Implementing the NIST Cybersecurity Framework 2.0
Master the NIST CSF 2.0 framework, focusing on its six Functions to enhance cybersecurity risk management.
What you'll learn
- Describe the purpose, structure, and updates of the NIST Cybersecurity Framework 2.0
- Navigate the CSF Core from Functions and Categories to Subcategories and outcomes
- Apply the Govern, Identify, Protect, Detect, Respond, and Recover Functions in cybersecurity risk management
- Develop Current and Target Organizational Profiles aligned with business needs and priorities
- Assess and prioritize discrepancies between current capabilities and desired cybersecurity results
- Utilize CSF Tiers correctly without treating them as maturity assessments or certification standards
- Create a realistic CSF implementation roadmap with responsibilities, dependencies, milestones, and performance measures
- Effectively communicate cybersecurity risks, developments, options, and resource requirements to leadership
Course outline
10 sections · 45 lessons · 5h 21m total
Why NIST 2.0
- Why NIST 2.0 05:19
- Meet the Six Pillars 03:04
- Inside the CSF Core 06:17
- Outcomes, Actions, Controls, and Evidence 05:14
- Implementation Examples and Informative References 06:19
- How Organizations Put the CSF to Work 06:35
Decode the CSF Core
- Organizational Context & Risk Strategy 05:57
- Roles, Responsibilities, & Authorities 07:49
- Policy & Third-Party Risk Governance 09:06
Build a Cybersecurity Governance Map
- Physical & Software Asset Management 07:35
- Mapping Data Flows & System Interdependencies 07:17
- Assessing Cyber Vulnerabilities 07:55
- Third-Party Risk Assessment 09:11
Build an Organizational Risk Picture
- Identity Management & Access Control 08:04
- Awareness & Training 07:45
- Data Security & Cryptography 07:48
- Platform & Network Security 09:11
Design a Layered Protection Plan
- Continuous Security Monitoring 07:47
- Finding Anomalies & Indicators of Compromise 05:58
- Adverse Event Detection & Validation 06:55
Direct an Incident Response
- Response Planning & Execution 06:35
- Incident Analysis & Triaging 06:07
- Containment, Mitigation, & Communication 07:12
Restore Operations with Confidence
- Recovery Planning & Execution 07:02
- Backup Management & Infrastructure Restoration 07:02
- Recovery Communication and Returning to Operations 06:39
- Incident Evidence and Continuous Improvement 07:07
Build Profiles and Analyze Gaps
- What Organizational Profiles Are and Why They Matter 06:30
- Establishing Profile Scope and Context 07:32
- Building the Current Profile 07:17
- Building the Target Profile 07:07
- Analyzing and Prioritizing Gaps 07:39
- Converting Profile Gaps into an Action Plan 06:54
Apply the CSF Tiers and Communicate Results
- Understanding the Four CSF Tiers 07:14
- Applying Tiers to Profiles and Improvement Decisions 07:25
- Assessing Outcomes and Evaluating Evidence 07:18
- Selecting Measures That Support Decisions 06:33
- Building a Practical CSF Implementation Roadmap 08:54
- Communicating CSF Results to Leadership 08:04
Leverage AI in CSF Implementation
- Where AI Can Support CSF Implementation 06:48
- Designing a Defensible AI-Assisted CSF Task 06:32
- Preparing Organizational Information for AI Analysis 07:46
- Building Evidence-Grounded CSF Analysis 07:29
- Validating AI-Assisted CSF Results 07:39
- Governing AI-Assisted CSF Work 07:42
About this course
This course focuses on leveraging artificial intelligence.
Gain expertise in the NIST Cybersecurity Framework 2.0 and discover how to apply its recommendations for effective cybersecurity risk management.
The NIST Cybersecurity Framework, often abbreviated as NIST CSF, is recognized globally for its effectiveness in managing cybersecurity risks. NIST CSF 2.0 broadens the Framework's scope beyond critical infrastructure, enhances its emphasis on cybersecurity governance, and introduces the new Govern Function, alongside the existing Functions: Identify, Protect, Detect, Respond, and Recover.
However, merely recognizing the names of the six Functions is insufficient.
This course unveils how NIST CSF 2.0 operates as a cohesive, outcome-oriented framework, demonstrating how organizations can assess risks, set priorities, evaluate existing capabilities, outline target outcomes, and devise a practical plan for enhancing cybersecurity.
You will delve into the interplay between the CSF Core, Organizational Profiles, Implementation Tiers, Implementation Examples, and Informative References. Additionally, you will learn why the CSF prioritizes cybersecurity outcomes over a generic list of controls.
Throughout the course, you will engage with HarborPoint Client Services, a realistic case study illustrating how an organization can implement NIST CSF 2.0 principles in a business context. Topics will include organizational context, governance, asset management, risk evaluations, protective measures, monitoring, incident management, recovery strategies, evidence assessment, performance metrics, Profile gaps, and strategic implementation planning.
The course thoroughly explores the following areas:
- Govern — Understanding organizational context, risk management approach, roles, policy, oversight, and supply chain cybersecurity risk
- Identify — Managing assets, conducting cybersecurity risk assessments, identifying dependencies, vulnerabilities, threats, and areas for improvement
- Protect — Implementing identity management, authentication, access controls, training, data protection, platform security, and infrastructure resilience
- Detect — Continuous event monitoring, adverse event evaluation, establishing detection criteria, and escalation procedures
- Respond — Management of incidents, analysis, communication strategies, reporting, and response actions
- Recover — Executing recovery plans, service restoration, validation processes, stakeholder communications, and learning from experiences
Learn to apply NIST CSF 2.0 effectively
This course goes beyond a simple overview of NIST concepts. Practical exercises and reusable templates will assist you in:
- Identifying and interpreting CSF outcomes
- Differentiating between outcomes, actions, controls, and supporting evidence
- Evaluating Implementation Examples and Informative References
- Establishing the scope and context of an Organizational Profile
- Documenting a streamlined Current Profile
- Creating a well-defined Target Profile
- Analyzing and prioritizing gaps between current capabilities and desired outcomes
- Assessing the quality of evidence and metrics
- Enhancing weak cybersecurity performance indicators
- Transforming prioritized gaps into a concrete implementation plan
- Preparing cybersecurity communications aimed at leadership decision-making
Who this course is for
- Professionals in cybersecurity and information security
- IT managers, system administrators, analysts, and technical personnel
- Governance, risk, and compliance experts
- Internal auditors and assessors specializing in cybersecurity
- Security program and project managers
- Risk owners and business executives involved in cybersecurity
- Consultants who assist with NIST CSF evaluations or implementations
- Students preparing to engage with cybersecurity frameworks
- Individuals looking for a solid understanding of NIST CSF 2.0