NIST CSF

NIST Cybersecurity Framework 2.0

Six verbs. One conversation the board can follow.

The shared language for “are we actually managing cyber risk?”

Who it's for. Any org that needs a map, not just a tool list. Common in US federal supply chains and everywhere else that borrowed the picture.

1. 01

   Govern

   Official-ish

   Establish and monitor the organization’s cybersecurity risk management strategy, expectations, and policy.

   Monday version

   Who owns cyber risk, what “enough” looks like, and whether the program matches the business — not a graveyard of unused policies.

   Do this

   • Name an accountable executive and a steering forum that actually meets.
   • Write risk appetite in numbers people can use (downtime, data types, money).
   • Tie security work to suppliers, legal duties, and the products you ship.

2. 02

   Identify

   Official-ish

   Understand current cybersecurity risks to assets, data, and capabilities.

   Monday version

   You cannot protect a mystery. Know the systems, data, and vendors that would ruin a quarter if they vanished.

   Do this

   • Keep an asset and data inventory that is boring and current.
   • Map crown-jewel processes, not just servers.
   • Write down third parties that touch sensitive work.

3. 03

   Protect

   Official-ish

   Use safeguards to manage the organization’s cybersecurity risks.

   Monday version

   Identity, hardening, backups, training — the unglamorous work that keeps Tuesday from becoming an incident.

   Do this

   • MFA and least privilege on anything that can move money or data.
   • Patch and configure like you mean it, especially the internet-facing stuff.
   • Backups that restore, not backups that only succeed in a log.

4. 04

   Detect

   Official-ish

   Find and analyze possible cybersecurity attacks and compromises.

   Monday version

   Assume something gets through. The question is how long it gets to live rent-free.

   Do this

   • Log the identity, endpoint, and email paths attackers actually use.
   • Alert on a few high-confidence stories, not 4,000 ignored ones.
   • Give someone a clock and a playbook when an alert fires.

5. 05

   Respond

   Official-ish

   Take action regarding a detected cybersecurity incident.

   Monday version

   Contain, communicate, preserve evidence, and decide — without improvising a press release in Slack.

   Do this

   • Keep a one-page severity matrix and who to call at 2am.
   • Practice isolation and comms, not just tabletop trivia.
   • Decide in advance who talks to customers, regulators, and the board.

6. 06

   Recover

   Official-ish

   Restore assets and operations affected by a cybersecurity incident.

   Monday version

   Getting back to business is a plan, not a vibe. RTO/RPO only count if you have tested them.

   Do this

   • Restore a critical system on a schedule, not on a hope.
   • Write the “we are back, here is what changed” note before you need it.
   • Feed lessons into Govern so the next incident is smaller.

Friendly translation, not legal advice. Always read the official text before you tell an auditor you “basically already do this.”