What It Is

NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, risk-based guideline developed by the U.S. National Institute of Standards and Technology. It provides organizations worldwide with a flexible structure to manage cybersecurity risks, evolving from critical infrastructure focus to universal applicability. Its methodology emphasizes outcomes over prescriptive controls, using a common language for risk communication.

Key Components

• **Framework CoreSix Functions (Govern, Identify, Protect, Detect, Respond, Recover), 22 Categories, 112 Subcategories with informative references to standards like ISO 27001.
• **Implementation TiersFour levels (Partial to Adaptive) for assessing risk management sophistication.
• **ProfilesCurrent vs. Target for gap analysis. No formal certification; self-attestation via Profiles.

Why Organizations Use It

Enhances risk prioritization, stakeholder communication, supply-chain management. Demonstrates due care, supports compliance (mandatory for U.S. federal agencies), builds trust. Aligns cybersecurity with enterprise risk, aiding budgets and insurance discounts.

Implementation Overview

Start with Current Profile assessment, prioritize gaps using Tiers. Applicable to all sizes/sectors; Quick Start Guides aid SMEs. Involves policy development, training, monitoring. No audits required, but third-party validation possible. Flexible for integration with existing programs.

What It Is

OSHA (Occupational Safety and Health Administration) is a US federal agency enforcing the Occupational Safety and Health Act of 1970. It is a regulatory framework with standards in 29 CFR 1910 (general industry) and others, aimed at assuring safe, healthful working conditions. Its risk-based approach uses specific standards, General Duty Clause, and hierarchy of controls.

Key Components

• Subparts covering walking-working surfaces, PPE, hazardous materials, toxic substances (Subpart Z).
• **Core principlesGeneral Duty Clause, PELs, recordkeeping (Forms 300/300A/301), inspections.
• Over 1,000 standards across industries; compliance via enforcement, not certification.

Why Organizations Use It

• Legal mandate for US employers; avoids penalties up to $165k.
• Reduces injuries, lowers costs, improves productivity.
• Builds reputation, meets stakeholder expectations.

Implementation Overview

• **Phased approachgap analysis, written programs (IIPP, HazCom), training, audits.
• Applies to most US private employers; state plans vary.
• Ongoing compliance via inspections, no formal certification.