Fort Walton Beach Resolution — 2024-16 Adopting the National Institute of Standards Cybersecurity Framework — reading text

04: Critical mission functions and cybersecurity risk management are considered to establish post -incident operational norms o RC. RP- 05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed o RC. RP- 06: The end of incident recovery is declared based on criteria, and incident - related documentation is completed Incident Recovery Communication ( RC. CO): Restoration activities are coordinated with internal and external parties o RC. CO- 03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders o RC. CO- 04: Public updates on incident recovery are shared using approved methods and messaging 23 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Appendix B. CSF Tiers Table 2 contains a notional illustration of the CSF Tiers discussed in Sec. 3. The Tiers characterize the rigor of an organization' s Cybersecurity risk governance practices ( GOVERN) and Cybersecurity risk management practices ( IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER). Table 2. Notional Illustration of the CSF Tiers Tier Cybersecurity Risk Governance Cybersecurity Risk Management Tier 1: Application of the organizational There is limited awareness of cybersecurity risks at the Partial cybersecurity risk strategy is managed organizational level. in an ad hoc manner. The organization implements cybersecurity risk Prioritization is ad hoc and not management on an irregular, case- by- case basis. formally based on objectives or threat The organization may not have processes that enable environment. cybersecurity information to be shared within the organization. The organization is generally unaware of the cybersecurity risks associated with its suppliers and the products and services it acquires and uses. Tier 2: Risk Risk management practices are There is an awareness of cybersecurity risks at the Informed approved by management but may organizational level, but an organization -wide approach not be established as organization- to managing cybersecurity risks has not been wide policy. established. The prioritization of cybersecurity Consideration of cybersecurity in organizational activities and protection needs is objectives and programs may occur at some but not all directly informed by organizational levels of the organization. Cyber risk assessment of risk objectives, the threat organizational and external assets occurs but is not environment, or business/ mission typically repeatable or reoccurring. requirements. Cybersecurity information is shared within the organization on an informal basis. The organization is aware of the cybersecurity risks associated with its suppliers and the products and services it acquires and uses, but it does not act consistently or formally in response to those risks. Tier 3: The organization' s risk management There is an organization -wide approach to managing Repeatable practices are formally approved and cybersecurity risks. Cybersecurity information is expressed as policy. routinely shared throughout the organization. Risk -informed policies, processes, and Consistent methods are in place to respond effectively procedures are defined, implemented to changes in risk. Personnel possess the knowledge and as intended, and reviewed. skills to perform their appointed roles and responsibilities. Organizational cybersecurity practices are regularly updated based on the The organization consistently and accurately monitors application of risk management the cybersecurity risks of assets. Senior cybersecurity processes to changes in and non- cybersecurity executives communicate business/ mission requirements, regularly regarding cybersecurity risks. Executives threats, and technological landscape. ensure that cybersecurity is considered through all lines of operation in the organization. 24 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Tier Cybersecurity Risk Governance Cybersecurity Risk Management The organization risk strategy is informed by the cybersecurity risks associated with its suppliers and the products and services it acquires and uses. Personnel formally act upon those risks through mechanisms such as written agreements to communicate baseline requirements, governance structures ( e. g., risk councils), and policy implementation and monitoring. These actions are implemented consistently and as intended and are continuously monitored and reviewed. Tier 4: There is an organization -wide The organization adapts its cybersecurity practices Adaptive approach to managing cybersecurity based on previous and current cybersecurity activities, risks that uses risk -informed policies, including lessons learned and predictive indicators. processes, and procedures to address Through a process of continuous improvement that potential cybersecurity events. The incorporates advanced cybersecurity technologies and relationship between cybersecurity practices, the organization actively adapts to a changing risks and organizational objectives is technological landscape and responds in a timely and clearly understood and considered effective manner to evolving, sophisticated threats. when making decisions. Executives The organization uses real- time or near real- time monitor cybersecurity risks in the information to understand and consistently act upon the same context as financial and other cybersecurity risks associated with its suppliers and the organizational risks. The organizational products and services it acquires and uses. budget is based on an understanding of the current and predicted risk Cybersecurity information is constantly shared throughout the organization and with authorized third environment and risk tolerance. parties. Business units implement executive vision and analyze system -level risks in the context of the organizational risk tolerances. Cybersecurity risk management is part of the organizational culture. It evolves from an awareness of previous activities and continuous awareness of activities on organizational systems and networks. The organization can quickly and efficiently account for changes to business/ mission objectives in how risk is approached and communicated. 25 NIST CSWP 29 The NIST Cybersecurity Framework ( CSF) 2. 0 February 26, 2024 Appendix C. Glossary CSF Category A group of related cybersecurity outcomes that collectively comprise a CSF Function. CSF Community Profile A baseline of CSF outcomes that is created and published to address shared interests and goals among a number of organizations. A Community Profile is typically developed for a particular sector, subsector, technology, threat type, or other use case. An organization can use a Community Profile as the basis for its own Target Profile. CSF Core A taxonomy of high- level cybersecurity outcomes that can help any organization manage its cybersecurity risks. Its components are a hierarchy of Functions, Categories, and Subcategories that detail each outcome. CSF Current Profile A part of an Organizational Profile that specifies the Core outcomes that an organization is currently achieving (or attempting to achieve) and characterizes how or to what extent each outcome is being achieved. CSF Function The highest level of organization for cybersecurity outcomes. There are six CSF Functions: Govern, Identify, Protect, Detect, Respond, and Recover. CSF Implementation Example A concise, action -oriented, notional illustration of a way to help achieve a CSF Core outcome. CSF Informative Reference A mapping that indicates a relationship between a CSF Core outcome and an existing standard, guideline, regulation, or other content. CSF Organizational Profile A mechanism for describing an organization' s current and/ or target cybersecurity posture in terms of the CSF Core' s outcomes. CSF Quick Start Guide A supplementary resource that gives brief, actionable guidance on specific CSF -related topics. CSF Subcategory A group of more specific outcomes of technical and management cybersecurity activities that comprise a CSF Category. CSF Target Profile A part of an Organizational Profile that specifies the desired Core outcomes that an organization has selected and prioritized for achieving its cybersecurity risk management objectives. CSF Tier A characterization of the rigor of an organization' s cybersecurity risk governance and management practices. There are four Tiers: Partial ( Tier 1), Risk Informed (Tier 2), Repeatable ( Tier 3), and Adaptive ( Tier 4). 26 NIST CSWP 29