Security Frameworks Flashcards
What is NIST Framework Core?
Five concurrent and continuous Functions—Identify, Protect, Detect, Respond, Recover.
These Functions provide a high-level, strategic view of the lifecycle of an organization’s management of cybersecurity risk.
The Framework Core then identifies underlying key Categories and Subcategories for each Function, and matches them with example Informative References, such as existing standards, guidelines, and practices for each Subcategory.
What are NIST Framework Profiles?
A Framework Profile (“Profile”) represents the cybersecurity outcomes based on business needs that an organization has selected from the Framework Categories and Subcategories.
The Profile can be characterized as the alignment of standards, guidelines, and practices to the Framework Core in a particular implementation scenario. Profiles can be used to identify opportunities for improving cybersecurity posture by comparing a “Current” Profile (the “as is” state) with a “Target” Profile (the “to be” state). Profiles can be used to conduct self-assessments and communicate within an organization or between organizations.
What are NIST Framework Implementation Tiers?
Framework Implementation Tiers (“Tiers”) provide context on how an organization views cybersecurity risk and the processes in place to manage that risk. Tiers describe the degree to which an organization’s cybersecurity risk management practices exhibit the characteristics defined in the Framework (e.g., risk and threat aware, repeatable, and adaptive). The Tiers characterize an organization’s practices over a range, from Partial (Tier 1) to Adaptive (Tier 4). These Tiers reflect a progression from informal, reactive responses to approaches that are agile and risk-informed. During the Tier selection process, an organization should consider its current risk management practices, threat environment, legal and regulatory requirements, business/mission objectives, and organizational constraints.
