NIST CSF: the functional backbone¶
A language before a checklist¶
When a new CISO first lists everything that needs doing at Scaldimet, the result is usually a long, unprioritised list of gaps: no asset inventory, no network segmentation at Beta, no monitoring of the contractor, no incident plan, no tested backups. What turns a list into a programme is a structure that organises the work and lets you talk about it with non-specialists. That is what the NIST Cybersecurity Framework (CSF) provides. It is the structure Scaldimet's chosen baseline, CyFun, is built on, so it is worth understanding first.
The most important thing to grasp is what CSF is not. It is not a law, it is not certifiable, and it is not a detailed control catalogue that tells you exactly how long a password must be. It is a structure: a common language for organising cybersecurity outcomes so that technical staff, managers and the board can discuss them together. Its value is structure and communication, not prescription.
The functions¶
CSF organises everything into a small set of functions. The original version had five; version 2.0, published in early 2024, added a sixth, Govern, at the front. The six are:
| Function | The question it answers | Scaldimet today |
|---|---|---|
| Govern | How do we direct and oversee security? | Just built, in Module 2 (mandate, roles, policy, oversight) |
| Identify | What do we have, and what matters? | Weak: no proper asset inventory across the two sites |
| Protect | How do we safeguard it? | Patchy: strong at Alpha, almost absent on Beta's OT |
| Detect | How do we notice something wrong? | Largely missing: the contractor's access is unmonitored |
| Respond | What do we do when it happens? | No incident plan exists |
| Recover | How do we get back to normal? | Backups exist at Alpha, untested; nothing at Beta |
Beneath each function sit categories and then subcategories: progressively more specific outcomes (for example, under Identify, an outcome that physical devices are inventoried). CSF stops at outcomes; it deliberately leaves how to achieve them to other references. CyFun, as the next Lesson shows, takes these outcomes and adds the "definition of done" that CSF omits.
Why the functions matter for risk¶
The functions are not an arbitrary list; they are a lifecycle, and treating them as one is itself risk management. A common failure is to put all the effort into Protect (buy tools, build walls) and neglect Detect, Respond and Recover. Real incidents are not only prevented; they are noticed, contained and recovered from. Laying the work across all six functions forces you to fund detection and recovery, not just prevention, which is where under-prepared organisations are repeatedly caught.
The addition of Govern in version 2.0 matters for this course specifically: it puts the Module 2 work (direction, accountability, oversight, risk appetite) as a core governance function within the framework, formalising that security is governed before it is operated. The backbone and the course agree on the order.
Application: sort Scaldimet's gaps, then find the weakness¶
On paper, file six of Scaldimet's known problems under the CSF function each best belongs to: (1) no list of what systems exist at Beta; (2) the flat, unsegmented OT network; (3) the unmonitored contractor access; (4) no plan for who does what during an incident; (5) backups never test-restored; (6) no one accountable until last month. Some touch more than one function, say which and why. Then answer the real question: across the six functions, where is Scaldimet weakest, and what would a "buy more Protect tools" response miss? Draft your answers before reading on.
Model answer (open after you've drafted yours)
A workable sort: (1) Identify, (2) Protect, (3) Detect, (4) Respond, (5) Recover, (6) Govern, one gap in every function. Two reasonably touch a second: unmonitored contractor access is a Detect gap but also a Protect one (the access itself is too broad), and "no one accountable" is Govern but shows up as weakness everywhere. The judgement the sort forces: Scaldimet is weak across the whole lifecycle, not just in prevention, so the common instinct, spend on more Protect tools, would leave it just as unable to notice an intrusion (Detect), respond to it, or recover. That is what CSF is for: a vocabulary that shows the board the holes are spread across six functions, not concentrated where the vendors are selling.
Key takeaway
NIST CSF is an organising structure and a common language, not a law, a certificate or a detailed control catalogue. It organises cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond, Recover (Govern added in version 2.0). Treating the functions as a lifecycle is itself risk management: it stops an organisation over-investing in prevention while neglecting detection, response and recovery. CSF underpins CyFun, and its Govern function places the Module 2 governance work at the head of the programme.