What is NIST CSF? The framework that defines Cybersecurity

What is a Framework?

A framework is just a structured way of thinking. It's a checklist of things you should do - organized so you can find the gaps in your security.

NIST CSF stands for National Institute of Standards and Technology Cybersecurity Framework. It was created by the US government in 2014 after President Obama ordered a unified approach to cybersecurity. Today, it's the most widely used security framework in the world.

It has five core functions: Identify, Protect, Detect, Respond, Recover.

Every cybersecurity job, every security program, every incident response plan maps back to these five words. Let's break them down

1. Identify - Know what you have


You can't protect what you don't know exists.

The identify function asks:


Example A company was breached because an old development server was left exposed to the internet with default credentials. The server wasn't in any asset inventory, so no one knew it existed. The attackers used it as a foothold to pivot into the internal network. A proper Identify program would have caught that server before it became an etry point.

2. Protect - Build the defense


Once you know what you have, you protect it.

The Protect function includes:


Example A company enforced MFA for all remote access but forgot to apply the same policy to its VPN fallback accounts. Attackers discovered one of these accounts still active and brute-forced it. Once inside, they moved laterally. A complete Protect program would have covered every authentication path - not just the primary one.

3. Detect - Know when you are being attacked


The Detect function includes:


Example A security team received hundreds of low-priority alerts. An attacker performed a credential-dumping attack, which triggered a critical alert, but it was buried under the noise. The team missed it until the attacker began exfiltrating data. A proper Detect program would have been tuned to prioritise high-confidence alerts over the noise.

4. Respond - Take action


The Respond function includes:


Example A ransomware gang encrypted a file server and demanded payment. The organisation had a response plan, but it hadn't been tested in over two years. Nobody knew who was authorised to make containment decisions, and the isolation procedure took hours instead of minutes. The attackers moved to backup servers before the team could act. A tested Respond function would have bought critical time.

5. Recover - Get back to normal


After the fire is out, you rebuild.

The Recover function includes:


Example After a ransomware attack, a company restored from backups — only to discover the backups were also encrypted because the backup servers were on the same domain. Recovery took weeks instead of days. A proper Recover function would have included offline, immutable backups and regular restore drills to verify they actually work.

Putting It All Together

Think of the five functions as a loop You identify what you have, protect it, detect attacks, respond to incidents, and recover. Then you start again — using what you learned to improve. It's not a one-time thing. It's a continuous cycle. That's why frameworks exist: to give you a structure that covers everything, not just the parts you happen to think about.

Why NIST CSF Matters for Your Career

If you interview for a cybersecurity job, you'll be asked about NIST CSF. It's the common language of the industry. SOC analysts map detections to it. Risk managers map controls to it. Executives report against it.

Knowing the five functions — Identify, Protect, Detect, Respond, Recover — means you can talk to anyone in the field, from interns to CISOs.