Fort Walton Beach Resolution — 2024-16 Adopting the National Institute of Standards Cybersecurity Framework — reading text

the differences between the Current and Target Profiles, and develop a prioritized action plan ( e. g., risk register, risk detail report, Plan of Action and Milestones [ POA& M]) to address those gaps. 5. Implement the action plan, and update the Organizational Profile. Follow the action plan to address the gaps and move the organization toward the Target Profile. An action plan may have an overall deadline or be ongoing. Given the importance of continual improvement, an organization can repeat these steps as often as needed. There are additional uses for Organizational Profiles. For example, a Current Profile can be used to document and communicate the organization' s cybersecurity capabilities and known opportunities for improvement with external stakeholders, such as business partners or prospective customers. Also, a Target Profile can help express the organization' s cybersecurity risk management requirements and expectations to suppliers, partners, and other third parties as a target for those parties to achieve. 3. 2. CSF Tiers An organization can choose to use the Tiers to inform its Current and Target Profiles. Tiers characterize the rigor of an organization' s cybersecurity risk governance and management practices, and they provide context for how an organization views cybersecurity risks and the processes in place to manage those risks. The Tiers, as shown in Fig. 4 and notionally illustrated in Appendix B, reflect an organization' s practices for managing cybersecurity risk as Partial ( Tier 1), Risk Informed ( Tier 2), Repeatable ( Tier 3), and Adaptive (Tier 4). The Tiers describe a progression from informal, ad hoc responses to approaches that are agile, risk -informed, and b91I19l JUJOLWGq 1i6L 1 Ifl2K- L!GL 3 Y6b69j9pjG 116L 3 dg9bf! AG 1i6L il NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 4. Introduction to Online Resources That Supplement the CSF NIST and other organizations have produced a suite of online resources that help organizations understand, adopt, and use the CSF. Since they are hosted online, these additional resources can be updated more frequently than this document, which is updated infrequently to provide stability to its users, and be available in machine- readable formats. This section provides an overview of three types of online resources: Informative References, Implementation Examples, and Quick Start Guides. Informative References are mappings that indicate relationships between the Core and various standards, guidelines, regulations, and other content. Informative References help inform how an organization may achieve the Core' s outcomes. Informative References can be sector- or technology -specific. They may be produced by NIST or another organization. Some Informative References are narrower in scope than a Subcategory. For example, a particular control from SP 800- 53, Security and Privacy Controls for Information Systems and Organizations, may be one of many references needed to achieve the outcome described in one Subcategory. Other Informative References may be higher- level, such as a requirement from a policy that partially addresses numerous Subcategories. When using the CSF, an organization can identify the most relevant Informative References. Implementation Examples provide notional examples of concise, action -oriented steps to help achieve the outcomes of the Subcategories. Verbs used to express Examples include share, document, develop, perform, monitor, analyze, assess, and exercise. The Examples are not a comprehensive list of all actions that could be taken by an organization to achieve an outcome, nor do they represent a baseline of required actions to address cybersecurity risks. Quick -Start Guides ( QSGs) are brief documents on specific CSF -related topics and are often tailored to specific audiences. QSGs can help an organization implement the CSF because they distill specific portions of the CSF into actionable " first steps" that an organization can consider on the path to improving their cybersecurity posture and management of associated risks. The guides are revised in their own time frames, and new guides are added as needed. Suggestions for new Informative References for CSF 2. 0 can always be shared with NIST at olir@nist. gov. Suggestions for other resources to reference on the NIST CSF website, including additional QSG topics, should be directed to cyberframework@nist. gov.  0* bLscfifiOusL2 4$ W bLoaL622 I1 Wbi6W6ups iou bLo} i162 LL9WGMOLK 0 W9usa6L2 Bnga6t suq Ln4nLG IS12K lSt2K Vbb6Fij6 suq Cpsua62iu CnLL6u4 W1221OU buouTA suq EXGC" f!n62 Iii vw NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Preparing to create and use Organizational Profiles involves gathering information about organizational priorities, resources, and risk direction from executives. Managers then collaborate with practitioners to communicate business needs and create risk -informed Organizational Profiles. Actions to close any gaps identified between the Current and Target Profiles will be implemented by managers and practitioners and will provide key inputs into system -level plans. As the target state is achieved throughout the organization — including through controls and monitoring applied at the system level — the updated results can be shared through risk registers and progress reports. As part of ongoing assessment, managers gain insights to make adjustments that further reduce potential harms and increase potential benefits. The GOVERN Function supports organizational risk communication with executives. Executives' discussions involve strategy, particularly how cybersecurity- related uncertainties might affect the achievement of organizational objectives. These governance discussions support dialogue and agreement about risk management strategies ( including cybersecurity supply chain risk); roles, responsibilities, and authorities; policies; and oversight. As executives establish cybersecurity priorities and objectives based on those needs, they communicate expectations about risk appetite, accountability, and resources. Executives are also responsible for integrating cybersecurity risk management with ERM programs and lower -level risk management programs ( see Sec. 5. 2). The communications reflected in the top half of Fig. 5 can include considerations for ERM and the lower -level programs and, thus, inform managers and practitioners. The overall cybersecurity objectives set by executives are informed by and cascade to managers. In a commercial entity, these may apply to a line -of -business or operating division. For government entities, these may be division- or branch -level considerations. When implementing the CSF, managers will focus on how to achieve risk targets through common services, controls, and collaboration, as expressed in the Target Profile and improved through the actions being tracked in the action plan ( e. g., risk register, risk detail report, POA& M). Practitioners focus on implementing the target state and measuring changes in operational risk to help plan, carry out, and monitor specific cybersecurity activities. As controls are implemented to manage risk at an acceptable level, practitioners provide managers and executives with the information (e. g., key performance indicators, key risk indicators) they need to understand the organization' s cybersecurity posture, make informed decisions, and maintain or adjust the risk strategy accordingly. Executives can also combine this cybersecurity risk data with information about other types of risk from across the organization. Updates to expectations and priorities are included in updated Organizational Profiles as the cycle repeats. 5. 2. Improving Integration with Other Risk Management Programs Every organization faces numerous types of ICT risk (e. g., privacy, supply chain, artificial intelligence) and may use frameworks and management tools that are specific to each risk. Some organizations integrate ICT and all other risk management efforts at a high level by using ERM, while others keep the efforts separate to ensure adequate attention on each. Small 11 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 organizations by their nature may monitor risk at the enterprise level, while larger companies may maintain separate risk management efforts integrated into the ERM. Organizations can employ an ERM approach to balance a portfolio of risk considerations, including cybersecurity, and make informed decisions. Executives receive significant input about current and planned risk activities as they integrate governance and risk strategies with results from previous uses of the CSF. The CSF helps organizations to translate their terminology for cybersecurity and cybersecurity risk management into general risk management language that executives will understand. NIST resources that describe the mutual relationship between cybersecurity risk management and ERM include: NIST Cybersecurity Framework 2. 0 —Enterprise Risk Management Quick -Start Guide NIST Interagency Report ( IR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) IR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management IR 828613, Prioritizing Cybersecurity Risk for Enterprise Risk Management IR 8286C, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight IR 8286D, Using Business Impact Analysis to Inform Risk Prioritization and Response isk: SP 800- 221, Enterprise Impact of Information and Communications Technology Risk.- Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio SP 800- 221A, Information and Communications Technology (ICT) Risk Outcomes: Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio An organization may also find the CSF beneficial for integrating cybersecurity risk management with individual ICT risk management programs, such as: Cybersecurity risk management and assessment: The CSF can be integrated with established cybersecurity risk management and assessment programs, such as SP 800- 37, Risk Management Framework for Information Systems and Organizations, and SP 800- 30, Guide for Conducting Risk Assessments from the NIST Risk Management Framework ( RMF). For an organization using the NIST RMF and its suite of publications, the CSF can be used to complement the RMF' s approach to selecting and prioritizing controls from SP 800- 53, Security and Privacy Controls for Information Systems and Organizations. Privacy risks: While cybersecurity and privacy are independent disciplines, their objectives overlap in certain circumstances, as illustrated in Fig. 6. 12  uieauwOL gAgllgp!I! IA bLocszaiui5 4 loaa of ooupqeujigji&