The NIST Cybersecurity Framework (CSF) 2.0 Functions, Profiles, Outcomes and Controls

• “Functions organize basic cybersecurity activities at their highest level. These Functions are Identify, Protect, Detect, Respond, and Recover." Using these Functions, organizations can better organize, communicate about and make informed decisions regarding their risk management approaches. Incident response and management leaders can also align the Functions with other best practices and track their investments. 
• “Categories are the subdivisions of a Function into groups of cybersecurity outcomes closely tied to programmatic needs and particular activities.” For instance, as shown in the image below, “Asset Management” would be a Category of the “Identify” Function, and “Recovery Planning” would be a Category of the “Respond” Function.
• “Subcategories further divide a Category into specific outcomes of technical and/or management activities....[which] help support achievement of the outcomes in each Category.” See the image below for examples of Subcategories.
• "Informative References are specific sections of standards, guidelines, and practices common among critical infrastructure sectors that illustrate a method to achieve the outcomes associated with each Subcategory.” The image below shows examples of other common frameworks, such as COBIT 5 and ISO/IEC 27001:2013, that organizations may review when aligning the CSF to their own practices.

From the CSF 1.1 description of the Framework Core, we can infer that the security controls required to secure a computing environment are not the outcome definitions. The controls can (not must) be extracted from the Informative References are provided in Appendix A, Table 2, which contain references to CIS, COBIT, ISA, ISO and NIST controls catalogs and standards. Therefore, an organization may decide to use ISO 27002:2022 controls to achieve specific NIST CSF outcomes. Further, NIST does not restrict controls defined by these bodies as the only ones. Organizations perhaps located in Australia could decide to use their local controls catalog, e.g., Australian Cyber Security Centre Essential 8 Controls, CERT NZ’s critical controls or others.

The CSF 2.0 Evolution

In 2018, NIST published information related to the CSF 1.1 in a single document. Nearly 6 years later, the CSF 2.0 takes a similar approach, but it supplements the primary document with multiple supporting and referenceable documents which clearly articulates their vision and suggested approach. 

Today, the NIST CSF 2.0 abstract states: "The CSF does not prescribe how outcomes should be achieved. Rather, it links to online resources that provide additional guidance on practices and controls that could be used to achieve those outcomes."

Again, outcomes should be mapped directly to a list of potential security controls as listed in the CSF 2.0 Informative References for immediate consideration to mitigate cybersecurity risks. But, in the CSF 2.0, the Informative References table has been removed from the NIST Cybersecurity Framework (CSF) 2.0 document and is available here as a downloadable Excel file or a browsable online file, which are much easier to work with than the original PDF file from the CSF 1.1. 

As with the CSF 1.1, the Informative References tables contain a listing of updated suggested security controls that organizations can select from to associate with the outcomes defined in their CSF Profile definitions. But remember, since CSF now suggests usage of multiple CSF Profiles and provides the Informative References in an easily accessible and extractable file format, the creation of an information security controls baseline has been greatly simplified. So why is this a big deal? 

The 'big deal' is that these baselines can be used for: 

1. Measuring compliance of what an organization is doing to protect its information, rather than simply relying on what it says it is doing
2. Reporting on its CSF Tier value, which reflects the degree of rigor the organization is using to manage its cybersecurity risk - which executive leadership and its board can promote and boost the confidence of its stakeholders and investors

Please refer to the following image to understand how CSF 2.0 Tiers can be used to report on the degree of risk management rigor used as each level of the Core model. You can also see how they are used in combination with CSF Profiles containing the expected outcomes to be achieved by implementing selected security controls from the Information Reference tables included in the CSF 2.0 or other control catalogs as selected by the organization.

Image

Summary