Editorial · April 15, 2014
NIST Cybersecurity Framework: A Primer for Small Firms
The NIST Cybersecurity Framework is a voluntary guide to managing cyber risk. Its five functions give a small firm a concise way to grasp cyber risk. NIST, the National Institute of Standards and Technology, released version 1.0 on February 12, 2014. The functions are Identify, Protect, Detect, Respond and Recover. Think of them as five questions about your business.
The Framework was meant to help organizations that provide the nation's financial, energy, health care and other critical systems. Even so, NIST says the five functions, taken together, "allow any organization to understand and shape its cybersecurity program." NIST also says the Framework offers a common language for managing cyber risk "without placing additional regulatory requirements on businesses."
Where the Framework came from
President Obama issued Executive Order 13636 on February 12, 2013. It told the Secretary of Commerce to have NIST lead the work on a framework "to reduce cyber risks to critical infrastructure." The order set a one-year deadline for a final version. NIST released version 1.0 of the Framework for Improving Critical Infrastructure Cybersecurity one year to the day after the order.
NIST says a year-long effort built the Framework. Thousands of people and groups from industry, academia and government took part. The Framework draws on existing standards and practices. The order called for a voluntary program to help critical infrastructure owners and operators, and "any other interested entities," adopt the Framework. An interested small firm fits that wording.
The five functions in plain words
The Framework Core is built on five functions. NIST says they are not meant to be a step-by-step path to a fixed end state. A firm can work on all five at once. Under them sit 22 categories and 98 subcategories, which describe results to aim for. NIST says the Core "is not a checklist." A firm can pick the results most important to its business and risks.
Identify. What do you have, and what matters most? This function is about understanding the business context, the resources that support critical functions, and related cyber risks. Goals include having devices and software "inventoried." A small firm can start with a one-page list of its computers, phones, programs and online accounts. Add a note on where customer data lives.
Protect. How do you limit the harm? One goal is "Identities and credentials are managed for authorized devices and users." Others include "All users are informed and trained" and "Backups of information are conducted, maintained, and tested periodically." In a small shop, that can mean deciding who gets which passwords, briefing staff, and testing a backup before you need it.
Detect. How would you notice trouble? This function "enables timely discovery of cybersecurity events." Goals include "The network is monitored to detect potential cybersecurity events" and "Malicious code is detected." A small firm can ask who would see a warning from its security software, and who would act on it.
Respond. What do you do when you find trouble? One goal is "Response plan is executed during or after an event." Another is "Personnel know their roles and order of operations when a response is needed." A one-page list of who does what, and who to call, can be a first draft of the plan.
Recover. How do you get back to normal? This function supports "timely recovery to normal operations." The Core includes "Recovery plan is executed during or after an event." A small firm can write down how it would restore its files and who needs to be told.
Tiers and profiles
The Framework has two more parts. Tiers run from Partial (Tier 1) through Risk Informed and Repeatable to Adaptive (Tier 4). They show an increasing degree of rigor in managing cyber risk. NIST says Tiers "do not represent maturity levels."
A Profile is a firm's own pick of results from the Core. The Current Profile shows what the firm achieves today. The Target Profile shows what the firm wants. Comparing the two may reveal gaps, and an action plan can address them. Successful use of the Framework, NIST says, rests on achieving the outcomes in a firm's Target Profile, "not upon Tier determination." NIST's Cybersecurity Framework page offers the Core as an Excel file.
Seven steps for a small firm
NIST gives seven example steps for building or improving a cybersecurity program with the Framework. It says to repeat them as necessary.
- Set priorities and scope. Pick a business line or process.
- Orient. List systems and assets, rules that apply, how you handle risk, then threats and weak spots.
- Build a Current Profile. Mark the outcomes you already achieve.
- Assess risk. Judge how likely an event is and how much it could hurt.
- Build a Target Profile. Choose the outcomes you want. Customers and partners may shape the list.
- Rank the gaps. Compare Profiles. Plan fixes by business needs, risk, cost and benefit.
- Act, then repeat. Carry out the plan, check your progress, and run the steps again as needed.
A firm with no cybersecurity program can use the Framework "as a reference to establish one," NIST says.
What to know before you start
NIST calls the Framework a "living document" that will be updated as industry gives feedback. It is also "not a one-size-fits-all approach," and how a firm uses it will vary.
Outside help is still taking shape. The Department of Homeland Security launched a voluntary program for the Framework in February 2014. In its first year, DHS says, the program will work with sector agencies and organizations using the Framework to develop guidance. DHS adds that later phases will reach "businesses of all sizes that are interested in using the Framework." NIST's Roadmap says industry groups, associations and non-profits "can be key vehicles for strengthening awareness of the Framework." If your firm belongs to a trade association, ask if it plans to help.
The Framework also offers a shared language for partners. A firm can use a Current Profile to report results or to compare with purchasing requirements. It can use a Target Profile to state its cybersecurity requirements to an outside provider, such as a cloud provider.
For the basics, NIST also has a small business guide from October 2009, Small Business Information Security: The Fundamentals. It lists actions it calls "absolutely necessary," such as backing up important business data and training employees.