Why it exists
Every organization relies on devices, accounts, and data. Attackers target the weakest of these, so security is about reducing risk across all of them — not buying one tool.
How it works
- 1Identify what you have (devices, software, data, accounts)
- 2Protect it with controls like MFA, patching, and backups
- 3Detect suspicious activity
- 4Respond to incidents
- 5Recover operations
Real-world example
A small firm inventories its laptops, turns on MFA for email, schedules automatic patching, and tests restoring a backup. Those steps map directly to the NIST CSF functions.
Common misconceptions
- “We're too small to be targeted.” Many attacks are automated and indiscriminate.
- “Antivirus is enough.” It is one layer among several.
Benefits
- Provides a shared vocabulary for buying decisions
- Helps prioritize spending
Limitations
- Frameworks describe outcomes, not specific products
- No control eliminates risk entirely
How it differs from related technologies
Fundamentals are the foundation; every category below (EDR, Zero Trust, application control) is a specific way of achieving one or more of these outcomes.
Questions a buyer should ask
- Which NIST CSF functions does this product support?
- What must already be in place for it to work well?
Learning path
beginner
- • Read the NIST CSF 2.0 overview
- • Learn the terms: asset, vulnerability, threat, control
intermediate
- • Map your current tools to the CSF functions
- • Review the CIS Critical Security Controls
advanced
- • Build a risk register and prioritize gaps
- • Define metrics for each control
Check your understanding
Which of these is one of the NIST CSF 2.0 functions?