Le NIST Cybersecurity Framework (CSF) is a set of cybersecurity standards, guidelines and best practices developed by the US National Institute of Standards and Technology (NIST), the US government agency responsible for standards and technological innovation.
The NIST CSF is designed to help organizations of all sizes and in all sectors to manage and reduce their cybersecurity risks. Adopted worldwide, it provides a common language for assessing, prioritising and optimising cybersecurity, whatever the size or sector of activity.
Updated regularly, the latest version is NIST CSF 2.0 of February 2024.
The CSF incorporates emerging challenges (IoT, supply chain, etc.), ransomware) and in line with modern best practice (Zero Trust, resilience).
🎯 Objectives
The main objectives of the NIST CSF are to :
- Establishing a common language : It provides a common frame of reference for discussing and understanding cyber security risks.
- Identifying risks : It helps organisations to identify and assess their cyber security risks.
- Implement protective measures : It proposes protective measures to reduce these risks.
- Detecting incidents: It provides tools for detecting cyber security incidents.
- Responding to incidents and restoring activity : It guides organisations in responding to incidents and resuming their activities.
Structure of the NIST CSF
The NIST CSF is organised around five main functions:
- Identifier (ID) : understand the organisation's cybersecurity context (assets, risks, etc.).
- Protect (PR) : put in place protective measures to prevent cyber security incidents.
- Detect (DE) : detect cyber security incidents quickly.
- Reply (RS ) : put in place plans to respond to cyber security incidents.
- Restore (RC) : Restore capabilities and services after a cyber security incident.
Each function is then divided into categories and sub-categories, providing a finer granularity for the implementation of cybersecurity measures.
✔ Benefits
The NIST CSF offers a number of advantages, including:
- International recognition : The NIST CSF is recognised as a benchmark in cybersecurity, encouraging its adoption by organisations wishing to comply with best practice.
- Flexibility : The framework is adaptable to the specific needs of each organisation, making it relevant to both small businesses and large multinationals.
- NIST support : NIST offers numerous resources, guides and tools to facilitate the adoption and implementation of the CSF.
- Constant development : NIST regularly updates the CSF to take account of new threats and technological developments, ensuring that it remains relevant over time.
Use cases
- Cyber posture assessment Identify gaps and measure progress.
- Regulatory compliance Align practices with legal requirements (e.g. RGPD, sectoral directives).
- Strategic communication Facilitate exchanges between technical and managerial departments and stakeholders.
- Cross-sector collaboration Harmonising efforts between suppliers, partners and governments.
Links with MITRE ATT&CK
Whereas MITRE ATT&CK focuses on opposing tactics (how the attackers operate), the NIST CSF focuses on defensive measures (how to protect yourself). The two frameworks are complementary:
- The FSB guides the implementation of generic controls.
- MITRE ATT&CK offers concrete insights to refine detections (e.g. correlation rules). SIEM based on TTP techniques).
