{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/nist-csf","url":{"en":"https://atlas.maintz.dev/en/terms/security/nist-csf/","da":"https://atlas.maintz.dev/da/terms/security/nist-csf/"},"term":{"en":"NIST Cybersecurity Framework (CSF)","da":"NIST Cybersecurity Framework (CSF)"},"aka":{"en":["NIST CSF"],"da":["NIST CSF"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","era":2014,"summary":{"en":"A free US framework that sorts security work into six broad goals, from steering it to recovering after an attack.","da":"Et gratis amerikansk rammeværk, der inddeler sikkerhedsarbejdet i seks overordnede funktioner, fra styring til genopretning efter et angreb."},"body":{"formal":{"en":"A voluntary framework from the US National Institute of Standards and Technology, first published in February 2014 and updated to version 2.0 in February 2024. Version 2.0 groups outcomes into six functions - Govern, Identify, Protect, Detect, Respond and Recover - and lets a firm compare a current profile with a target profile.","da":"Et frivilligt rammeværk fra det amerikanske National Institute of Standards and Technology, første gang udgivet i februar 2014 og opdateret til version 2.0 i februar 2024. Version 2.0 samler resultaterne i seks funktioner - Govern, Identify, Protect, Detect, Respond og Recover - og lader en virksomhed sammenligne en nuværende profil med en målprofil."},"plain":{"en":"A map with six regions rather than a checklist - it shows where you are, where you want to be and which roads connect them, but not exactly how to drive.","da":"Et kort med seks regioner snarere end en tjekliste - det viser, hvor man er, hvor man vil hen, og hvilke veje der forbinder dem, men ikke præcis hvordan man skal køre."},"inPractice":{"en":"The security lead at a Danish software company with US customers scores the firm against the six functions, finds Detect and Recover weak, and uses the gap between current and target profile to argue for next year's budget.","da":"Den sikkerhedsansvarlige i en dansk softwarevirksomhed med amerikanske kunder vurderer firmaet mod de seks funktioner, finder Detect og Recover svage og bruger afstanden mellem den nuværende profil og målprofilen som argument i næste års budget."},"whyItMatters":{"en":"Leaders and technical staff often talk past each other about security; the framework gives them one free, shared language that suits any size of firm and maps onto ISO 27001 and the CIS Controls.","da":"Ledelse og teknikere taler ofte forbi hinanden om sikkerhed; rammeværket giver dem ét gratis, fælles sprog, der passer til virksomheder af alle størrelser og kan kobles til ISO 27001 og CIS Controls."}},"deepDive":{"en":"The framework originated in Executive Order 13636 (February 2013), which directed NIST to develop a voluntary framework for critical infrastructure; version 1.0 followed on 12 February 2014, the Cybersecurity Enhancement Act of 2014 gave NIST a standing mandate to maintain it, version 1.1 appeared in April 2018, and Executive Order 13800 (2017) required US federal agencies to use it. Version 2.0, published as NIST CSWP 29 on 26 February 2024, dropped the critical-infrastructure framing in its title and addresses organisations of any size or sector.\n\nIt has three components. The Core is a hierarchy of Functions, Categories and Subcategories with stable identifiers: in 2.0 there are six functions, 22 categories and 106 subcategories, compared with five functions, 23 categories and 108 subcategories in 1.1. Govern (GV) is new and contains organisational context (GV.OC), risk management strategy (GV.RM), roles, responsibilities and authorities (GV.RR), policy (GV.PO), oversight (GV.OV) and cybersecurity supply chain risk management (GV.SC); the other functions are Identify (ID), Protect (PR, including PR.AA for identity management, authentication and access control), Detect (DE), Respond (RS) and Recover (RC). Profiles describe current or target outcomes selected from the Core, including Community Profiles shared by a sector. Tiers 1-4 (Partial, Risk Informed, Repeatable, Adaptive) characterise the rigour of an organisation's governance and management practices.\n\nVersion 2.0 moved informative references and implementation examples out of the PDF into online resources, notably the Cybersecurity and Privacy Reference Tool, where the subcategories are mapped to SP 800-53 Rev. 5, the CIS Controls, ISO/IEC 27001 and other sources through the OLIR programme, and added Quick-Start Guides for small businesses and other audiences. The framework itself contains no controls to implement; it points to catalogues that do.\n\nTwo misconceptions are common. Tiers are often read as maturity levels, but NIST presents them as describing the rigour of risk governance and management, and does not require an organisation to aim for Tier 4 across the board. And there is no official certification: \"CSF assessments\" by consultants are self-defined evaluations. That is the main contrast with ISO/IEC 27001, which requires a management system audited by accredited bodies; in practice many organisations use the CSF functions as a reporting language for boards and the 27001 ISMS as the operating machinery, and ISO/IEC 27002 borrowed the five original function names as attribute values for its controls.","da":"Rammeværket udsprang af Executive Order 13636 (februar 2013), der pålagde NIST at udvikle et frivilligt rammeværk for kritisk infrastruktur; version 1.0 kom den 12. februar 2014, Cybersecurity Enhancement Act of 2014 gav NIST et varigt mandat til at vedligeholde det, version 1.1 udkom i april 2018, og Executive Order 13800 (2017) pålagde amerikanske føderale myndigheder at bruge det. Version 2.0, udgivet som NIST CSWP 29 den 26. februar 2024, fjernede kritisk infrastruktur fra titlen og henvender sig til organisationer af enhver størrelse og i enhver sektor.\n\nDet har tre komponenter. Core er et hierarki af funktioner, kategorier og underkategorier med faste identifikatorer: i 2.0 er der seks funktioner, 22 kategorier og 106 underkategorier mod fem funktioner, 23 kategorier og 108 underkategorier i 1.1. Govern (GV) er ny og rummer organisatorisk kontekst (GV.OC), risikostyringsstrategi (GV.RM), roller, ansvar og beføjelser (GV.RR), politik (GV.PO), tilsyn (GV.OV) og styring af risici i forsyningskæden (GV.SC); de øvrige funktioner er Identify (ID), Protect (PR, herunder PR.AA for identitetsstyring, autentificering og adgangskontrol), Detect (DE), Respond (RS) og Recover (RC). Profiler beskriver nuværende eller ønskede resultater udvalgt fra Core, herunder Community Profiles, som deles af en sektor. Tiers 1-4 (Partial, Risk Informed, Repeatable, Adaptive) karakteriserer, hvor stringent organisationens styring og ledelse af cyberrisici er.\n\nVersion 2.0 flyttede informative referencer og implementeringseksempler ud af PDF'en og over i onlineressourcer, især Cybersecurity and Privacy Reference Tool, hvor underkategorierne via OLIR-programmet er koblet til SP 800-53 Rev. 5, CIS Controls, ISO/IEC 27001 og andre kilder, og tilføjede Quick-Start Guides til små virksomheder og andre målgrupper. Selve rammeværket indeholder ingen kontroller, der skal implementeres; det peger på kataloger, der gør.\n\nTo misforståelser er udbredte. Tiers læses ofte som modenhedsniveauer, men NIST beskriver dem som et udtryk for, hvor stringent risikostyringen er, og kræver ikke, at en organisation sigter mod Tier 4 overalt. Og der findes ingen officiel certificering: konsulenters \"CSF-vurderinger\" er selvdefinerede evalueringer. Det er den væsentligste forskel fra ISO/IEC 27001, der kræver et ledelsessystem, som auditeres af akkrediterede organer; i praksis bruger mange organisationer CSF-funktionerne som rapporteringssprog over for bestyrelsen og ISO 27001-ISMS'et som det maskineri, der driver arbejdet, og ISO/IEC 27002 har lånt de fem oprindelige funktionsnavne som attributværdier for sine kontroller."},"howTo":{"steps":{"en":["Agree the scope with management - which business units, systems and services the work covers - and name an owner.","Use the Govern function to capture the context, such as your mission, stakeholders, legal and contractual demands like NIS2 or customer requirements, risk appetite and supply chain risk.","Build a Current Profile by rating how far each relevant subcategory of the CSF Core is achieved today, using NIST's Organizational Profile template and evidence rather than opinion.","Build a Target Profile with the outcomes you need, prioritised by risk and business goals, and choose the Tier you aim for in how you govern and manage cyber risk.","Compare the two profiles and turn the gaps into an action plan with owners, budget and deadlines.","Pick concrete controls for each outcome from the informative references, such as the CIS Controls, ISO/IEC 27001 or SP 800-53, since the CSF itself does not say how.","Carry out the plan, and report progress to management and the board using the six functions.","Update the Current Profile at least yearly and after major incidents or changes, and adjust the Target Profile as threats and requirements change."],"da":["Aftal omfanget med ledelsen - hvilke forretningsområder, systemer og tjenester arbejdet dækker - og udpeg en ejer.","Brug Govern-funktionen til at beskrive rammerne, fx jeres mission, interessenter, lov- og kontraktkrav som NIS2 eller kundekrav, risikovillighed og risici i forsyningskæden.","Lav en nuværende profil ved at vurdere, hvor langt I er med hver relevant underkategori i CSF Core i dag, med NIST's skabelon til Organizational Profiles og med dokumentation frem for mavefornemmelse.","Lav en målprofil med de resultater, I har brug for, prioriteret efter risiko og forretningsmål, og vælg, hvilket Tier I sigter mod i jeres styring af cyberrisici.","Sammenlign de to profiler, og gør hullerne til en handlingsplan med ejere, budget og frister.","Vælg konkrete kontroller til hvert resultat fra de informative referencer, fx CIS Controls, ISO/IEC 27001 eller SP 800-53, for CSF siger ikke selv hvordan.","Gennemfør planen, og rapportér fremdriften til direktion og bestyrelse i de seks funktioner.","Opdatér den nuværende profil mindst en gang om året og efter større hændelser eller ændringer, og justér målprofilen, når trusler og krav ændrer sig."]},"pitfalls":{"en":["Reading the Tiers as maturity levels and aiming for Tier 4 everywhere, instead of the rigour the risk justifies.","Claiming a CSF certification, which does not exist; if you need a certificate, use ISO/IEC 27001.","Rating subcategories without evidence, so the Current Profile shows hopes rather than practice.","Skipping Govern and starting with tools under Protect and Detect, so the work lacks owners, priorities and budget."],"da":["At læse Tiers som modenhedsniveauer og sigte mod Tier 4 overalt i stedet for den stringens, risikoen berettiger.","At påstå at være CSF-certificeret, hvilket ikke findes; har I brug for et certifikat, så brug ISO/IEC 27001.","At vurdere underkategorier uden dokumentation, så den nuværende profil viser ønsker frem for praksis.","At springe Govern over og starte med værktøjer under Protect og Detect, så arbejdet mangler ejere, prioriteter og budget."]},"guides":[{"title":"The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)","url":"https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final","publisher":"NIST","tier":"standard"},{"title":"NIST SP 1301 - NIST Cybersecurity Framework 2.0: Quick-Start Guide for Creating and Using Organizational Profiles","url":"https://csrc.nist.gov/pubs/sp/1301/final","publisher":"NIST","tier":"official-doc"},{"title":"NIST SP 1300 - NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide","url":"https://csrc.nist.gov/pubs/sp/1300/final","publisher":"NIST","tier":"official-doc"},{"title":"CSF 2.0 Profiles","url":"https://www.nist.gov/cyberframework/profiles","publisher":"NIST","tier":"official-doc"}]},"edges":[{"type":"requires","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/security-framework","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/supplier-management","why":{"en":"Version 2.0 places supply chain risk management inside the Govern function.","da":"Version 2.0 placerer styring af risici i forsyningskæden under Govern-funktionen."},"confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)","url":"https://doi.org/10.6028/NIST.CSWP.29","tier":"standard","publisher":"NIST"},{"title":"NIST Releases Version 2.0 of Landmark Cybersecurity Framework","url":"https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework","tier":"official-doc","publisher":"NIST"}],"draft":true}