NIST Cybersecurity Framework

  1. Framework Implementation Tiers
    1. Tier Concept and Purpose
      1. Risk Management Characterization
        1. Self-Assessment Facilitation
          1. Improvement Prioritization
            1. Stakeholder Communication Support
              1. Maturity Measurement
              2. Tier 1: Partial Implementation
                1. Risk Management Characteristics
                  1. Ad-hoc processes
                    1. Reactive approach
                      1. Limited documentation
                        1. Informal procedures
                        2. Integration Limitations
                          1. Siloed operations
                            1. Limited awareness
                              1. Informal information sharing
                                1. Inconsistent practices
                                2. External Participation
                                  1. Limited collaboration
                                    1. Minimal information sharing
                                      1. Reactive engagement
                                        1. Isolated operations
                                        2. Improvement Opportunities
                                          1. Process formalization
                                            1. Documentation development
                                              1. Awareness building
                                                1. Collaboration enhancement
                                              2. Tier 2: Risk Informed
                                                1. Risk Management Evolution
                                                  1. Management-approved processes
                                                    1. Documented procedures
                                                      1. Regular risk assessments
                                                        1. Structured approach
                                                        2. Integration Progress
                                                          1. Increased awareness
                                                            1. Informal sharing mechanisms
                                                              1. Cross-functional coordination
                                                                1. Improved communication
                                                                2. External Engagement
                                                                  1. Informal information sharing
                                                                    1. Industry participation
                                                                      1. Vendor coordination
                                                                        1. Peer collaboration
                                                                        2. Implementation Challenges
                                                                          1. Inconsistent application
                                                                            1. Resource limitations
                                                                              1. Skill gaps
                                                                                1. Cultural barriers
                                                                              2. Tier 3: Repeatable
                                                                                1. Risk Management Maturity
                                                                                  1. Formal organization-wide policies
                                                                                    1. Standardized procedures
                                                                                      1. Regular review cycles
                                                                                        1. Continuous monitoring
                                                                                        2. Integration Achievement
                                                                                          1. Organization-wide approach
                                                                                            1. Formal risk management
                                                                                              1. Structured communication
                                                                                                1. Coordinated activities
                                                                                                2. External Collaboration
                                                                                                  1. Formal information sharing
                                                                                                    1. Industry partnerships
                                                                                                      1. Regulatory coordination
                                                                                                        1. Best practice sharing
                                                                                                        2. Process Characteristics
                                                                                                          1. Regular updates
                                                                                                            1. Performance measurement
                                                                                                              1. Improvement tracking
                                                                                                                1. Stakeholder engagement
                                                                                                              2. Tier 4: Adaptive
                                                                                                                1. Advanced Risk Management
                                                                                                                  1. Continuous improvement
                                                                                                                    1. Predictive capabilities
                                                                                                                      1. Lessons learned integration
                                                                                                                        1. Innovation adoption
                                                                                                                        2. Cultural Integration
                                                                                                                          1. Risk-informed culture
                                                                                                                            1. Embedded practices
                                                                                                                              1. Organizational learning
                                                                                                                                1. Adaptive capabilities
                                                                                                                                2. Proactive Engagement
                                                                                                                                  1. Information sharing leadership
                                                                                                                                    1. Threat intelligence contribution
                                                                                                                                      1. Industry collaboration
                                                                                                                                        1. Research participation
                                                                                                                                        2. Advanced Capabilities
                                                                                                                                          1. Analytics utilization
                                                                                                                                            1. Automation implementation
                                                                                                                                              1. Intelligence integration
                                                                                                                                                1. Predictive modeling

                                                                                                                                            Previous

                                                                                                                                            3. The Framework Core: Five Functions

                                                                                                                                            Go to top

                                                                                                                                            Next

                                                                                                                                            5. Framework Profiles