Introduction:

The NIST Cybersecurity Framework is the foundation for creating cybersecurity programs in many organizations. This reflection serves the purpose of understanding what benefits organizations can gain from using the framework and how it can be used in my future workplace, based on information gathered from the reading.

Reading: NIST Cybersecurity Framework (CSF 2.0)

As one of the CSF’s core functions, the govern function stands out because it shows the importance of cybersecurity when planning and implementing new technology for a company. Rolling out new technology comes with new risks that anyone in leadership or project management should be aware of from the outset. Governance should be used to establish the risks, responsibilities, expectations, and authorities from the beginning, as opposed to waiting until the technology is implemented to identify if it is secure.

Additionally, the CSF Functions are presented as a wheel because each function relates to one another. The article states that all functions should be addressed at the same time and should happen continuously. This comment stood out to me because it shows that cybersecurity is not a one-time process but one that should be ongoing. Technology advancement and threats are ongoing, so it is important for organizations to continuously assess and identify risks for protection, while also creating a response and recovery plan in the event that an attack occurs. In a future workplace, I would use this as an ongoing technology project.

According to the reading, a CSF Profile is one that describes an organization’s cybersecurity posture based on the Core’s outcomes. By using an organization profile, they could make continuous improvements to their cybersecurity. Within the profile, there are five steps for creating and using a CSF Profile. From my reading, a classmate and I agreed that step 4 of the CSF Organization Profile is a very important one, as identifying cybersecurity weaknesses is only half the battle; the other half is knowing how to fix them. By conducting a gap analysis by comparing the current vs. target profile, organizations should prioritize which risks to address first. In the workplace, funding, staffing, and limited time are factors that can impact how many risks can be addressed. The CSF would be very helpful in creating an action plan to prioritize risks.