International (US-originated, globally adopted) · National Institute of Standards and Technology (NIST), USA · NIST CSF 2.0

NIST Cybersecurity Framework

A risk-based framework structured around six functions - Govern, Identify, Protect, Detect, Respond and Recover.

What it is

NIST CSF is a voluntary, outcome-based framework used worldwide to manage cybersecurity risk. Version 2.0 added the Govern function to the original five, bringing board-level accountability, risk management and supply-chain risk into the core. It's one of the frameworks permitted under Australia's CIRMP Rules, and gives security teams, auditors and executives a shared language.

Who it applies to

Any organisation. Australian regulated entities often use it as a governance backbone, giving a common structure across ISM, Essential Eight, ISO 27001 and PCI DSS.

NIST Cybersecurity Framework

Requirements

Govern (GV)

Set, share and monitor the cybersecurity risk-management strategy, expectations and policy.

Identify (ID)

Find the organisation's current cybersecurity risk, including assets, risks and governance context.

Protect (PR)

Manage cybersecurity risk with safeguards - access control, awareness and data security.

Detect (DE)

Continuously monitor to find and analyse possible cybersecurity attacks and compromises.

Respond (RS)

Act on a detected cybersecurity incident. Use containment, communications and analysis.

Recover (RC)

Restore assets and operations after a cybersecurity incident, through recovery planning and improvement.

Sources

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.