Govern (GV)
Establish, communicate and monitor the cybersecurity risk-management strategy, expectations and policy.
International (US-originated, globally adopted) · National Institute of Standards and Technology (NIST), USA · NIST CSF 2.0
NIST Cybersecurity Framework
A risk-based framework structured around six functions - Govern, Identify, Protect, Detect, Respond and Recover.
What it is
The NIST CSF is a voluntary, outcome-based framework used worldwide to describe and manage cybersecurity risk. v2.0 introduced the Govern function alongside the original five, bringing board-level accountability, risk management and supply-chain risk into the core. The CSF is one of the permitted cybersecurity frameworks under the Australian CIRMP Rules, and is commonly used as a common language between security teams, auditors and executives.
Who it applies to
Any organisation. Often adopted as a governance backbone by Australian regulated entities who need a common structure across ISM, Essential Eight, ISO 27001 and PCI DSS.
Requirements
Identify (ID)
Determine current cybersecurity risk to the organisation, including assets, risks and governance context.
Protect (PR)
Safeguards to manage cybersecurity risks through access control, awareness and data security.
Detect (DE)
Find and analyse possible cybersecurity attacks and compromises through continuous monitoring.
Respond (RS)
Take action regarding a detected cybersecurity incident through containment, communications and analysis.
Recover (RC)
Restore assets and operations impacted by a cybersecurity incident through recovery planning and improvement.
Read next
Other places this turns up on the site.
Security, engineered around you.
Talk to an engineer - not a call centre. Most Vectra conversations start with a 30-minute technical briefing and end with a written plan.