The NIST Cybersecurity Framework

To protect against cyberattacks, the cybersecurity team needs a thorough understanding of what are the most important assets and resources of the organization. The identify function includes such categories as asset management, business environment, governance, risk assessment, risk management strategy, and supply chain risk management.

The protect function covers much of the technical and physical security controls for developing and implementing appropriate safeguards and protecting critical infrastructure. These categories are identity management and access control, awareness and training, data security, information protection processes and procedures, maintenance, and protective technology.

The detect function implements measures that alert an organization to cyberattacks. Detect categories include anomalies and events, security continuous monitoring, and detection processes.

The respond function categories ensure the appropriate response to cyberattacks and other cybersecurity events. Specific categories include response planning, communications, analysis, mitigation, and improvements.

Recovery activities implement plans for cyber resilience and ensure business continuity in the event of a cyberattack, security breach, or other cybersecurity event. The recovery functions are recovery planning improvements and communications.