Glossary term
NIST Cybersecurity Framework (NIST CSF)
Subject: Technology, Cyber and Data, Information Security Frameworks
Also known as: CSF, Cybersecurity Framework
The NIST Cybersecurity Framework is a voluntary guide from the US standards body NIST that groups cyber risk activities into functions such as Identify, Protect, Detect, Respond and Recover, so any organisation can plan and measure its security.
Explanation
The framework was first published in 2014 for operators of critical infrastructure in the United States and is now used by firms of all sizes and in many countries. It is not a certification and does not tell an organisation which tools to buy. Instead it sets out outcomes, such as knowing what assets you hold or being able to restore systems after an attack, and leaves the method to the user. Early versions had five functions: Identify, Protect, Detect, Respond and Recover. Version 2.0, released in 2024, added a sixth, Govern, to place cyber risk in the hands of senior leadership. Organisations compare their current profile with a target profile and plan the gap. Boards and regulators often borrow its function names to describe cyber maturity, giving them a shared vocabulary.
Example
A logistics company maps its controls to the framework and finds strong Protect measures but little Detect or Recover capability. Backups are never tested and nobody watches network alerts after hours. The security lead presents the gap to the board and secures funding for monitoring and a restore test each quarter.
Not to be confused with
- ISO/IEC 27001
- The NIST framework is a voluntary outcome guide with no certificate. ISO/IEC 27001 is a management system standard that an auditor can certify.