NIST Cybersecurity Framework v1.0
Active
Best for: Owners and operators of critical infrastructure and other interested entities, who can use the voluntary framework to identify, assess, and manage cybersecurity-related risk.
| Mandatory? | Voluntary framework, as directed by Executive Order 13636 |
|---|---|
| Who validates? | |
| Renewal | |
| Scope | Owners and operators of critical infrastructure and other interested entities |
| Governing body | National Institute of Standards and Technology (NIST). Official source |
Controls by category
62 controls are Mapped to NIST Cybersecurity Framework v1.0.
DE.AE-2: Detected events are analyzed to understand attack targets and methods.
DE.AE-3: Event data are collected and correlated from multiple sources and sensors.
DE.CM-1: The network is monitored to detect potential cybersecurity events.
ID.AM-1: Physical devices and systems within the organization are inventoried.
| Control | Status |
|---|---|
| Projects should have Cloud Asset Inventory enabled | Mapped |
PR.AC-1: Identities and credentials are issued, managed, verified, revoked, andaudited for authorized devices, users and processes.
PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
PR.DS-1: Data-at-rest is protected.
PR.DS-2: DData-in-transit is protected.
| Control | Status |
|---|---|
| Compute Engine instances should have 'Block Project-wide SSH keys' enabled | Mapped |
PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition.
| Control | Status |
|---|---|
| Projects should have Cloud Asset Inventory enabled | Mapped |
PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
PR.IP-2: A System Development Life Cycle to manage systems is implemented.
PR.IP-4: Backups of information are conducted, maintained, and tested.
| Control | Status |
|---|---|
| Cloud SQL instances should have automated backups configured | Mapped |
PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
PR.PT-3: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.
RS.AN-1: Notifications from detection systems are investigated.
RS.CO-1: Personnel know their roles and order of operations when a response is needed.
| Control | Status |
|---|---|
| Organizations should have Essential Contacts configured | Mapped |
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST SP 800-53 Rev 5 | High 97% | |
| CIS GCP Benchmark v2.0.0 | High 94% | |
| CIS GCP Benchmark v3.0.0 | High 90% |
Frequently asked questions
Who developed the NIST Cybersecurity Framework v1.0 and why?
NIST developed it after President Obama issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity, in February 2013. The order directed NIST to work with stakeholders on a voluntary framework for reducing cybersecurity risks.
Is the NIST Cybersecurity Framework mandatory?
It is a voluntary framework based on existing standards, guidelines, and practices. It does not prescribe particular technological solutions or specifications.
When was NIST Cybersecurity Framework v1.0 published, and who wrote it?
It was published on February 19, 2014. The Computer Security Division of NIST's Information Technology Laboratory led its development. The authors are Kevin M. Stine, Kim Quill, and Gregory A. Witte.
What approach does the framework describe?
It provides a prioritized, flexible, repeatable, and cost-effective approach, including information security measures and controls. It aims to protect business confidentiality, individual privacy, and civil liberties while managing cybersecurity-related risk.