{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/nist-csf","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/nist-csf/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/nist-csf/"},"term":{"en":"NIST Cybersecurity Framework (CSF)","da":"NIST Cybersecurity Framework (CSF)"},"aka":{"en":["NIST CSF"],"da":["NIST CSF"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","era":2014,"summary":{"en":"A free US framework that sorts security work into six broad goals, from steering it to recovering after an attack.","da":"Et gratis amerikansk rammeværk, der inddeler sikkerhedsarbejdet i seks overordnede funktioner, fra styring til genopretning efter et angreb."},"body":{"formal":{"en":"A voluntary framework from the US National Institute of Standards and Technology, first published in February 2014 and updated to version 2.0 in February 2024. Version 2.0 groups outcomes into six functions - Govern, Identify, Protect, Detect, Respond and Recover - and lets a firm compare a current profile with a target profile.","da":"Et frivilligt rammeværk fra det amerikanske National Institute of Standards and Technology, første gang udgivet i februar 2014 og opdateret til version 2.0 i februar 2024. Version 2.0 samler resultaterne i seks funktioner - Govern, Identify, Protect, Detect, Respond og Recover - og lader en virksomhed sammenligne en nuværende profil med en målprofil."},"plain":{"en":"A map with six regions rather than a checklist - it shows where you are, where you want to be and which roads connect them, but not exactly how to drive.","da":"Et kort med seks regioner snarere end en tjekliste - det viser, hvor man er, hvor man vil hen, og hvilke veje der forbinder dem, men ikke præcis hvordan man skal køre."},"inPractice":{"en":"The security lead at a Danish software company with US customers scores the firm against the six functions, finds Detect and Recover weak, and uses the gap between current and target profile to argue for next year's budget.","da":"Den sikkerhedsansvarlige i en dansk softwarevirksomhed med amerikanske kunder vurderer firmaet mod de seks funktioner, finder Detect og Recover svage og bruger afstanden mellem den nuværende profil og målprofilen som argument i næste års budget."},"whyItMatters":{"en":"Leaders and technical staff often talk past each other about security; the framework gives them one free, shared language that suits any size of firm and maps onto ISO 27001 and the CIS Controls.","da":"Ledelse og teknikere taler ofte forbi hinanden om sikkerhed; rammeværket giver dem ét gratis, fælles sprog, der passer til virksomheder af alle størrelser og kan kobles til ISO 27001 og CIS Controls."}},"deepDive":{"en":"The framework originated in Executive Order 13636 (February 2013), which directed NIST to develop a voluntary framework for critical infrastructure; version 1.0 followed on 12 February 2014, the Cybersecurity Enhancement Act of 2014 gave NIST a standing mandate to maintain it, version 1.1 appeared in April 2018, and Executive Order 13800 (2017) required US federal agencies to use it. Version 2.0, published as NIST CSWP 29 on 26 February 2024, dropped the critical-infrastructure framing in its title and addresses organisations of any size or sector.\n\nIt has three components. The Core is a hierarchy of Functions, Categories and Subcategories with stable identifiers: in 2.0 there are six functions, 22 categories and 106 subcategories, compared with five functions, 23 categories and 108 subcategories in 1.1. Govern (GV) is new and contains organisational context (GV.OC), risk management strategy (GV.RM), roles, responsibilities and authorities (GV.RR), policy (GV.PO), oversight (GV.OV) and cybersecurity supply chain risk management (GV.SC); the other functions are Identify (ID), Protect (PR, including PR.AA for identity management, authentication and access control), Detect (DE), Respond (RS) and Recover (RC). Profiles describe current or target outcomes selected from the Core, including Community Profiles shared by a sector. Tiers 1-4 (Partial, Risk Informed, Repeatable, Adaptive) characterise the rigour of an organisation's governance and management practices.\n\nVersion 2.0 moved informative references and implementation examples out of the PDF into online resources, notably the Cybersecurity and Privacy Reference Tool, where the subcategories are mapped to SP 800-53 Rev. 5, the CIS Controls, ISO/IEC 27001 and other sources through the OLIR programme, and added Quick-Start Guides for small businesses and other audiences. The framework itself contains no controls to implement; it points to catalogues that do.\n\nTwo misconceptions are common. Tiers are often read as maturity levels, but NIST presents them as describing the rigour of risk governance and management, and does not require an organisation to aim for Tier 4 across the board. And there is no official certification: \"CSF assessments\" by consultants are self-defined evaluations. That is the main contrast with ISO/IEC 27001, which requires a management system audited by accredited bodies; in practice many organisations use the CSF functions as a reporting language for boards and the 27001 ISMS as the operating machinery, and ISO/IEC 27002 borrowed the five original function names as attribute values for its controls.","da":"Rammeværket udsprang af Executive Order 13636 (februar 2013), der pålagde NIST at udvikle et frivilligt rammeværk for kritisk infrastruktur; version 1.0 kom den 12. februar 2014, Cybersecurity Enhancement Act of 2014 gav NIST et varigt mandat til at vedligeholde det, version 1.1 udkom i april 2018, og Executive Order 13800 (2017) pålagde amerikanske føderale myndigheder at bruge det. Version 2.0, udgivet som NIST CSWP 29 den 26. februar 2024, fjernede kritisk infrastruktur fra titlen og henvender sig til organisationer af enhver størrelse og i enhver sektor.\n\nDet har tre komponenter. Core er et hierarki af funktioner, kategorier og underkategorier med faste identifikatorer: i 2.0 er der seks funktioner, 22 kategorier og 106 underkategorier mod fem funktioner, 23 kategorier og 108 underkategorier i 1.1. Govern (GV) er ny og rummer organisatorisk kontekst (GV.OC), risikostyringsstrategi (GV.RM), roller, ansvar og beføjelser (GV.RR), politik (GV.PO), tilsyn (GV.OV) og styring af risici i forsyningskæden (GV.SC); de øvrige funktioner er Identify (ID), Protect (PR, herunder PR.AA for identitetsstyring, autentificering og adgangskontrol), Detect (DE), Respond (RS) og Recover (RC). Profiler beskriver nuværende eller ønskede resultater udvalgt fra Core, herunder Community Profiles, som deles af en sektor. Tiers 1-4 (Partial, Risk Informed, Repeatable, Adaptive) karakteriserer, hvor stringent organisationens styring og ledelse af cyberrisici er.\n\nVersion 2.0 flyttede informative referencer og implementeringseksempler ud af PDF'en og over i onlineressourcer, især Cybersecurity and Privacy Reference Tool, hvor underkategorierne via OLIR-programmet er koblet til SP 800-53 Rev. 5, CIS Controls, ISO/IEC 27001 og andre kilder, og tilføjede Quick-Start Guides til små virksomheder og andre målgrupper. Selve rammeværket indeholder ingen kontroller, der skal implementeres; det peger på kataloger, der gør.\n\nTo misforståelser er udbredte. Tiers læses ofte som modenhedsniveauer, men NIST beskriver dem som et udtryk for, hvor stringent risikostyringen er, og kræver ikke, at en organisation sigter mod Tier 4 overalt. Og der findes ingen officiel certificering: konsulenters \"CSF-vurderinger\" er selvdefinerede evalueringer. Det er den væsentligste forskel fra ISO/IEC 27001, der kræver et ledelsessystem, som auditeres af akkrediterede organer; i praksis bruger mange organisationer CSF-funktionerne som rapporteringssprog over for bestyrelsen og ISO 27001-ISMS'et som det maskineri, der driver arbejdet, og ISO/IEC 27002 har lånt de fem oprindelige funktionsnavne som attributværdier for sine kontroller."},"edges":[{"type":"requires","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/security-framework","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/supplier-management","why":{"en":"Version 2.0 places supply chain risk management inside the Govern function.","da":"Version 2.0 placerer styring af risici i forsyningskæden under Govern-funktionen."},"confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)","url":"https://doi.org/10.6028/NIST.CSWP.29","tier":"standard","publisher":"NIST"},{"title":"NIST Releases Version 2.0 of Landmark Cybersecurity Framework","url":"https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework","tier":"official-doc","publisher":"NIST"}],"draft":true}