What Is
NIST?
A Comprehensive Guide

The National Institute of Standards and Technology (NIST) is a non-regulatory federal agency operating within the U.S. Department of Commerce.  NIST plays a key role in setting standards and guidelines for the U.S. technology industry and promoting the safe and secure use of technology in both the private and public sectors.  

NIST covers a wide range of areas, including information security, where it develops and maintains a number of frameworks and guidelines that are widely used by organisations to improve their cybersecurity practices.  Notably, these include the NIST Cybersecurity Framework (CSF), which provides a set of best practices for managing cybersecurity risks, and the NIST Special Publication (SP) 800 series, which includes detailed guidance on a range of cybersecurity topics, including risk management, identity and access management, and incident response.

On 26 Febraury 2024, NIST released v2.0 of the CSF, which introduces a 6^th Function, Govern, to the Framework Core.  The Framework has also been expanded in scope to extend beyond the protection of critical infrastructure (as was the aim of the previous version) in order to explicitly include all organisations in any sector.

How does the NIST CSF differ from ISO 27001?

Whilst both standards are focused on protecting information, key differences include:

1. As a non-regulatory US federal agency, NIST focuses specifically on developing standards and guidelines for the U.S. technology industry.  In comparison, ISO 27001 is more general in nature and can be applied to any organisation, regardless of location or industry.  Whilst the primary focus of NIST is the US technology industry, the CSF is widely regarded as reliable and comprehensive and is often used globally with other standards to improve an organisation’s cyber security posture.  NIST CSF is a flexible and adaptable framework that helps organisations manage their cybersecurity risks and improve their cybersecurity posture.  It is intended to be used by organisations of all sizes and in all sectors, and it can be tailored to the specific needs and resources of each organisation.
2. Whilst organisations can certify to ISO 27001, the intention of NIST is to provide guidance and best practices in order that organisations can improve their cybersecurity posture.  The  CSF was developed for voluntary adoption by owners and operators of critical infrastructure and there is no third party, or independent, attestation or certification process.  However, the overall level of effort required for its implementation is likely to be comparable to that for ISO 27001.
3. On the whole, NIST standards and guidelines are often more specific and detailed than ISO 27001 and other information security standards.  The NIST CSF, and NIST SP 800 series are both known for their detail and specific guidance.
4. There is also the more obvious difference that NIST is cyber focussed, whereas ISO 27001 has a wider information security remit.

What are the main components of NIST CSF?

• Core
• Implementation Tiers
• Profiles

Core

This is the foundation of the NIST CSF and consists of three main parts:

• The Framework Core:  This is a set of cybersecurity activities, outcomes and references that are common to all organisations.  It comprises 6 functions and 22 categories.
  The 6 functions are:
  ◦ Govern – Establish, communicate and monitor your organisation’s cybersecurity risk management strategy, expectations and policy
  ◦ Identify – Understand cybersecurity risks by identifying your assets, vulnerabilities and threats
  ◦ Protect – Implement controls and safeguards to prevent, detect and mitigate attacks
  ◦ Detect – Implement processes and technologies to identify anomalies and suspicious activity
  ◦ Respond – Implement processes and procedures for incident response and recovery
  ◦ Recovery – Implement processes and procedures for restoring systems and services.
  ‍
• The Framework Profiles: This is a comparison of your organisation's current cybersecurity posture with your desired or targeted cybersecurity posture.  It is created by identifying your organisation's assets, vulnerabilities and threats, and then comparing the current controls and safeguards in place to the ones that are recommended in the Framework Core.
• The Framework Implementation Tiers: This is a system for describing your organisation's approach to managing cybersecurity risk.  It consists of four tiers (Partial, Risk Informed, Repeatable, and Adaptive) that describe the level of formality and sophistication of your risk management processes.

Implementation Tiers

Implementation Tiers are used to help your organisation understand and communicate your approach to managing cybersecurity risk.  The tiers provide a common language for describing your risk management practices and help you assess your risk management processes and identify areas for improvement.

Profiles

Profiles are used to help you understand your current cybersecurity posture and identify areas for improvement. Profiles also provide a snapshot of your current controls and safeguards and can be used to identify gaps and vulnerabilities that need to be addressed.

‍

How can URM assist you?

Since 2002, URM can support your organisation by assisting with each of the 7-step CSF implementation process or specific steps as follows:

Step 1 – Prioritise and scope.  The first step is to identify your business objectives and high-level priorities.  This information helps inform the scope of the systems and assets which support the business processes, as well as making strategic decisions concerning cybersecurity implementation.  It is crucial that all of your critical systems and assets are identified so that their protection can be prioritised.

Step 2 – Orient.  After defining the scope of your cybersecurity programme, URM will assist you in identifying the relevant systems and assets, regulatory requirements and the overall risk approach.  This is followed by the identification of threats and vulnerabilities which relate to the systems and assets identified in the scope.

Step 3 – Create a current profile.  With this step you need to identify your current profile specifying what security controls have been implemented and what outcomes have been achieved.  When looking at the outcomes, you will need to use the Categories and Subcategories from the Framework Core to define which outcomes are being fully or partially achieved.  This baseline will help you plan the next steps.

Step 4 – Conduct a risk assessment.  Having created a current profile, URM will help you conduct a risk assessment analysing the impact and likelihood of a cybersecurity breach.

Step 5 – Create a target profile. You will now be in a position to create a Target Profile.  Here, URM will support you focussing on your Categories and Subcategories and setting targets for your desired cybersecurity outcomes incorporating your organisation’s risk appetite.  

Step 6 – Determine, analyse and prioritise gaps.  This step includes the creation of a prioritised action plan to close the control gaps between your Current and Target Profiles, reflecting your organisation’s drivers, costs, benefits and risks.  You will also need to decide on what resources will be needed to close the gaps.

Step 7 – Implement action plan.  Having set priorities for addressing gaps between your Current and Target Profiles, it is now a case of implementing security controls and control activities in order to achieve the target profile.  The target profile comprises 108 Subcategories which are outcome-driven statements that reflect the improvement of your organisation’s cybersecurity programme.