What It Is

The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, risk-based guideline from the U.S. National Institute of Standards and Technology. It offers a flexible structure to manage cybersecurity risks across organizations of any size or sector, evolving from critical infrastructure focus to universal applicability.

Key Components

• **Framework CoreSix Functions (Govern, Identify, Protect, Detect, Respond, Recover), organized into 22 Categories and 112 Subcategories with informative references to standards like ISO 27001 and NIST SP 800-53.
• **Implementation TiersFour qualitative levels (Partial, Risk-Informed, Repeatable, Adaptive) to evaluate risk processes.
• **Framework ProfilesAlign business needs with Core outcomes via Current and Target states. No formal certification; relies on self-assessment.

Why Organizations Use It

• Fosters common language for executives, boards, and partners.
• Aids compliance, supply chain risk management, and insurance benefits.
• Drives strategic risk reduction, prioritization, and continuous improvement.
• Builds trust with stakeholders through demonstrated posture.

Implementation Overview

• Conduct gap analysis using Profiles and Tiers.
• Prioritize via Quick Start Guides, vendor tools, mappings.
• Applicable globally; incremental for SMEs, comprehensive for enterprises. (178 words)

What It Is

The Federal Information Security Modernization Act (FISMA) of 2014 is a U.S. federal law that establishes a mandatory, risk-based framework for protecting federal information and systems. Modernizing the 2002 act, it requires agencies to implement comprehensive security programs using the NIST Risk Management Framework (RMF) to ensure confidentiality, integrity, and availability.

Key Components

• NIST RMF 7 steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor
• NIST SP 800-53 controls (20 families, baselines per SP 800-53B)
• FIPS 199 impact categorization (Low/Moderate/High)
• Continuous monitoring (SP 800-137), SSPs, POA&Ms, annual IG evaluations

Why Organizations Use It

• Mandatory for federal agencies/contractors handling federal data
• Reduces breach risks, enhances resilience
• Enables contracts, FedRAMP cloud use
• Builds trust via oversight, reporting to OMB/Congress

Implementation Overview

• Phased RMF lifecycle with governance, inventory, controls
• Applies to agencies, contractors; scalable by size/complexity
• Involves assessments, ATOs, IG audits (no central certification)

(178 words)