What It Is

The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, risk-based guideline from the U.S. National Institute of Standards and Technology. It provides a flexible structure to manage cybersecurity risks for organizations of any size or sector, emphasizing outcomes over prescriptive controls.

Key Components

• **Framework CoreSix Functions (Govern, Identify, Protect, Detect, Respond, Recover) with 22 Categories and 112 Subcategories, plus informative references to standards like ISO 27001 and NIST 800-53.
• **Implementation TiersFour qualitative levels (Partial, Risk-Informed, Repeatable, Adaptive) to evaluate risk processes.
• **Framework ProfileAligns business needs with Core outcomes via Current and Target states.
• No certification; relies on self-assessment.

Why Organizations Use It

• Fosters common risk language for executives and partners.
• Demonstrates due care, aids compliance, manages supply chain risks.
• Prioritizes cost-effective improvements; boosts insurance discounts.
• Enhances reputation; adopted by over 70% of mid-size firms.

Implementation Overview

• Assess posture with Profiles and Tiers, prioritize Core activities.
• Scalable for SMEs to enterprises using Quick Start Guides.
• Integrates existing programs; community resources accelerate rollout.
• Globally applicable across industries.

What It Is

The Cybersecurity Maturity Model Certification (CMMC) is a U.S. Department of Defense (DoD) certification framework ensuring cybersecurity protections for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in the Defense Industrial Base (DIB). It uses a tiered, risk-based maturity model with three levels, mapping to FAR 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172 standards.

Key Components

• **Three cumulative levelsLevel 1 (17 basic FAR controls for FCI), Level 2 (110 NIST 800-171 controls for CUI), Level 3 (+24 NIST 800-172 for APTs)
• 14 domains (e.g., Access Control, Incident Response, Risk Assessment)
• **Assessment modelSelf-assessments (Levels 1/2), C3PAO (Level 2), DIBCAC (Level 3); 3-year certifications with annual affirmations and limited POA&Ms

Why Organizations Use It

Mandatory for DoD contractors to access contracts; mitigates supply chain risks, reduces breach costs, enhances bid competitiveness, and builds prime-sub trust via verified compliance.

Implementation Overview

Phased approach (scoping, gap analysis, remediation, assessment, sustainment) for DIB firms of all sizes. Key activities: SSP development, evidence collection, enclave scoping. Requires C3PAO/DIBCAC audits for higher levels.