{"id":9987,"date":"2024-01-12T07:00:25","date_gmt":"2024-01-12T07:00:25","guid":{"rendered":"https:\/\/carecomputers.co.uk\/?p=9987"},"modified":"2024-01-12T07:00:25","modified_gmt":"2024-01-12T07:00:25","slug":"nist-2-0-a-comprehensive-guide-for-smbs","status":"publish","type":"post","link":"https:\/\/creativeideasfactory.co.uk\/carenew\/nist-2-0-a-comprehensive-guide-for-smbs\/","title":{"rendered":"NIST 2.0: A Comprehensive Guide for SMBs\u00a0\u00a0"},"content":{"rendered":"

The National Institute of Standards and Technology Cybersecurity Framework 2.0 (NIST CSF 2.0) is an easy-to-use framework that not only addresses future risks but also provides risk management blueprints for organisations regardless of their size.<\/p>\n

Understanding NIST 2.0<\/h2>\n

The NIST CSF 2.0 is a voluntary framework that provides a robust set of guidelines for organisations to manage and mitigate cybersecurity risk effectively. Developed by the National Institute of Standards and Technology (NIST), a non-regulatory agency of the U.S. Department of Commerce, the framework is designed to be flexible and adaptable to the specific needs of each organisation. It represents an evolution from its predecessor, incorporating feedback from users and updates to reflect changes in the cybersecurity landscape.<\/p>\n

NIST was originally created to aid critical national infrastructure (CNI) organisations but its clarity and thoroughness in highlighting cybersecurity best practices made it one of the most popular frameworks among US and global organisations \u2013 whatever the sector.<\/p>\n

Key Features and Components of NIST 2.0<\/h2>\n

The NIST framework was first published in 2014 but its first significant refresh is currently underway in a new public draft version, ready for publication in early 2024.<\/p>\n

The NIST CSF 2.0 is composed of six key functions: Govern, Identify, Protect, Detect, Respond, and Recover.<\/p>\n

Each function is further divided into categories and subcategories that detail specific outcomes related to each function. These components provide a strategic view of an organisation\u2019s management of cybersecurity risk, allowing for a comprehensive and holistic approach to cybersecurity.<\/p>\n

Govern<\/h3>\n

A new function added to NIST 2.0. This extra layer augments the existing five functions by emphasising the importance of governance in cybersecurity. This new addition aligns the NIST framework more closely with ISO 27001, a globally recognized standard for Information Security Management Systems (ISMS).<\/p>\n

The \u2018Govern\u2019 function covers people, process and technology elements that cover the roles, responsibilities, policies, procedures and oversight in addition to the technology throughout the implementation of NST 2.0. This incorporates multiple categories which were under the \u2018Identify\u2019 function in the original framework including Business Environment, Risk Management Strategy and Supply Chain Risk Management.<\/p>\n

Identify<\/h3>\n

\u2018Identify\u2019 comprises of three core goals for organisations:<\/p>\n

    \n
  1. Identify your assets (from hardware, software, services to data to facilities and people)<\/li>\n
  2. Understand the cybersecurity risks to the organisation, its assets and individuals<\/li>\n
  3. Identify improvements to its cybersecurity risk management processes, procedures and activities<\/li>\n<\/ol>\n

    SMBs need an understanding of business context, the resources that support critical functions, and the related cybersecurity risks enable your organisation to focus and prioritise your efforts in conjunction with risk management strategy and business needs.<\/p>\n

    Protect<\/h3>\n

    Covering a range of safeguards for preventing or reducing cybersecurity risk, the \u2018Protect\u2019 function includes managing identities and their access rights, requiring authentication, protecting data, securing platforms and ensuring infrastructure resilience, as well as promoting cybersecurity awareness amongst users.<\/p>\n

    This function supports the ability to limit or contact the impact of a potential cybersecurity event and outcomes within an organisation. Outcomes for \u2018protect\u2019 could include:<\/p>\n