<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

NIST Cybersecurity Framework, implement

How to Implement the NIST Cybersecurity Framework

down-arrow

The National Institutes of Standard and Technology’s Framework for Improving Critical Infrastructure Cybersecurity - later dubbed the NIST Cybersecurity Framework (CSF) - is regarded as the gold-standard framework profile on which to build your cybersecurity program. Designed to facilitate conversations around cybersecurity risk management between cybersecurity professionals and stakeholders across both public and private-sector organizations, the NIST CSF, when coupled with the NIST Risk Management Framework (RMF), is a powerful tool. The RMF is a process-based framework practically applied using multiple more directly practical special publications from NIST and SP 800-30 is one of them. While the NIST CSF is the gold standard for cybersecurity management, being the most comprehensive and flexible, it is also one of the most challenging to implement. In his most recent webinar, CyberSaint Chief Product Officer Padraic O’Reilly discusses the connections between the CSF, RMF, and new Privacy Framework - on our official website. Here we’ll dive into how to use the RMF, SP 800-30, and steps to implement this cyber security framework.

What is NIST SP 800-30

According to NIST: The purpose of Special Publication 800-30 is to provide guidance for conducting risk assessments of federal information systems and organizations…

SP 800-30 gives risk management teams the ability to examine risk through the lenses necessary to relay that risk back to business leaders: threat type, business impact, and financial impact. Relaying these identified risks in this format helps bridge the gap between cybersecurity events and business leaders - as information security becomes an increasing concern at the CEO and Board level, using the same terminology is paramount. SP 800-30 helps technical leaders put cyber risks into a business context.

Using a NIST Risk Assessment to Implement the NIST Cybersecurity Framework

The NIST RMF is predicated on actively conducting assessments for risk-informed control implementation which makes SP 800-30 so critical to both NIST’s framework for risk management as well as cybersecurity management. The CSF is driven by outcomes and maps onto specific security controls - overall, though for strategic planning, the NIST CSF needs a risk assessment to inform where to begin. While O'Reilly sees any framework for risk quantification as a step in the right direction (from a three-by-three matrix through to 800-30 and the FAIR model) he believes that it comes down to how much value the outcomes are to the other members of your organization.

The NIST CSF relies on three main tenets of the Framework for implementation: Profiles, Implementation Tiers, and implementing the Framework Core functions (Identify, Protect, Detect, Respond, Recover). Starting with a risk assessment allows your organization to baseline and integrate that into a baseline CSF Profile. From there, determining your implementation tier level (current and desired) helps contextualize your organization’s current posture further. Finally, the Framework Core will guide where you need to invest resources based on gaps in your security program and perform continuous monitoring. 

A NIST SP 800-30 risk assessment specifically is of value since it rolls up well into the CSF given that they were developed by the same organization. While the CSF is flexible enough to use any risk assessment framework, O'Reilly recommends SP 800-30 for established infosec programs and uses a combination of 800-30 and the FAIR model in the CyberStrong platform.

Tools for Conducting An SP 800-30 Risk Assessment

Implementing both the NIST RMF and CSF relies on a baseline security risk assessment - both frameworks are designed to be as valuable as fast as possible. Baselining with a risk assessment informs where organizations should start when implementing both the NIST CSF as well as the RMF. Although, This integrated approach can be stifled by the tools organizations use to support their teams - in short, using spreadsheets with these two gold standards is insufficient. Integrated risk management tools like the CyberStrong platform help organizations integrate the risk and security assessments into one platform - helping security leaders understand how these two pieces fit together.

For more information on how to implement the NIST CSF, contact us

You may also like

October Product Update
on October 3, 2022

Hey, Jimmy - is it really always 5 o’clock somewhere? If not, it should be! With this release, we’re focusing on empowering our customers to work smarter, not harder. Whether ...

How Does FAIR Fit into ...
on September 26, 2022

The Factor Analysis of Information Risk (FAIR) methodology breaks down risk into elements that organizations can compute, understand, analyze and quantify cyber threats and their ...

All-in-One Cybersecurity Board ...
on September 19, 2022

CISOs and Board Members can no longer ignore the importance of cybersecurity. New cyber attacks and threats surface every week and threaten the security of business operations. ...

Rules for Effective Cyber Risk ...
on September 12, 2022

Cybersecurity threats are becoming more challenging for businesses. According to PurpleSec’s Cyber Security Trend Report in 2021, cybercrime surged by 600% during the pandemic, ...

A Pocket Guide to Factor Analysis ...
on September 14, 2022

FAIR, short for Factor Analysis of Information Risk, is a risk quantification methodology founded to help businesses evaluate information risks. FAIR is the only international ...

Your Guide to Cyber Risk ...
on August 30, 2022

During the pandemic, online businesses flourished as people turned to e-commerce stores to shop from the comfort and safety of their homes. This unprecedented expansion of ...