A framework is a structure you can build upon whether actual or conceptual. A framework is a starting point to assist in development to guide and make the process speed up to best reach the goals. It is also a common language to express risk to stakeholders.1  The word framework describes its own purpose of describing the basics needed to complete a task instead of starting from scratch. There are many types of frameworks such as hardware frameworks and software frameworks for example. A framework is based on completing the outcomes in the organization’s Target Profile(s) and not tier determination.2

There are also framework cores:

1. Functions (Identity, Protect, Detect, Respond, and Recover): Functions help in expressing cyber risk by organizing, assisting in risk-level decisions, fighting threats, and tracking previous history. 3

2. Categories: Subdivdes a function into a group of outcomes based on activities and needs.4

3. Subcategories: Divide categories into outcomes of activities and help achieve them.5

4. Informative Responses: Specific sections that illustrate a way to accomplish outcomes for each subcategory.6

The 5 NISTs or 5 framework core functions in order are:

1. Identify: One needs to understand the risks and spot them as or before they occur to systems, data, etc.

2. Protect: Protection plans should be established on what to do in case a threat occurs.

3. Detect: Systems should be in place to make decisions on whether an attack is actually happening, on what type of attack, and where they are attacking.

4. Respond: By doing the other 3 steps one should be able to respond in a timely manner with a solution to best counter the incident in a timely manner.

5. Recover: Figure out if any systems were breached or vulnerable, make sure no data was taken, figure out how to make sure protections are back in place, and what can be done to prevent this next time.

Reference/Footnotes: 

1-6Barrett, M. P. (2020, January 27). Framework for improving critical infrastructure cybersecurity version 1.1. NIST. https://www.nist.gov/publications/framework-improving-critical-infrastructure-cybersecurity-version-11