NIST CSF 2.0 Through a Beginner’s Lens: Beyond the Framework
Recently, I gave a good read of the NIST CSF framework, a framework designed to help organizations of any size and sector (including industry, government, academia, and non-profit). There, I discovered some facts about the CSF. Some of them contradicted my assumptions, and some of them fascinated me.
Some facts that contradicted my assumptions.
When I first learned about CSF, I thought NIST CSF would be a type of framework that would explicitly list every step: “What to do and what not to do, and if this happens, use this tool.” But when I actually read the NIST CSF official documentation, CSF does this instead.
- CSF translates complex cybersecurity outcomes into general terms so a broad audience can understand them, regardless of security expertise.
- It does not prescribe how to achieve an outcome; rather, it assists its users in learning and selecting specific outcomes as per requirements. It primarily gives suggestions on how those outcomes may be achieved and how CSF can be adopted by providing online resources. (namely, informative resources and implementation examples, quick short guides, and community profiles and organizational profile templates).
- The CSF is a guide not only intended for cybersecurity professionals. It can be used by anyone involved in managing risk — from tech professionals all the way to lawyers — to guide their cybersecurity decisions.
- CSF is not only for cybersecurity risk management. It can be directly plugged into the ERM (Enterprise Risk Management) strategy. It can also deal with other risks of the enterprise, such as financial, privacy, reputational, supply chain, and physical risks, etc.
- The CSF is not a one-size-fits-all approach nor a rigid step-by-step plan. Because every organization has unique missions, objectives, and risk appetites, the framework supports a flexible, tailored implementation.
Facts that fascinated me and ideas I’d carry into my own work:
Some of the facts that really fascinated me are the segmentation of overall security outcomes, the creation of an organizational profile that involves the participation of people at each level of hierarchy and authority, and the setting of milestones to improve continuously.
You will find an infinite number of excellent articles out there on the internet that will explain the components of NIST CSF. But this article is just an analysis by a beginner in this field.
So let’s go through what I think about the components of the NIST CSF 2.0.
Please note: Officially, NIST CSF has 3 components: CSF Core, CSF Organizational Profile, and CSF Tiers. But CSF provides a vast number of different types of online resources and documentation.
So I thought the online resources should be the 4th component of CSF. CSF is not a mandatory framework, and referring to the online resources is not compulsory either. However, referring to well-documented examples and guides should be treated as a core component or process in the framework, as it gives an organization a solid base and guidance for creating its security processes.
So my version of CSF has 4 components:
CSF CORE: It classifies overall security outcomes into high-level cybersecurity outcomes to help manage cybersecurity risks. The core components are a hierarchy of functions, categories, and subcategories. (Broader → Specific)
The NIST CSF documentation states that each function is divided into categories, which are related cybersecurity outcomes that comprise the function. Subcategories further divide each category into more specific outcomes of technical and management activities.
The same old OG technique for breaking down a complex problem into smaller chunks and working on it.
For example, Identity (ID) is a function where an organization’s current cybersecurity risks, assets, and improvement opportunities are identified. — → Asset Management (ID.AM) is a category where assets are identified and managed according to their relative importance and ID.AM-01 is a subcategory where inventories of hardware managed by the organization are maintained.
A proper list of all the functions, categories, and subcategories is already listed in the official documentation, which makes referring to NIST CSF easier.
CSF Organizational Profile: There is a well-defined process for creating an organization’s current security posture and setting its target security posture.
CSF Tiers: Describes the strictness of an organization’s cybersecurity risk governance and management practices and provides context for how an organization views cybersecurity risk and the processes.
Tier 1: Partial, Tier 2: Risk-informed, Tier 3: Repeatable, and Tier 4: Adaptive. Organizations should select a Tier that reflects their cybersecurity risk management needs and operating environment. Moving toward a higher tier can be beneficial when it meaningfully improves the organization’s ability to manage cybersecurity risks.
CSF Online Resources: Resources that provide additional guidance and help an organization to understand, adopt, and use the CSF.
A. Informative Resources
B. Implementation Examples
C. Quick-Start Guides
D. Community Profiles and Organizational Profile Templates
To me, these online resources are the real treasure. They remind me of self-help books that capture an author’s knowledge and lifelong experience or grammar books that guide someone as they write an article. Similarly, NIST’s supporting resources provide informative references, implementation examples, guides, and templates that help organizations translate cybersecurity outcomes into practical actions.
Rather than starting from scratch, organizations can use these resources as a foundation and adapt them to their own requirements.
By following all these 4 components, an organization can understand, assess, prioritize, and communicate cybersecurity risk.
Get Raj Pallab Deka’s stories in your inbox
Join Medium for free to get updates from this writer.
One more thing I liked in the official NIST CSF documentation is the openness and abundant availability of room for collaboration. It is stated that CSF works best when used in combination with other established cybersecurity risk management and assessment frameworks, privacy risk management frameworks, supply chain risk management frameworks, and frameworks that manage risk from emerging technologies like artificial intelligence, etc
My favorite part of NIST CSF
Communication is the key factor when a diverse group of people is working for the same goal.
The most interesting part I found about NIST CSF is the organizational profile. Not the concept of the component itself, but the process involved in evaluating the organizational profile. It elevates risk management communication to another level. It indirectly creates a flow between people from different fields, combining them to work on a shared goal.
CSF enables bidirectional information flow between executives, managers, and practitioners.
Executives—People who focus on the organization’s priorities and strategic direction
Managers—People who manage specific cybersecurity risks.
Practitioners—People who implement and operate the technologies.
So an information flow chart popped into my mind between the executive, managers, and practitioners to create or evaluate an organizational profile.
PHASE 1: A discussion and evaluation of the organization’s status.
The governance function was introduced in the NIST CSF version 2.0 and comes into play; it promotes organizational risk communication among executives. This involves cybersecurity-related discussions on organizational objectives, risk direction, resources, risk management strategies, roles, responsibilities, authorities, policies, etc.
After that, based on the discussion, executives set the cybersecurity priorities and objectives.
PHASE 2: Setting and stating expectations (executives to managers)
Risk appetite, accountability, resources, and overall cybersecurity objectives are communicated by executives to managers.
Executives communicate the target profile to the managers.
PHASE 3: Setting the plan to hit specific cybersecurity goals.
Managers create a plan to achieve the target profile through controls, collaboration, and tasks.
PHASE 4: Ground-level implementation.
Practitioners help plan, carry out, and monitor specific cybersecurity activities.
PHASE 5: Repeat
After the ground-level implementation, practitioners provide managers and executives with information to understand the organization’s security posture to make informed decisions and maintain or adjust risk strategies accordingly.
All the phases are repeated once again.
So this is not a one-time process; it’s a process that is followed consistently to strengthen overall security posture.
Conclusion
So this was my thought on NIST CSF, an easy-to-adopt framework that is very collaborative in nature. Even if not implemented, just reading the official documentation can provide a great blueprint for an organization’s risk governance and management strategy.
I believe NIST CSF 2.0 should be strongly considered as a baseline reference when designing or improving an organization’s cybersecurity risk management processes, even when the organization does not formally adopt the framework.
But there is a question that arose while drafting the conclusion of this article: Is it practically feasible for a small-sized organization to adopt and implement this versatile framework?
Next, I will implement the NIST CSF in a real-world scenario and document my experience.
References:
- Official documentation of NIST CSF 2.0 — https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
About me:
I am currently working as a network field engineer and a cybersecurity enthusiast.
I learn by doing: building and breaking things, running labs, coding, reading, and analyzing cybersecurity concepts, frameworks, and real-world incidents.
Documenting what I learn along the way.
🔗 LinkedIn: https://www.linkedin.com/in/raj-pallab-deka-604b33276/
💻 GitHub: https://github.com/RajPallabDeka
📧 rajdeka.official@gmail.com
