What Is the NIST Cybersecurity Framework?

| Posted on |

What Is the NIST Cybersecurity Framework?

When it comes to managing cybersecurity, the landscape is always changing. One year, ransomware may be the biggest threat, and the next it may be credential theft.

If you take a piecemeal approach to IT security, you could find yourself battling data breaches, and needing to get virus removal on employee devices far too often. It’s important to put together a framework that uses best practices to help you protect against all types of threats.

While many small business owners think that cybersecurity is something that “big companies have to worry about,” the fact is that a data breach or ransomware infection can be much more devastating to a small business.

60% of small businesses that fall victim to a cyberattack go out of businesses within 6 months. Also, small businesses are often a target, with approximately 43% of all cyberattacks directed at them.

And this brings us to an important cybersecurity framework that can help small and large businesses alike better manage their IT security risks through a strategy that integrates industry standards and best practices.

The NIST Cybersecurity Framework Explained

NIST stands for the National Institute of Standards and Technology, an entity within the U.S. Department of Commerce.

NIST was founded in 1901 and its mission was to enable innovation during the dawn of the industrial revolution in the U.S. It provides the reliable measurement standards needed to support things like nanoscale devices, computer chips, and more.

It also administers a national Cybersecurity Framework that was used by approximately 30% of U.S. organizations as of 2015 and is projected to reach 50% use in 2020.

Why the NIST Framework Was Created

Data breaches, malware infections, and other types of cyberattacks have only become more dangerous and impactful as government, public, and private organizations have become more dependent upon technology.

In February of 2013, a President issued Executive Order directed NIST to work with stakeholders to develop a voluntary cybersecurity framework. One that would provide guidance through standards, guidelines, and best practices for mitigating cyber risk.

Is NIST Mandatory?

The NIST cybersecurity framework is a voluntary set of guidelines, it’s not mandatory. But it is very helpful to use as a roadmap for a cybersecurity strategy to ensure your business isn’t leaving any gaps in your practices or the technologies that you’re using to protect your network, data, and devices.

Three Main Components

The Cybersecurity Framework contains three main components:

  • Core: A set of desired IT security activities organized into different categories, these include both proactive and reactive strategies.
  • Tiers: Four tiers that represent the different degrees of an organization’s risk management practices: Partial, Risk Informed, Repeatable, Adaptive.
  • Profile: Describes an organization’s safeguards that align with the desired outcomes of the Core activities and can identify vulnerabilities.

The Cybersecurity Framework Mission

The NIST Cybersecurity Framework was designed with a mission to:

  • Be easy to understand and use a common language
  • Be adaptable to multiple industries, lifecycle phases, and technologies
  • Be risk based
  • Be based upon international standards
  • Be a living document that is always being updated as cyberthreats and technology evolve
  • Be guided by multiple perspectives (private sector, education, government, etc.)

Five Framework Core Areas

The Cybersecurity Framework’s Core is where you will find the recommendations as to which activities are recommended to put into place to protect your business. These include everything from doing a cybersecurity risk assessment to recovery planning after a security incident.

Each of the five core areas of the framework include both categories and subcategories to keep activities organized.

The five Core areas of the Framework and their categories are:

  • Identify
    • Asset Management
    • Business Environment
    • Governance
    • Risk Assessment
    • Risk Management Strategy
  • Protect
    • Access Control
    • Awareness & Training
    • Data Security
    • Information Protection Process & Procedures
    • Maintenance
    • Protective Technology
  • Detect
    • Anomalies & Events
    • Security Continuous Monitoring
    • Detection Processes
  • Respond
    • Response Planning
    • Communications
    • Analysis
    • Mitigation
    • Improvements
  • Recover
    • Recovery Planning
    • Improvements
    • Communications

Implementation Tiers

The four implementation tiers offer guidance into the level that an organization decides to undertake cybersecurity activities.

Tier 1 being the lowest level, and Tier 4, the most stringent.

  • Tier 1 – Partial: This is the basic level, where IT security is more reactive than proactive and cybersecurity activities don’t typically have a prioritization to them.
  • Tier 2 – Risk Informed: Cybersecurity activity is informed by priority of business requirements, and best practices may be established but not fully required by the organization.
  • Tier 3 – Repeatable: IT security policies are formally approved and expressed as company policy, strategies are regularly updated and prioritized.
  • Tier 4 – Adaptive: A continuous improvement policy is put into place that focuses on best practices, policies are risk-informed and take an organization-wide approach.

Put a Strong Cybersecurity Framework In Place with Help from C Solutions

There is a lot at risk that comes with each phishing email that makes it into an employee inbox. Make sure your cybersecurity framework has you covered for all types of threats.

Schedule a free cybersecurity consultation today! Call 407-536-8381 or reach us online.