How can you use NIST's Cybersecurity Framework to improve your systems management?

1 Understand the Framework

The NIST's Cybersecurity Framework consists of three parts: the Core, the Implementation Tiers, and the Profiles. The Core is a set of five functions that describe the key activities for effective cybersecurity: Identify, Protect, Detect, Respond, and Recover. Each function has subcategories that provide specific outcomes and informative references that suggest standards and practices. The Implementation Tiers are four levels that indicate the degree of rigor and sophistication of your cybersecurity practices: Partial, Risk-Informed, Repeatable, and Adaptive. The Profiles are customized representations of your current and desired cybersecurity outcomes based on your business objectives, risk appetite, and resources.

2 Assess your Current State

The first step to use the NIST's Cybersecurity Framework is to assess your current state of cybersecurity by creating a Current Profile. A Current Profile is a snapshot of your system's alignment with the Core functions and subcategories. To create a Current Profile, you need to review your system's documentation, policies, procedures, and practices, and map them to the relevant Core subcategories. You also need to determine your current Implementation Tier based on your system's risk management processes, threat environment, legal and regulatory requirements, and business goals.

3 Define your Target State

The second step to use the NIST's Cybersecurity Framework is to define your target state of cybersecurity by creating a Target Profile. A Target Profile is a vision of your system's desired cybersecurity outcomes based on your system's priorities, needs, and challenges. To create a Target Profile, you need to identify the gaps between your Current Profile and your preferred Core subcategories, and prioritize the actions to address them. You also need to select your target Implementation Tier based on your system's desired level of cybersecurity maturity and improvement.

4 Implement the Action Plan

The third step to use the NIST's Cybersecurity Framework is to implement the action plan to achieve your target state of cybersecurity. An action plan is a roadmap that outlines the specific tasks, timelines, responsibilities, and resources to close the gaps between your Current Profile and your Target Profile, and to reach your target Implementation Tier. To implement the action plan, you need to allocate the necessary resources, assign the roles and responsibilities, monitor the progress and performance, and communicate the results and feedback.

5 Review and Update the Framework

The fourth step to use the NIST's Cybersecurity Framework is to review and update the framework periodically to ensure its relevance and effectiveness. The framework is not a one-time exercise, but a continuous process that requires regular evaluation and adjustment. To review and update the framework, you need to measure the impact and value of your cybersecurity practices, identify the changes and trends in your system's environment and requirements, and revise your Profiles, Tiers, and action plan accordingly.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?