What It Is

NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, risk-based guideline developed by NIST for managing cybersecurity risks. It provides a flexible structure applicable to organizations of all sizes and sectors, emphasizing outcomes over prescriptive controls through its Core, Tiers, and Profiles.

Key Components

• **Six Core FunctionsGovern, Identify, Protect, Detect, Respond, Recover—covering the full cybersecurity lifecycle.
• **Categories and Subcategories22 categories, 112 subcategories with informative references to standards like ISO 27001, NIST 800-53.
• **Implementation TiersPartial to Adaptive for maturity assessment.
• **ProfilesCurrent and Target for prioritization; no formal certification, self-attestation suffices.

Why Organizations Use It

Enhances risk communication, supports compliance (mandatory for U.S. federal agencies), reduces threats via common language, aids supply chain management, builds stakeholder trust, and integrates with enterprise risk strategies.

Implementation Overview

Create Profiles for gap analysis, map to existing controls, use Tiers for roadmap. Applicable globally, scalable for SMEs to enterprises; involves policy development, training, monitoring—no audits required.

What It Is

BREEAM (Building Research Establishment Environmental Assessment Method) is a science-led sustainability certification framework for buildings, infrastructure, and communities. It assesses environmental, health, and resilience performance across asset lifecycles, using a credit-based, weighted scoring methodology to deliver ratings from Pass to Outstanding.

Key Components

• 10 core categories: Management, Health & Wellbeing, Energy, Transport, Water, Materials, Waste, Land Use & Ecology, Pollution, Innovation.
• Credits earned via evidenced compliance; categories weighted by impact (e.g., high for Energy).
• Built on technical manuals, KBCNs, and third-party assurance.
• Certification via licensed assessors and BRE Global audits.

Why Organizations Use It

• Drives operational savings (e.g., 22-33% energy reduction), asset value uplift (up to 30%), ESG alignment.
• Supports regulatory compliance (e.g., EU Taxonomy), risk mitigation, tenant appeal.
• Enhances reputation through credible, comparable benchmarks.

Implementation Overview

• Phased: pre-assessment, design integration, construction evidence, certification.
• Early assessor/AP appointment essential; applies globally to all sizes/types.
• Requires training, evidence management; voluntary but often planning-driven.