Fort Walton Beach Resolution — 2024-16 Adopting the National Institute of Standards Cybersecurity Framework — reading text

quickly. Cybersecurity risks are expanding constantly, and managing those risks must be a continuous process. This is true regardless of whether an organization is just beginning to confront its cybersecurity challenges or whether it has been active for many years with a sophisticated, well -resourced cybersecurity team. The CSF is designed to be valuable for any type of organization and is expected to provide appropriate guidance over a long time. MY NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 1. Cybersecurity Framework (CSF) Overview This document is version 2. 0 of the NIST Cybersecurity Framework (Framework or CSF). It includes the following components: CSF Core, the nucleus of the CSF, which is a taxonomy of high- level cybersecurity outcomes that can help any organization manage its cybersecurity risks. The CSF Core components are a hierarchy of Functions, Categories, and Subcategories that detail each outcome. These outcomes can be understood by a broad audience, including executives, managers, and practitioners, regardless of their cybersecurity expertise. Because the outcomes are sector-, country-, and technology -neutral, they provide an organization with the flexibility needed to address its unique risks, technologies, and mission considerations. CSF Organizational Profiles, which area mechanism for describing an organization' s current and/ or target cybersecurity posture in terms of the CSF Core' s outcomes. CSF Tiers, which can be applied to CSF Organizational Profiles to characterize the rigor of an organization' s cybersecurity risk governance and management practices. Tiers can also provide context for how an organization views cybersecurity risks and the processes in place to manage those risks. This document describes what desirable outcomes an organization can aspire to achieve. It does not prescribe outcomes nor how they may be achieved. Descriptions of how an organization can achieve those outcomes are provided in a suite of online resources that complement the CSF and are available through the NIST CSF website. These resources offer additional guidance on practices and controls that could be used to achieve outcomes and are intended to help an organization understand, adopt, and use the CSF. They include: Informative References that point to sources of guidance on each outcome from existing global standards, guidelines, frameworks, regulations, policies, etc. Implementation Examples that illustrate potential ways to achieve each outcome Quick -Start Guides that give actionable guidance on using the CSF and its online resources, including transitioning from previous CSF versions to version 2. 0 Community Profiles and Organizational Profile Templates that help an organization put the CSF into practice and set priorities for managing cybersecurity risks An organization can use the CSF Core, Profiles, and Tiers with the supplementary resources to understand, assess, prioritize, and communicate cybersecurity risks. Understand and Assess: Describe the current or target cybersecurity posture of part or all of an organization, determine gaps, and assess progress toward addressing those gaps. NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Prioritize: Identify, organize, and prioritize actions for managing cybersecurity risks that align with the organization' s mission, legal and regulatory requirements, and risk management and governance expectations. Communicate: Provide a common language for communicating inside and outside the organization about cybersecurity risks, capabilities, needs, and expectations. The CSF is designed to be used by organizations of all sizes and sectors, including industry, government, academia, and nonprofit organizations, regardless of the maturity level of their cybersecurity programs. The CSF is a foundational resource that may be adopted voluntarily and through governmental policies and mandates. The CSF' s taxonomy and referenced standards, guidelines, and practices are not country -specific, and previous versions of the CSF have been leveraged successfully by many governments and other organizations both inside and outside of the United States. The CSF should be used in conjunction with other resources ( e. g., frameworks, standards, guidelines, leading practices) to better manage cybersecurity risks and inform the overall management of information and communications technology ( ICT) risks at an enterprise level. The CSF is a flexible framework that is intended to be tailored for use by all organizations regardless of size. Organizations will continue to have unique risks — including different threats and vulnerabilities — and risk tolerances, as well as unique mission objectives and requirements. Thus, organizations' approaches to managing risks and their implementations of the CSF will vary. The remainder of this document is structured as follows: Section 2 explains the basics of the CSF Core: Functions, Categories, and Subcategories. Section 3 defines the concepts of CSF Profiles and Tiers. Section 4 provides an overview of selected components of the CSFs suite of online resources: Informative References, Implementation Examples, and Quick Start Guides. Section 5 discusses how an organization can integrate the CSF with other risk management programs. Appendix A is the CSF Core. Appendix B contains a notional illustration of the CSF Tiers. Appendix C is a glossary of CSF terminology. Lf6COA6l Hezbouq DGfGCj bLOSGCf IgeufitA eoAGLU Enuc iouz e e o iez 2npcg4r.RO. ie2 C%p61.26cnLitA ELSW65MOLK C066 I NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 improvement opportunities for the organization' s policies, plans, processes, procedures, and practices that support cybersecurity risk management to inform efforts under all six Functions. PROTECT ( PR) — Safeguards to manage the organization' s cybersecurity risks are used. Once assets and risks are identified and prioritized, PROTECT supports the ability to secure those assets to prevent or lower the likelihood and impact of adverse cybersecurity events, as well as to increase the likelihood and impact of taking advantage of opportunities. Outcomes covered by this Function include identity management, authentication, and access control; awareness and training; data security; platform security (i. e., securing the hardware, software, and services of physical and virtual platforms); and the resilience of technology infrastructure. DETECT ( DE) —Possible cybersecurity attacks and compromises are found and analyzed. DETECT enables the timely discovery and analysis of anomalies, indicators of compromise, and other potentially adverse events that may indicate that cybersecurity attacks and incidents are occurring. This Function supports successful incident response and recovery activities. RESPOND ( RS) — Actions regarding a detected cybersecurity incident are taken. RESPOND supports the ability to contain the effects of cybersecurity incidents. Outcomes within this Function cover incident management, analysis, mitigation, reporting, and communication. RECOVER ( RC) — Assets and operations affected by a cybersecurity incident are restored. RECOVER supports the timely restoration of normal operations to reduce the effects of cybersecurity incidents and enable appropriate communication during recovery efforts. While many cybersecurity risk management activities focus on preventing negative events from occurring, they may also support taking advantage of positive opportunities. Actions to reduce cybersecurity risk might benefit an organization in other ways, like increasing revenue ( e. g., first offering excess facility space to a commercial hosting provider for hosting their own and other organizations' data centers, then moving a major financial system from the organization' s in- house data center to the hosting provider to reduce cybersecurity risks). Figure 2 shows the CSF Functions as a wheel because all of the Functions relate to one another. For example, an organization will categorize assets under IDENTIFY and take steps to secure those assets under PROTECT. Investments in planning and testing in the GOVERN and IDENTIFY Functions will support timely detection of unexpected events in the DETECT Function, as well as enabling incident response and recovery actions for cybersecurity incidents in the RESPOND and RECOVER Functions. GOVERN is in the center of the wheel because it informs how an organization will implement the other five Functions.  DElECl SO 6' O O o r W LLgWGMOLK CAPGLzscm li A - M 121 C' OA EtS'A o y  HGb6Jf... F lwblGWGJf 9CfIOIJ biqu 9uq nbg9f6 bLOt! IG pEIECl lq a VU91ASG P9b2 9uq CLG9f6 9u 9CflOu bl9u O m EL9WGMOLK n CAP6L2GcnLl f A C1. 69f6 fpG OLRg1JIS9f! OlJ9l bLOt! IG 0121 C' OAEt5N `.`: Ir 00 ID 40 2COb6 fpG Cjl.Pa9uls9f! OU91 blOUG NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 1. Scope the Organizational Profile. Document the high- level facts and assumptions on which the Profile will be based to define its scope. An organization can have as many Organizational Profiles as desired, each with a different scope. For example, a Profile could address an entire organization or be scoped to an organization' s financial systems or to countering ransomware threats and handling ransomware incidents involving those financial systems. 2. Gather the information needed to prepare the Organizational Profile. Examples of information may include organizational policies, risk management priorities and resources, enterprise risk profiles, business impact analysis ( BIA) registers, cybersecurity requirements and standards followed by the organization, practices and tools (e. g., procedures and safeguards), and work roles. 3. Create the Organizational Profile. Determine what types of information the Profile should include for the selected CSF outcomes, and document the needed information. Consider the risk implications of the Current Profile to inform Target Profile planning and prioritization. Also, consider using a Community Profile as the basis for the Target Profile. 4. Analyze the gaps between the Current and Target Profiles, and create an action plan. Conduct a gap analysis to identify and analyze