The FISMA Focus IPD

As discussed previously here, the NIST CSF simplifies the complex subject of cybersecurity into language that industries are increasingly using to build company profiles of their cybersecurity programs. The CSF allows businesses to prioritize gaps in the implementation of cyber categories for improvement, using simple vocabulary and definitions that resonate outside of IT security and compliance circles. The NIST CSF categories are organized across five overarching functions. Using the functions and underlying subcategories, the NIST CSF translates into the real-world conversation of how much money, expertise, and political will the organization has for the bite-sized activities that will do a really good job of keeping the firm off the front page news.

The NIST CSF categories are high level and cut across proactive, preventative, and detective measures as well as recovery activities. Additionally, the categories focus on the specific cybersecurity people and process aspects to the all-too-often technology centric discussion. It takes the technical out of the cybersecurity conversation, making it the ideal framework for program management and for discussions with external stakeholders. Not only is the NIST CSF a collection of best practices that improve efficiency and protect constituents, but it can serve as the sole cybersecurity framework that empowers cybersecurity programs to prioritize needs, implement a tailored strategy, and overcome challenges.