NIST CSF 2.0, the technical side
Jun 12th, 2024 by Jesper Kråkhede
In February NIST released version 2.0 of its Cybersecurity Framework, the first major update since 2014. It is one of the most widely used frameworks in the world, so it is worth a look.
The biggest change is a new function. The five well known functions, Identify, Protect, Detect, Respond and Recover, now have a sixth one in the middle: Govern. More on that in my next post.
On the technical side, a few things stand out. The framework is no longer aimed only at critical infrastructure. It is written for organisations of every size and sector, with quick start guides for smaller ones. Supply chain risk management has been expanded considerably, which fits this year well. The categories have been restructured, with more focus on identity, platform security and the resilience of technology infrastructure. And there are many more implementation examples, which makes it easier to go from ‘what’ to ‘how’.
How do you use it technically? Map your existing controls to the framework´s categories and see where the gaps are. Use the profiles to describe where you are today and where you want to be. Combine it with MITRE ATT&CK, so you know which attacks your controls actually stop.
The framework doesn´t tell you which product to buy. It tells you which questions you need answers to.
A good framework is a checklist for your thinking, not a replacement for it.