Subjects and lessons to explore.

Law

Cybersecurity · Foundations

NIST Cybersecurity Framework

9 min read 5 practice questions
9 key termsSourcesReport an error
Want it in plain words first? Jump to Eli explains — the same idea, no jargon.
On this page 9 sections
  1. In 30 seconds
  2. Why this matters
  3. The college version
  4. Eli explains
  5. Worked example
  6. Key takeaway
  7. Quick check
  8. Study tools
  9. Sources & references

In 30 seconds

The is a voluntary framework from the U.S. National Institute of Standards and Technology for improving cybersecurity. It organizes security work into six functions — , , , , , — and describes the outcomes worth achieving, not the exact products or settings to use. Organizations use it to assess where they are, plan improvements, and speak a common language about cyber risk.

Why this matters

Security conversations fail when people use different words for the same problem. The CSF exists to end that: it gives executives, technicians, regulators, and business partners one vocabulary of six functions, so an organization can say where it stands and what it plans to do next in terms everyone understands. In coursework, the CSF ties the foundations together — risk, the CIA triad, incident response, backups — into a single framework you will meet again in nearly every security job posting. In practice, it is how organizations turn vague concern into a written current state, a target, and a plan. It is also the honest version of security: a framework that guides judgment rather than promising a certificate of safety. Knowing what frameworks can and cannot do is part of security literacy itself.

The college version

What the CSF is: a shared framework from NIST

The NIST Cybersecurity Framework — usually just "the CSF" — is a voluntary framework published by the U.S. National Institute of Standards and Technology (NIST), the federal agency that develops measurement and technology standards. NIST first issued the framework in 2014, after the U.S. government asked the agency to develop voluntary guidance for improving cybersecurity, originally with critical infrastructure in mind. In February 2024 NIST released CSF 2.0, which extended the framework to organizations of every kind. The CSF's own description of itself is precise: it offers a taxonomy of high-level cybersecurity outcomes that any organization — regardless of its size, sector, or maturity — can use to better understand, assess, prioritize, and communicate its cybersecurity efforts. Two words carry the weight. "Outcomes" means the framework names results worth achieving, not particular products or settings. "Taxonomy" means those outcomes are organized into a clear structure. The CSF does not prescribe how outcomes should be achieved; it links to other resources that describe practices and controls. It may be adopted voluntarily, or because a regulation, contract, or partner requires it.

The six functions

At the top of the CSF's structure sit six functions, each named after a verb: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER. Each is a category of outcomes, and each has a one-line plain meaning. GOVERN: the organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored — the layer that sets priorities and assigns responsibility. IDENTIFY: the organization's current cybersecurity risks are understood — what assets exist, what depends on them, and what could go wrong. PROTECT: safeguards to manage the risks are used — access control, awareness and training, data security, and similar defenses. DETECT: possible attacks and compromises are found and analyzed — monitoring, alerts, and review of anomalies. RESPOND: actions regarding a detected incident are taken — containing it, managing it, and reporting it. RECOVER: assets and operations affected by an incident are restored — returning to normal and communicating during recovery. NIST draws the functions as a wheel with GOVERN at the center, because governance informs how the other five are carried out, and because the functions run concurrently: identify, protect, and detect are continuous work, while respond and recover must be ready at all times and activate when an incident occurs.

Using the framework: assess, plan, communicate

The framework's practical engine is the . A Current Profile describes the outcomes an organization is achieving today; a Target Profile describes the outcomes it has chosen to pursue. Comparing the two reveals gaps, and the gaps drive a prioritized action plan — a list of what to do next, with owners and milestones. That is the assess-and-plan rhythm, and NIST presents it as a cycle that repeats as systems and threats change. The third use is communication. Because the CSF gives everyone the same six functions and the same outcome vocabulary, executives, managers, and practitioners can discuss cybersecurity without talking past one another, and organizations can describe their capabilities and expectations to partners, suppliers, and customers. NIST states it directly: the CSF provides a common language for communicating about cybersecurity risks, capabilities, needs, and expectations. This is the sense in which the CSF is the shared language of security — not a dialect experts speak, but a vocabulary anyone can use.

Who it is for — and what a framework can't do

The CSF is designed for organizations of all sizes and sectors — industry, government, academia, and nonprofits — whether their security program is brand new or deeply mature. NIST stresses that the framework is not one-size-fits-all: organizations have different missions, different risk appetites, and different resources, so how they implement the CSF will vary. It is guidance, not a guarantee. Completing the functions does not certify that an organization is secure, and NIST does not present the CSF as a compliance checklist. A framework helps an organization see its situation, set priorities, and speak clearly about them; it does not remove the need for judgment, monitoring, and adaptation. It is also worth knowing what the CSF is not: it is one framework among several NIST publishes. The AI Risk Management Framework (AI RMF), for example, is a separate NIST framework focused on the risks of AI systems, with its own structure and its own lessons elsewhere in this curriculum.

Eli, the EliExplains learning guide

Eli explains

The same idea, in plain words

Explain it like I’m 10

The CSF is a list of good outcomes that NIST wrote down so every organization would talk about security in the same way. Instead of arguing about opinions, people point to the six functions: GOVERN asks who is in charge and what the rules are; IDENTIFY asks what we have and what could go wrong; PROTECT asks what defenses are in place; DETECT asks how we notice problems; RESPOND asks what we do when something happens; RECOVER asks how we get back to normal. An organization checks which outcomes it already meets, picks the ones it wants, and works through the difference. Nothing in the CSF forces a specific brand of firewall or a particular password policy. It tells you what good looks like; you decide how to get there.

Picture it like this

Imagine six families all describing their homes with the same six questions: Who sets the house rules? What is inside and what could catch fire? What locks and rails protect people? How would we notice smoke early? What is the fire drill? How do we rebuild afterward? Because everyone uses the same questions, a landlord, a tenant, and an inspector can compare notes without confusion. The CSF is that shared set of questions for cybersecurity. A hospital, a bakery, and a university answer them differently, but they answer the same ones — which is why the answers are comparable.

Where the picture stops working

The house analogy has limits. A house's rooms are fixed, while an organization's systems, staff, and threats change constantly, so the assessment has to be repeated. The six questions describe outcomes, not solutions: the framework will not tell you which smoke detector to buy, so two organizations can both be strong in a function with very different controls. And unlike a house inspection, completing the list does not clear the building — cyber risk never fully goes away, and the CSF is a tool for managing it, not a certificate of safety.

Worked example

Beacon Street Books, a family-run bookstore with an online shop, works through the CSF with a technically minded relative. GOVERN: the owner writes a one-page policy — who may approve new software, and that backups run weekly. IDENTIFY: they list what matters: the customer database, the card terminal, and the shop's reputation, and they note that a phishing email could reach any staff member. PROTECT: they add two-step login to email, enable automatic updates, and keep an encrypted backup off-site. DETECT: they set the point-of-sale app to alert on unusual logins. RESPOND: the runbook says unplug the terminal, change passwords, and tell the payment processor. RECOVER: restore from the off-site backup and verify customer records. A Current Profile showed recovery was the weakest area, so the action plan fixed that first. The framework bought them nothing — it told them what to think about.

Key takeaway

The NIST Cybersecurity Framework is a voluntary, outcome-based framework that gives organizations of every size a shared vocabulary — six functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER — for assessing where they stand, planning improvements, and communicating about cyber risk. It guides and organizes; it does not guarantee security.

Quick check

3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.

Question 1 of 3foundational

Which statement best describes the NIST Cybersecurity Framework?

Choose an answer, then check it.
Question 2 of 3intermediate

Of the six CSF functions, which one asks an organization to find and analyze possible attacks and compromises?

Choose an answer, then check it.
Question 3 of 3intermediate

A small law firm has quarterly reviews of its client files (IDENTIFY), encrypted laptops and two-step login (PROTECT), and monitoring for unusual account activity (DETECT). A consultant notices the firm has no written security policy and no one reviews security decisions. Which CSF function is being neglected?

Choose an answer, then check it.
Practice all 5

Keep learning

You’ve reached the end of this subject. Return to the outline to choose what to explore next.

Practice this lesson
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related

You’ll learn to

  • Define the NIST Cybersecurity Framework and explain its purpose as a voluntary, outcome-based framework for managing cybersecurity risk.
  • Identify the six CSF functions — GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER — and explain each one in plain language.
  • Explain how organizations use Current and Target Profiles to assess where they are, plan improvements, and communicate about cyber risk.
  • Distinguish the CSF from NIST's separate AI Risk Management Framework.
  • Apply the six functions to classify the activities in an organization's security program.
  • Evaluate the limits of the CSF as guidance rather than a guarantee of security.

Common mistakes

  • Treating the CSF as a compliance checklist that certifies security.

    The CSF organizes outcomes and links to guidance; it does not prescribe controls or guarantee results. Completing the functions is a starting point for continuous improvement, not a certificate of safety.

  • Assuming the CSF is only for critical infrastructure or only for large enterprises.

    CSF 2.0 is explicitly designed for organizations of all sizes and sectors — from a one-person shop to a government agency — at any maturity level.

  • Running the functions once, in order, and calling the job done.

    The functions run concurrently and continuously: identify, protect, and detect are ongoing work, respond and recover must always be ready, and profiles should be revisited as systems and threats change.

  • Confusing the CSF with NIST's AI Risk Management Framework.

    They are separate NIST frameworks. The CSF covers general cybersecurity, while the AI RMF focuses on risks from AI systems and is covered in the data-science and AI literacy lessons.

Easily confused

The NIST Cybersecurity Framework vs. The NIST AI Risk Management Framework (AI RMF)

Both are voluntary NIST frameworks, but the CSF organizes general cybersecurity outcomes into six functions, while the AI RMF targets the risks of AI systems with its own structure. The AI RMF gets its own treatment in the data-science subject.

A Current Profile vs. A Target Profile

A Current Profile records the CSF outcomes an organization achieves today; a Target Profile records the outcomes it wants. The gap between the two is what the action plan closes.

A framework vs. Controls and standards

A framework names and organizes desired outcomes; controls and standards are the concrete practices that achieve them. The CSF deliberately leaves the choice of controls to the organization and points to resources for guidance.

Key vocabulary

NIST Cybersecurity Framework (CSF)
A voluntary framework from the U.S. National Institute of Standards and Technology that organizes cybersecurity outcomes into six functions to help organizations understand, assess, prioritize, and communicate their cybersecurity efforts.
core function
One of the six highest-level outcome categories of the CSF: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER.
GOVERN
The CSF function whose outcomes establish, communicate, and monitor the organization's cybersecurity risk management strategy, expectations, and policy.
IDENTIFY
The CSF function whose outcomes ensure the organization's current cybersecurity risks are understood.
PROTECT
The CSF function whose outcomes put safeguards in place to manage cybersecurity risks, such as access control, awareness and training, and data security.
DETECT
The CSF function whose outcomes find and analyze possible cybersecurity attacks and compromises.
RESPOND
The CSF function whose outcomes take action regarding a detected incident, including containing its effects.
RECOVER
The CSF function whose outcomes restore assets and operations affected by a cybersecurity incident.
Organizational Profile
A CSF tool that describes an organization's current and/or target cybersecurity posture in terms of the Core's outcomes; comparing the two reveals gaps to close.

Sources & references

  1. Cybersecurity Framework | NIST — National Institute of Standards and Technology (NIST)
  2. The NIST Cybersecurity Framework (CSF) 2.0 — NIST CSWP 29 (February 26, 2024) — National Institute of Standards and Technology (NIST)
  3. AI Risk Management Framework (AI RMF) — National Institute of Standards and Technology (NIST)
  4. NIST Cybersecurity Framework (CSF) definition — TechTarget

EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.

Researched 2026-08-21

Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.