Press Release
NIST CSF
CBIZ Pivot Point Security has helped hundreds of organizations of all sizes understand their cybersecurity posture utilizing the NIST Cybersecurity Framework (CSF). We utilize risk assessments, gap analysis, maturity modeling and more to help organizations understand their current and target cybersecurity goals.
The NIST CSF is a set of guidelines and best practices designed to help organizations manage and reduce cybersecurity risks. It was developed by the National Institute of Standards and Technology (NIST) in response to Executive Order 13636, issued in 2013, which called for improving critical infrastructure cybersecurity.
The NIST CSF is designed to be flexible and adaptable, allowing organizations of all sizes and across all sectors to apply the framework to their specific needs and circumstances. It promotes a continuous improvement approach to managing cybersecurity risks and encourages collaboration between public and private sectors.
The latest version of the framework, version 2.0 was released on February 26th, 2024, and expanded the framework to include a Governance function. Overall, NIST CSF 2.0 builds on the foundation of the original framework, aiming to provide more comprehensive, flexible, and up-to-date guidance for managing cybersecurity risks in an increasingly complex and interconnected world. CSF 2.0 offers improved tools and methodologies for measuring cybersecurity performance and assessing the effectiveness of cybersecurity practices. This helps organizations to better evaluate their cybersecurity posture and make data-driven improvements.
This provides a set of cybersecurity activities, outcomes, and references that are common across all business sectors. The Framework Core consists of six high-level functions:
-
- Govern: Emphasizes the importance of governance and the role of executive leadership in managing cybersecurity risks. This includes clear guidance on integrating cybersecurity into organizational governance structures and decision-making processes.
- Identify: Develops an organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.
- Protect: Develops and implements appropriate safeguards to ensure the secure delivery of technology services.
- Detect: Develops and implements appropriate activities to identify the occurrence of a cybersecurity event.
- Respond: Develops and implements appropriate activities to take action regarding a detected cybersecurity event.
- Recover: Develops and implements appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.
Implementation Tiers
The NIST CSF Implementation Tiers provide context on how an organization views cybersecurity risk and the processes in place to manage that risk. They help organizations understand their cybersecurity maturity and guide them in enhancing their cybersecurity practices. There are four Implementation Tiers in the NIST CSF, ranging from Tier 1 (Partial) to Tier 4 (Adaptive).
- Tier 1: Partial
- Characteristics: The organization has a limited understanding of cybersecurity risk. Practices are often reactive and ad hoc. There is minimal awareness of risks, and cybersecurity efforts are typically uncoordinated and unplanned.
- Key Aspects: Risk management practices are sporadic, and there is little or no formal documentation or processes in place. Responses to incidents are typically reactive rather than proactive.
- Tier 2: Risk Informed
- Characteristics: The organization has some awareness of cybersecurity risks and has begun to implement basic risk management practices. These practices are more structured and repeatable than in Tier 1, but they may still be reactive.
- Key Aspects: Risk management practices are informed by some policy and procedure, and there is a basic understanding of risk tolerance. There is a stronger focus on identifying and managing risks but with limited integration into the overall business strategy.
- Tier 3: Repeatable
- Characteristics: The organization has established risk management processes that are consistently implemented and tracked. There is a proactive approach to cybersecurity, with practices becoming more formalized and integrated into the organization’s operations.
- Key Aspects: Risk management practices are repeatable and documented, with regular assessments and reviews. The organization has a well-defined strategy for managing cybersecurity risks, and there is a focus on continuous improvement and resilience.
- Tier 4: Adaptive
- Characteristics: The organization has a sophisticated, integrated, and adaptive approach to managing cybersecurity risks. Practices are dynamic and resilient, allowing the organization to anticipate and respond to emerging threats effectively.
- Key Aspects: Risk management practices are advanced, with a high degree of integration across the organization. The organization uses threat intelligence and data-driven insights to anticipate and mitigate risks. Cybersecurity is fully embedded into the organization’s culture and decision-making processes.
Each tier represents a progression in the organization’s maturity and capability to manage cybersecurity risks effectively. By understanding and working toward higher tiers, organizations can enhance their cybersecurity posture and resilience against threats.
The NIST CSF 2.0 Framework Profile is a tool that helps organizations align their cybersecurity activities with their business requirements, risk tolerance, and resources. The profile serves as a customized roadmap for managing cybersecurity risks, enabling organizations to identify and prioritize improvements in their cybersecurity posture.
Key Components of the NIST CSF 2.0 Framework Profile:
- Current Profile: This represents the organization’s existing cybersecurity practices and the current state of its cybersecurity posture. It includes the outcomes and activities that the organization is presently undertaking to manage cybersecurity risks.
- Target Profile: This defines the desired state of the organization’s cybersecurity posture. It outlines the outcomes and activities the organization aims to achieve in order to effectively manage cybersecurity risks in alignment with its business objectives and risk management strategy.
- Gap Analysis: By comparing the Current Profile with the Target Profile, CBIZ Pivot Point Security helps organizations identify gaps in their cybersecurity practices. This analysis highlights areas where improvements are needed to reach the desired level of cybersecurity maturity.
- Action Plan: Based on the gap analysis, organizations can develop a prioritized action plan to address identified gaps. The plan includes specific steps, timelines, and resources required to implement improvements and achieve the Target Profile.
Benefits of Using the NIST CSF 2.0 Framework Profile:
- Customization: The profile is tailored to the specific needs, objectives, and risk tolerance of the organization. This ensures that the cybersecurity efforts are relevant and aligned with business goals.
- Prioritization: By identifying gaps and creating an action plan, organizations can prioritize their cybersecurity investments and efforts, focusing on the most critical areas first.
- Continuous Improvement: The profile encourages ongoing assessment and improvement of cybersecurity practices. Organizations can regularly update their profiles to reflect changes in the threat landscape, business environment, and technological advancements.
- Communication: The profile provides a clear and structured way to communicate the organization’s cybersecurity posture and improvement plans to stakeholders, including executives, board members, and regulatory bodies.
- Resource Allocation: By understanding the current and target states, organizations can better allocate resources, ensuring that investments in cybersecurity are efficient and effective.
How We Develop a NIST CSF 2.0 Framework Profile:
- Assessment: CBIZ Pivot Point Security conducts a thorough assessment of the organization’s current cybersecurity practices, using the NIST CSF’s Core Functions (Govern, Identify, Protect, Detect, Respond, Recover) as a guide.
- Define Goals: We help you establish clear and measurable cybersecurity goals that align with the organization’s business objectives and risk tolerance.
- Create Profiles: We develop your Current Profile by documenting existing practices and the Target Profile by defining desired outcomes and activities.
- Analyze Gaps: We perform a gap analysis to identify discrepancies between the Current and Target Profiles.
- Develop Action Plan: We assist with the creation of a detailed action plan to address the gaps, including plans of action and milestones (POAMS).
- Implement and Monitor: This allows you to then execute the action plan, monitor progress, and adjust as necessary to ensure continuous improvement and alignment with the Target Profile.
CBIZ Pivot Point Security uses these methodologies to help organizations effectively measure their current cybersecurity posture and better manage cybersecurity risks.
Who should implement NIST CSF
NIST is not a regulatory agency, and most organizations use the CSF on a voluntary basis. The new CSF 2.0 edition is tailored to be applicable to all audiences, industry sectors, and organization types, from small schools and nonprofits to large agencies and corporations, regardless of their level of cybersecurity expertise. The CSF maps to many other frameworks as well and can be used in conjunction with other regulatory, contractual or statutory requirements.
2024 State of The Cybersecurity Industry Report ResultsÂ