{"id":310,"date":"2025-12-08T20:12:08","date_gmt":"2025-12-08T20:12:08","guid":{"rendered":"https:\/\/sites.wp.odu.edu\/andrewcho\/?p=310"},"modified":"2025-12-08T20:12:08","modified_gmt":"2025-12-08T20:12:08","slug":"discussion-board-the-nist-cybersecurity-framework","status":"publish","type":"post","link":"https:\/\/sites.wp.odu.edu\/andrewcho\/2025\/12\/08\/discussion-board-the-nist-cybersecurity-framework\/","title":{"rendered":"Discussion Board: The NIST Cybersecurity Framework"},"content":{"rendered":"\n<p>The Strategic Value of the NIST Cybersecurity Framework<\/p>\n\n\n\n<p>After reviewing the introduction and core sections (pp. 1-21) of the NIST Cybersecurity Framework (CSF), it&#8217;s clear that its primary benefit is not as a rigid set of technical controls, but as a&nbsp;strategic tool for aligning cybersecurity risk management with business objectives.&nbsp;It provides a common language and a flexible structure that allows organizations of any size or sector to understand, manage, and communicate their cybersecurity risks effectively.<\/p>\n\n\n\n<p>The key benefits an organization can gain include:<\/p>\n\n\n\n<ol start=\"1\">\n<li>Risk-Based Prioritization:&nbsp;The CSF moves the conversation from &#8220;we need to secure everything&#8221; to &#8220;what are our most critical assets and how do we protect them?&#8221; By focusing on the&nbsp;Framework Core&nbsp;functions (Identify, Protect, Detect, Respond, Recover), organizations can prioritize investments based on what will most effectively mitigate their biggest risks.<\/li>\n\n\n\n<li>Improved Communication:&nbsp;The CSF bridges the gap between technical teams, executives, and board members. It provides a standardized taxonomy so that a CISO can explain a security gap or investment need in terms of business impact (e.g., &#8220;We need to improve our detect&nbsp;function to reduce our mean time to identify a breach&#8221;) rather than using complex technical jargon.<\/li>\n\n\n\n<li>Flexibility and Adaptability:&nbsp;The framework is not one-size-fits-all. It is designed to be tailored. Organizations can use the&nbsp;Implementation Tiers&nbsp;(pp. 15-17) to assess their current cybersecurity practices and chart a path toward a more rigorous and adaptive risk management program. This allows a small startup and a large financial institution to use the same framework effectively at their respective maturity levels.<\/li>\n\n\n\n<li>Gap Analysis and Continuous Improvement:&nbsp;The CSF&#8217;s profile&nbsp;mechanism (pp. 17-18) is perhaps its most powerful feature. By creating a &#8220;Current Profile&#8221; and a &#8220;Target Profile,&#8221; an organization can clearly identify gaps in its cybersecurity posture. This creates a direct, actionable roadmap for improvement, turning abstract security goals into a concrete plan.<\/li>\n<\/ol>\n\n\n\n<p>How I Would Use the NIST CSF at my future workplace:<\/p>\n\n\n\n<p>In my future role as a cybersecurity professional, I would advocate for using the NIST CSF as the foundational model for our cybersecurity program. Here is a step-by-step approach I would propose:<\/p>\n\n\n\n<ol start=\"1\">\n<li>Gain Executive Buy-in:&nbsp;I would first present the framework to leadership, emphasizing its benefits as a business risk tool, not just an IT checklist. I&#8217;d explain how it helps fulfill legal\/regulatory obligations, protect brand reputation, and ensure operational resilience.<\/li>\n\n\n\n<li>Conduct a Collaborative Assessment:\u00a0I would facilitate workshops with key stakeholders from IT, legal, finance, and operations to:\n<ul>\n<li>Identify Critical Assets:&nbsp;What data, systems, and capabilities are most vital to our business mission? (The&nbsp;Identify&nbsp;function).<\/li>\n\n\n\n<li>Create a Current Profile:&nbsp;Map our existing security controls, policies, and processes to the Subcategories within the CSF Core. This honestly assesses &#8220;where we are today.&#8221;<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Develop a Target Profile:&nbsp;Working with the same stakeholders, we would define &#8220;where we want to be.&#8221; This Target Profile would be based on our organizational risk tolerance, industry best practices, and any specific regulatory requirements we must meet.<\/li>\n\n\n\n<li>Analyze Gaps and Prioritize Actions:&nbsp;By comparing the current and target profiles, we would generate a prioritized list of gaps. This allows us to develop a practical and budget-conscious action plan. For example, the analysis might reveal that our respond&nbsp;function is weak because we lack an incident response plan. This gap would become a top priority for the next quarter.<\/li>\n\n\n\n<li>Implement and Iterate:&nbsp;We would execute the action plan to move from the current to the target profile. Crucially, I would emphasize that this is not a one-time project. The CSF is a cycle for&nbsp;continuous improvement. We would regularly reassess our profiles, especially after a major incident, a business change, or the emergence of new threats, ensuring our cybersecurity program remains adaptive and aligned with the business.<\/li>\n<\/ol>\n\n\n\n<p>In essence, I would use the NIST CSF not to create more paperwork, but to build a smarter, more business-focused, and continuously improving cybersecurity program that everyone\u2014from technicians to the board\u2014can understand and support.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Strategic Value of the NIST Cybersecurity Framework After reviewing the introduction and core sections (pp. 1-21) of the NIST Cybersecurity Framework (CSF), it&#8217;s clear that its primary benefit is not as a rigid set of technical controls, but as a&nbsp;strategic tool for aligning cybersecurity risk management with business objectives.&nbsp;It provides a common language and &hellip; <a href=\"https:\/\/sites.wp.odu.edu\/andrewcho\/2025\/12\/08\/discussion-board-the-nist-cybersecurity-framework\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Discussion Board: The NIST Cybersecurity Framework<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":31485,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wds_primary_category":0},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/posts\/310"}],"collection":[{"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/users\/31485"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/comments?post=310"}],"version-history":[{"count":1,"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/posts\/310\/revisions"}],"predecessor-version":[{"id":311,"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/posts\/310\/revisions\/311"}],"wp:attachment":[{"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/media?parent=310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/categories?post=310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/andrewcho\/wp-json\/wp\/v2\/tags?post=310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}