NIST Cybersecurity Framework

  1. Framework Implementation Methodology
    1. Step 1: Prioritization and Scoping
      1. Scope Definition
        1. System boundaries
          1. Organizational units
            1. Asset categories
              1. Process inclusion
              2. Business Objective Identification
                1. Mission alignment
                  1. Strategic goal integration
                    1. Value proposition consideration
                      1. Success criteria definition
                      2. Priority Determination
                        1. Risk-based prioritization
                          1. Business impact consideration
                            1. Resource constraint evaluation
                              1. Timeline establishment
                              2. Constraint Analysis
                                1. Resource limitations
                                  1. Regulatory requirements
                                    1. Technical constraints
                                      1. Organizational barriers
                                    2. Step 2: Orientation and Context
                                      1. System and Asset Identification
                                        1. Asset inventory development
                                          1. System interconnection mapping
                                            1. Dependency analysis
                                              1. Critical component identification
                                              2. Regulatory Requirement Analysis
                                                1. Applicable regulation identification
                                                  1. Compliance obligation mapping
                                                    1. Gap assessment
                                                      1. Remediation planning
                                                      2. Threat and Vulnerability Assessment
                                                        1. Threat landscape analysis
                                                          1. Vulnerability identification
                                                            1. Risk exposure evaluation
                                                              1. Mitigation requirement determination
                                                              2. Organizational Context Understanding
                                                                1. Culture assessment
                                                                  1. Capability evaluation
                                                                    1. Resource availability
                                                                      1. Change readiness
                                                                      2. Dependency Mapping
                                                                        1. Internal dependencies
                                                                          1. External dependencies
                                                                            1. Critical path analysis
                                                                              1. Single point of failure identification
                                                                            2. Step 3: Current Profile Creation
                                                                              1. Activity Assessment
                                                                                1. Current practice evaluation
                                                                                  1. Control effectiveness assessment
                                                                                    1. Process maturity evaluation
                                                                                      1. Gap identification
                                                                                      2. Control Documentation
                                                                                        1. Existing control inventory
                                                                                          1. Implementation status
                                                                                            1. Effectiveness measurement
                                                                                              1. Improvement opportunities
                                                                                              2. Process Evaluation
                                                                                                1. Process maturity assessment
                                                                                                  1. Efficiency evaluation
                                                                                                    1. Effectiveness measurement
                                                                                                      1. Optimization opportunities
                                                                                                      2. Weakness Identification
                                                                                                        1. Control gaps
                                                                                                          1. Process deficiencies
                                                                                                            1. Resource shortfalls
                                                                                                              1. Capability limitations
                                                                                                            2. Step 4: Risk Assessment Execution
                                                                                                              1. Operational Environment Analysis
                                                                                                                1. Threat landscape evaluation
                                                                                                                  1. Vulnerability assessment
                                                                                                                    1. Asset criticality analysis
                                                                                                                      1. Business impact evaluation
                                                                                                                      2. Likelihood and Impact Determination
                                                                                                                        1. Probability assessment
                                                                                                                          1. Impact magnitude evaluation
                                                                                                                            1. Risk calculation
                                                                                                                              1. Uncertainty consideration
                                                                                                                              2. Threat and Vulnerability Integration
                                                                                                                                1. Threat-vulnerability pairing
                                                                                                                                  1. Exploit likelihood assessment
                                                                                                                                    1. Impact scenario development
                                                                                                                                      1. Risk scenario analysis
                                                                                                                                      2. Business Impact Prioritization
                                                                                                                                        1. Impact category definition
                                                                                                                                          1. Severity classification
                                                                                                                                            1. Priority ranking
                                                                                                                                              1. Resource allocation guidance
                                                                                                                                            2. Step 5: Target Profile Development
                                                                                                                                              1. Desired Outcome Definition
                                                                                                                                                1. Risk reduction goals
                                                                                                                                                  1. Performance targets
                                                                                                                                                    1. Capability objectives
                                                                                                                                                      1. Compliance requirements
                                                                                                                                                      2. Risk Tolerance Alignment
                                                                                                                                                        1. Acceptable risk levels
                                                                                                                                                          1. Risk appetite integration
                                                                                                                                                            1. Business objective balance
                                                                                                                                                              1. Stakeholder expectation management
                                                                                                                                                              2. Measurable Objective Setting
                                                                                                                                                                1. Specific target definition
                                                                                                                                                                  1. Quantifiable metrics
                                                                                                                                                                    1. Timeline establishment
                                                                                                                                                                      1. Success criteria
                                                                                                                                                                      2. Resource Consideration
                                                                                                                                                                        1. Budget constraints
                                                                                                                                                                          1. Personnel availability
                                                                                                                                                                            1. Technology requirements
                                                                                                                                                                              1. Time limitations
                                                                                                                                                                            2. Step 6: Gap Analysis and Prioritization
                                                                                                                                                                              1. Profile Comparison
                                                                                                                                                                                1. Current versus target analysis
                                                                                                                                                                                  1. Gap identification
                                                                                                                                                                                    1. Priority assessment
                                                                                                                                                                                      1. Impact evaluation
                                                                                                                                                                                      2. Action Prioritization
                                                                                                                                                                                        1. Risk-based ranking
                                                                                                                                                                                          1. Resource requirement consideration
                                                                                                                                                                                            1. Implementation complexity
                                                                                                                                                                                              1. Business impact weighting
                                                                                                                                                                                              2. Resource Requirement Analysis
                                                                                                                                                                                                1. Budget estimation
                                                                                                                                                                                                  1. Personnel needs
                                                                                                                                                                                                    1. Technology requirements
                                                                                                                                                                                                      1. Timeline development
                                                                                                                                                                                                      2. Responsibility Assignment
                                                                                                                                                                                                        1. Role definition
                                                                                                                                                                                                          1. Authority delegation
                                                                                                                                                                                                            1. Accountability establishment
                                                                                                                                                                                                              1. Communication requirements
                                                                                                                                                                                                            2. Step 7: Action Plan Implementation
                                                                                                                                                                                                              1. Implementation Planning
                                                                                                                                                                                                                1. Project planning
                                                                                                                                                                                                                  1. Resource allocation
                                                                                                                                                                                                                    1. Timeline development
                                                                                                                                                                                                                      1. Milestone definition
                                                                                                                                                                                                                      2. Execution Management
                                                                                                                                                                                                                        1. Progress monitoring
                                                                                                                                                                                                                          1. Issue identification
                                                                                                                                                                                                                            1. Risk management
                                                                                                                                                                                                                              1. Quality assurance
                                                                                                                                                                                                                              2. Resource Allocation
                                                                                                                                                                                                                                1. Budget management
                                                                                                                                                                                                                                  1. Personnel assignment
                                                                                                                                                                                                                                    1. Technology procurement
                                                                                                                                                                                                                                      1. Vendor management
                                                                                                                                                                                                                                      2. Progress Monitoring
                                                                                                                                                                                                                                        1. Performance measurement
                                                                                                                                                                                                                                          1. Milestone tracking
                                                                                                                                                                                                                                            1. Issue escalation
                                                                                                                                                                                                                                              1. Corrective action
                                                                                                                                                                                                                                            2. Continuous Improvement Process
                                                                                                                                                                                                                                              1. Review Cycle Establishment
                                                                                                                                                                                                                                                1. Regular assessment schedule
                                                                                                                                                                                                                                                  1. Review criteria
                                                                                                                                                                                                                                                    1. Stakeholder involvement
                                                                                                                                                                                                                                                      1. Update procedures
                                                                                                                                                                                                                                                      2. Lessons Learned Integration
                                                                                                                                                                                                                                                        1. Incident analysis
                                                                                                                                                                                                                                                          1. Assessment findings
                                                                                                                                                                                                                                                            1. Best practice identification
                                                                                                                                                                                                                                                              1. Process improvement
                                                                                                                                                                                                                                                              2. Threat Landscape Adaptation
                                                                                                                                                                                                                                                                1. Emerging threat monitoring
                                                                                                                                                                                                                                                                  1. Vulnerability assessment updates
                                                                                                                                                                                                                                                                    1. Risk reassessment
                                                                                                                                                                                                                                                                      1. Control adjustment
                                                                                                                                                                                                                                                                      2. Stakeholder Engagement
                                                                                                                                                                                                                                                                        1. Communication planning
                                                                                                                                                                                                                                                                          1. Feedback collection
                                                                                                                                                                                                                                                                            1. Expectation management
                                                                                                                                                                                                                                                                              1. Relationship maintenance

                                                                                                                                                                                                                                                                          Previous

                                                                                                                                                                                                                                                                          5. Framework Profiles

                                                                                                                                                                                                                                                                          Go to top

                                                                                                                                                                                                                                                                          Next

                                                                                                                                                                                                                                                                          7. Integration with Standards and Frameworks