How to Use NIST’s Cybersecurity Framework to Foster a Culture of Cybersecurity

Editor’s note: this piece on the NIST cybersecurity framework was originally published in February 2020, and has been updated on February 16, 2021, with new information.

Faced with the increasing volume and sophistication of cyber threats, CISOs and security teams need to find ways to garner greater executive support and meaningful budgets to keep their organizations safe. However, recent research reveals that many CISOs aren’t getting the support that they need, and it’s one of the top reasons why they switch jobs more often than any other role in the C-suite. 

According to research conducted by Korn Ferry (via The Wall Street Journal) on the length of tenure of the top 1,000 U.S. companies’ C-suites, the average tenure across the entire C-suite was 5.3 years. However, the average tenure of a CIO is lower, at 4.3 years. A survey conducted by Nominet Cyber Security shows that a CISO’s average tenure is about half of that of a CIO. 

While it’s easy to assume that CISOS have shorter tenures because they’re taking a hit as the bearer of bad news (e.g., fired after a data breach), research shows this isn’t the only reason. A research report conducted by the Enterprise Strategy Group (ESG) and ISSA in April 2019 found that the most common reasons that security officers quit include the following: 

1. No corporate culture: 36% of the security executives ESG-ISSA surveyed stated that as CISOs, they would change jobs when they felt their employer didn’t have a culture that emphasizes cybersecurity.
2. No visibility: Nearly one-third of the security executives surveyed stated they would change jobs if they felt they were not being taken seriously and were not actively engaged with the executive leadership team.
3. No resources: 27% of the security executives surveyed stated they would change jobs if they felt the budgets were not realistic to the risk associated with the company’s size or industry.

In 2020, it is not unusual for an organization to have a disconnect between the C-suite and the technical implementation staff concerning risk tolerance. And to make things worse, the organization is often unaware it has this problem. 

Unless the entire organization is aligned concerning its risk tolerance level, it’s difficult for security executives to secure budgets that are realistic to the risk associated with the company’s size, industry or business model. 

However, with a definitive, universal understanding of what an organization’s governance considers an acceptable level of risk in place, it becomes simple for security leaders to acquire the resources needed to improve cyber resilience.  

What could security professionals do to transform a discussion about risks and risk tolerance objectives from implicit to explicit? 

In this article, we’ll discuss the NIST cybersecurity Framework — a tool security leaders can use to foster a definitive, organization-wide understanding of what an organization’s governance considers an acceptable level of risk. 

Whether you work for a three-year-old company or a hundred-year-old company, the NIST cybersecurity framework is a tool you can leverage to assess enterprise-wide risks and foster internal dialogues to align your whole organization on its risk tolerance objectives. This in turn will help your team set better security priorities and secure the budget needed to adequately mitigate IT risks. 

Related: Cybersecurity Measures and Internal Controls Needed to Adapt for Remote Work Environments

Overview of NIST Cybersecurity Framework 

The Framework provides a common language and methodology for managing cybersecurity risk and helps guide key decisions about risk management activities through the various levels of an organization from senior executives, to business and process level, and implementation as well. NIST standards are based on best practices from several security documents, organizations, and publications (e.g. ISO 27001, COBIT 5, etc.). 

Because the framework is designed to be outcome-driven (as opposed to prescriptive), it works for organizations of all sizes, industries, and maturities. Thus, whether you’re just getting started in establishing a cybersecurity program or you’re already running a fairly mature program, the framework can provide value — by acting as a top-level security management tool that helps assess cybersecurity risk across the organization.  

Are you tired of efficiency losses in implementing and putting together your company’s compliance and risk management solutions? Hyperproof is a great place to start reducing your workload.

Key Terminology of the NIST Cybersecurity Framework 

The Cybersecurity Framework is made of three major components: 

• Implementation Tiers
• Framework Core 
• Profiles 

Implementation Tiers: The Framework also consists of 4 implementation tiers that describe the degree to which an organization’s cybersecurity risk management practices exhibit the characteristics defined in the Framework. The tiers range from Partial (Tier 1) to Adaptative (4) and describe an increasing degree of rigor and how well-integrated cybersecurity risk decisions are into broader risk decisions and the degree to which the organization shares and receives cybersecurity info from external parties.   

Framework Core. A set of cybersecurity activities and references that is common across critical infrastructure sectors and organized around particular outcomes. The Framework Core comprises four types of elements: Functions, Categories, Subcategories, and Informative References.

Functions. One of the main components of the Framework, Functions provides the highest level of structure for organizing basic cybersecurity activities into Categories and Subcategories. The five Functions are Identify, Protect, Detect, Respond, and Recover.

Categories  The subdivisions of a Function into general groups of cybersecurity outcomes, closely tied to programmatic needs and particular activities. Examples of Categories include Asset Management, Access Control, and Detection Processes.

Subcategories. The subdivision of a Category into specific outcomes of technical and management activities. Think of sub-categories as outcome-driven statements that provide considerations for creating or improving a cybersecurity program. 

Examples of Subcategories include:

1. External information systems are cataloged
2. Data-at-rest is protected
3. Notifications from detection systems are investigated

Framework Profiles. Profiles are an organization’s unique alignment of their firm’s requirements and objectives, risk appetite, and resources against the desired outcomes of the Framework Core. Profiles can be used to identify opportunities for improving cybersecurity posture by comparing a current profile (the “as is” state) with a target profile (the “to be” state).

There isn’t a right or wrong way to approach the profiles. But one way to approach it is to map your organization’s cybersecurity requirements, mission objectives, operating methodologies, and current practices against the subcategories of the Framework Core to create a Current-State Profile. 

In addition to these components, NIST has also provided a framework for clarifying the communication roles for each level within an organization. 

Source: NIST.gov

Executive-level responsibilities: This level communicates the mission priorities, available resources, and overall risk tolerance to the business/process level. 

The business/process level responsibilities: This level uses the information as inputs into the risk management process and then formulates a profile to coordinate implementation/operation activities. 

The implementation/operations level responsibilities: This level communicates the Profile implementation progress to the business/process level. The business/process level uses this information to perform an impact assessment. Business/process level management reports the outcomes of that impact assessment to the executive level to inform the organization’s overall risk management process and to the implementation/operations level for awareness of business impact.”

Related: What is the Cybersecurity Maturity Model Certification (CMMC)?

A Breakdown of the 6 RMF Steps

As we’ve seen and discussed, the NIST framework for managing cybersecurity risks through the various levels of an organization is quite complex, full of various levels and steps. This section will cover the 6 RMF steps identified by the NIST to manage cybersecurity risks effectively.

1. Identify Information Systems

The first step in the process involves identifying and categorizing the different types of systems within the organization. Everything must be accounted for, including information types, information systems, and assets, in addition to the specific responsibilities and roles of the individuals who manage them. Finally, you’ll also want to log what each system’s intended use is and how each system connects to others.

2. Select Specific Security Controls

The next step in the process is to select which security controls you’d like implemented and used as technical safeguards to your identified systems. These are the critical controls that will protect your systems’ integrity and confidentiality, and information. These controls obviously must be selected on the basis that they are effective in their application.

3. Implementing Selected Security Controls

In this step in the process, the selected security controls from step two are implemented to their respective systems. Additionally, it must be described how each control is employed in its specific system of operation. These controls will be used to both posture and benchmark the success of your organization’s cybersecurity initiatives. Additionally, implemented policies should be tailored to the individual devices they’re aligned with the proper security documentation.

4. Assessment of Implemented Security Controls

This step is used to benchmark the relative success of the security controls that you have in place. Thus, your security’s effectiveness is only as good as its ability to protect against threats effectively. Controls must be appropriately implemented to produce the desired outcome of the security procedures for specific devices and systems.

5. Authorization of Information Systems

Nearing the end of our six-step ‘cycle,’ this step requires reporting system control operational success and whether or not present risks are permissible to the organization. This step also involves the tracking of controls put in place that have failed. That said, permission must be granted for this step to occur by organization stakeholders to ensure that all organizational personnel are kept informed.

6. Monitoring Security Controls

The final step in the full implementation of your cybersecurity management system is to monitor and update your systems continually. Thus, your system will reflect the dynamic and continuously evolving technologies and threats present at any given point in time. Automated tools can help to increase the efficiency and effectiveness of your security systems and processes.

How the NIST Cybersecurity Framework Can Be Applied  

Several organizations have leveraged the Framework to create a risk heat map for their critical business functions, and through the process drove organization-wide alignment on risk tolerance and prioritization. Below is the story of how Intel has utilized the Framework to achieve meaningful outcomes.  

Intel Case study 

Intel used the framework to create a risk heat map that can be used to set risk tolerance baselines, identify areas that need more detailed or technical assessments, identify areas of underinvestment and overinvestment, and assist in risk prioritization. 

Intel divided its computer infrastructure into five critical business functions and piloted the Framework to perform an initial high-level risk assessment for one business function. They conducted the project in four phases: 

1. Set target scores: A core group of security SMEs set target scores, validated Categories, developed Subcategories, and performed an initial risk assessment and scoring. This phase helped the team validate that their approach could be a meaningful tool for prioritization and risk tolerance decisions. 
2. Assess current status: Separate from the core group, several individual security SMEs conducted an independent risk assessment based on the framework. They individually scored the Categories and noted specific Subcategories where opportunities to improve existed. 
3. Analyze results: They used the heat map format to examine areas of concern at the Subcategory level to further identify specific areas for improvement
4. Communicate results. They reviewed their findings and recommendations with Intel’s CISO and staff. This process fostered dialogue and helped the broader team agree on risk tolerance and prioritization.  

This process brought the organization several benefits. One of the most valuable was the internal dialogues it helped foster — risk conversations became grounded in a shared understanding of the threats, vulnerabilities, and impacts the organization faces, and the organization gained improved visibility into its strengths and opportunities to improve. All of this helps the organization set better security priorities, and better deploy budgets and security solutions. And best of all, all of these results were achieved with a cost of under 175 FTE (full-time-employee) hours. 

Parting Thoughts

If you’re interested in improving how your organization identifies, detects, responds to, and recovers from cyber risk, the NIST Cybersecurity Framework is a solid tool to incorporate into your risk management practices. To maximize the benefits to your organization, you’ll need to tailor the framework to meet your specific business processes and priorities, start where you’re comfortable, and commit to iterations with decision-makers throughout the process.

Lastly, it’s worth remembering that cyber risk management is not an end result, but an ongoing process of iteration and dialogue about risk.

Hyperproof Supports the Implementation of NIST SP 800-53

The NIST SP 800-53 database represents the list of security controls and standards for federal agencies to architect and manage their information security systems. NIST established these guidelines to provide guidance for the protection of agencies’ and citizens’ private data. While federal agencies are required to follow these standards, other organizations should follow the same guidelines.

Hyperproof’s compliance operations software can help organizations implement NIST 800-53 guidelines, support ongoing control evaluation efforts and improve the security of organization’s information systems. Hyperproof makes complying with NIST guidelines easier by providing:

• A starter template with NIST SP 800-53 security controls
• Ability to quickly collect evidence to verify the efficacy of various controls
• A single pane of glass into all of your compliance efforts
• The ability to lever NIST SP 800-53 controls to comply with other cybersecurity and data privacy standards; the ability to map a control to multiple standards
• See your progress towards compliance, assign tasks and prioritize work streams

To learn more about how Hyperproof can help make compliance easier, sign up for a personalized demo.