This is an introduction to the National Institute of Standards and Technology Cybersecurity Framework also known as the CSF. This program is designed to provide you an understanding of the NIST Cybersecurity Framework and how to implement it. The seven-step process helps organizations use the CSF to establish a strong cybersecurity program or to validate the effectiveness of an existing program. It enables organizations to map their existing programs to the CSF, identify improvements, and communicate results, as well as incorporate and align with processes and tools the organization is already using or plans to use. This approach can be used along with any cybersecurity standard, frameworks like NIST 800-53, NIST 800-171, ISO 27,000 for mapping cybersecurity risks to facilitate the cybersecurity framework implementation. Each step is introduced by a table describing the step's inputs, activities, and outputs. In step 1, prioritize and scope. The organization decides how and where it wants to use a cybersecurity framework; its framework usage and scope, whether in a subset of its operations, in multiple subsets of its operations, or for the entire organization. This decision should be based on the risk management considerations, organizational and critical infrastructure objectives and priorities, and availability of resources, as well as other internal and external factors. The purpose is to obtain an understanding of the organizational governance approach to inform risk assessment activities and to prioritize security activities. The organization will look at the risk architecture, business drivers, and compliance requirements. Remember, each step is introduced by a table describing the step's inputs, activities, and outputs. This slide shows you the example of these inputs, activities, and outputs. For example, if the input was enterprise policies, strategies, governance, and business plans, the activity might be identify key executive broad-level stakeholders that authoritatively speak to the mission drivers and risk appetites and the outputs might be enterprise architecture vision. In this step, orient. The organization identifies the systems, assets requirements, and risk management approaches that are in scope. This includes standards and practices the organization already uses and could include additional standards and practices that the organization believes would help achieve its critical infrastructure and business objectives for cybersecurity risk management. The purpose is to gain an understanding of the organizational systems and assets that enable the mission described in step 1; determining specific IT goals for protecting those systems in accordance with the business impact requirements. As well as determination should include any downstream dependencies for identified systems and assets, such as facilities in which the technology resides, operators that ensure equipment functions safely, and infrastructure that delivers products to the customer. The organization should be able to determine the availability goals and/or recovery goals for identified systems and assets in order to provide stakeholder value and fulfill organizational obligations such as : contractual availability requirements, critical infrastructure service requirements, service level agreements, etc. In addition, they should understand the overarching threats to and vulnerabilities of those systems and use current profile templates to achieve current outcome achievement levels. In step 3, create a current profile. The organization creates a current profile and identifies its current implementation tier by mapping the existing cybersecurity and risk management practices to specific descriptions in the cybersecurity framework. You see in the slide here where we have grabbed the functional area protect, the category of access control, and then the subcategory of PR.AC-3: Remote access is managed. In this case, the informative reference that the organization is using is NIST 800-53 Rev. 4. You see the controls identified for this profile: AC-17, AC-17 subsection 1 and 2, AC-19, AC-20, and AC-20 subsection 1. These are the profiles that the organization would use in order to map to that particular functional area. We then grab those and create our input activities and outputs. In step 4, conduct a risk assessment. Organizations perform a cybersecurity risk assessment to identify and evaluate cybersecurity risks and determine which are outside of current tolerances. The outputs of cybersecurity risk assessment activities assist the organization in developing its target profile and identifying a target implementation tier which occurs in the next step; step 5, create a target profile. The purpose of step 4; the risk assessment, is to gain an understanding of the security specific goals for the organizational systems and assets that enable the missions described in step 1; to attain stake holder risk management goals. Having identified overarching threats to and vulnerabilities of those systems and assets, we can discern the likelihood of a cybersecurity event and the potential organizational impact. In step 5, create a target profile. The organization should consider the current risk management practices, current risk environment, legal and regulatory requirements, business and mission objectives, as well as organizational constraints. The target profile identifies the desired category and subcategory outcomes, and associated cybersecurity, and risk management standards, tools, methods, and guidelines that might mitigate cybersecurity risks commensurate with the risks to the organization and critical infrastructure security objectives. In step 6, determine, analyze, and prioritize gaps. The organization evaluates its current profile and implementation tier against the target profile and target implementation tier and identifies any gaps. The purpose is to understand what actions are required to attain stakeholder goals through identification of gaps between the current and target environments and align with organizational priorities and resources. Here you'll see that we're using the functional area of protect, the category of access control, the subcategory of remote access is managed. The current informative references listed as NIST 800-53, AC-17, AC-17 subsection 1, AC-17 subsection 2, AC-19, AC-20, and AC-20 subsection 1. Then you see the target profiles, which controls are we looking to implement. In this case, we're looking for AC-17, AC-17 subsection 1, 2, 3, and 4, AC-19, AC-19 subsection 5, AC-20, AC-20 subsection 1 and 2. Then we identify where are our gaps between the current controls and the target controls that we want to implement. In this case, you see that we have identified NIST 800-53 Rev. 4. AC-17(3) is a missing control, so we want to put that as our gap. AC-17(4) is a missing control, so we list that as a gap. AC-19(5) and AC-20 subsection 2 are also identified gaps for our controls. On the screen you see an example of a tool that I've included which allows you to list the functional area category, the baseline, current state, and target state for your systems and then we'll allow you to see the gap between the two. In step 7, the final step, implementation action plan. This is where the organization executes the implementation plan and tracks its progress over time ensuring that the gaps that we identified in step 6 are closed and risks are monitored. The purpose is to execute the plan as defined in the previous steps, to address the gaps and improve security to achieve stakeholder goals in a prioritized and cost-effective manner. In summary, in this course, we have discussed the seven-steps CSF process. Step 1, prioritize and scope. This is the implementation of tiers which may be used to express varying risk tolerances. Step 2, orient. Step 3, create a current profile. Step 4, conduct a risk assessment. Step 5, create a target profile. Step 6, determine, analyze, and prioritize our gaps based on our current controls against our target controls, and then the final step, implementation of the action plan to close those gaps and then remediate anything that is listed on our plan of action and milestones.