What It Is

The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, risk-based guideline developed by the U.S. National Institute of Standards and Technology. It provides organizations worldwide with a flexible structure to manage cybersecurity risks, evolving from critical infrastructure focus to universal applicability. Its risk-based approach emphasizes outcomes over prescriptive controls, using a common language for strategic risk discussions.

Key Components

• **Framework CoreSix Functions (Govern, Identify, Protect, Detect, Respond, Recover), organized into 22 Categories and 112 Subcategories with informative references.
• **Implementation TiersFour levels (Partial to Adaptive) for evaluating risk management sophistication.
• **Framework ProfilesCurrent and Target states for alignment and gap analysis. No formal certification; self-attestation and mappings to standards like ISO 27001 and NIST SP 800-53.

Why Organizations Use It

Enhances risk prioritization, board communication, supply chain oversight, and compliance demonstration. Reduces threats cost-effectively, builds stakeholder trust, and supports insurance discounts. Ideal for demonstrating due care amid evolving threats.

Implementation Overview

Start with Current Profile assessment, prioritize gaps via Tiers, implement via Functions. Suited for all sizes/sectors; tooling accelerates for SMEs. Involves policy development, training, monitoring; ongoing via Profiles. (178 words)

What It Is

LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is Brazil's comprehensive data protection regulation, enacted in 2018 and fully enforced since 2021. It protects personal data of identified or identifiable natural persons with extraterritorial scope for processing targeting Brazilian residents. Employs a risk-based approach with 10 core principles like purpose limitation, necessity, and accountability.

Key Components

• **10 principlesPurpose limitation, adequacy, necessity, transparency, security, prevention, non-discrimination, accountability.
• **Data subject rightsAccess, correction, deletion, portability, anonymization, objection to automated decisions.
• **10 legal basesConsent, contracts, legitimate interests, sensitive data restrictions.
• **GovernanceMandatory DPO for controllers, processing records, DPIAs for high-risk, enforced by ANPD with graduated sanctions up to 2% Brazilian revenue (R$50M cap).

Why Organizations Use It

• Avoids fines, suspensions, reputational damage.
• Builds trust, enables market access in Brazil's digital economy.
• Manages breach/cross-border risks via SCCs.
• Drives efficiency, innovation through minimization, privacy-by-design.

Implementation Overview

Phased: governance/DPO appointment, data mapping/RoPA, policies/DSRs, technical controls/training, monitoring/audits. Applies universally to public/private entities processing Brazilian data, no size exemptions. ANPD audits, no formal certification. (178 words)