voluntarily. A regulator, an insurer or a contract can still point to it. Because it speaks in outcomes and not technology, it also works as a structure for board and executive reporting.

How it fits with OT guidance

The CSF is sector-neutral. It says what a program should accomplish and leaves the how to other documents. For control systems, pair it with OT-specific guidance: NIST SP 800-82 for how OT differs from IT and which controls fit (its Section 6 applies the CSF to OT systems), and IEC 62443 for zone and conduit design and security levels. The Purdue model supplies the network picture those documents map against.

One common arrangement: the CSF gives the program-level view that executives and boards read, and the OT documents supply the engineering detail underneath. What an ICS security assessment covers shows how assessment findings map to the CSF alongside the other frameworks.

What to do with it

Start with a current profile. For each function, note what the program does today and what evidence supports it. Then write the target profile and rank the gaps by operational risk. To see how a pipeline program measures up against the TSA directives, take the Readiness Check.

Sources: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 26, 2024. NIST Cybersecurity Framework for the Quick Start Guides, profiles and informative references. Framework 1.0 release, NIST, February 2014. NIST SP 800-82r3, Section 6.

All posts