Cybersecurity

NIST also describes cybersecurity more briefly as the process of protecting information by preventing, detecting, and responding to attacks. In US government usage, the term replaced information assurance in 2014, and information assurance had earlier replaced information security and computer security. Those older terms are still used, depending on scope and intent.

The NIST Cybersecurity Framework (CSF) 2.0 organizes cybersecurity outcomes under six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern establishes, communicates, and monitors the organization's cybersecurity risk management strategy, expectations, and policy, and it informs how the other five functions are implemented. Identify covers understanding current cybersecurity risks, including assets and suppliers. Protect uses safeguards, with outcomes such as identity management, authentication, and access control; awareness and training; data security; and platform security.

Detect finds and analyzes possible attacks and compromises, including anomalies and indicators of compromise. Respond takes action on a detected incident and supports containing its effects. Recover restores assets and operations affected by an incident. The functions are addressed concurrently: Govern, Identify, and Protect outcomes help prevent and prepare for incidents, while Govern, Detect, Respond, and Recover outcomes help discover and manage them.

The CSF is meant for any organization, regardless of size, sector, or maturity. It describes outcomes rather than prescribing how to achieve them, and links to resources on practices and controls that can be used to reach those outcomes.