YTYK You think you know

Card 6 of 15 GOVERN, the Function that was added ●●○ Working knowledge

The Functions are not a lifecycle

The six Functions are not steps, phases or a maturity progression. NIST states they should be addressed concurrently and continuously — an organisation is detecting while it is protecting while it is recovering from something else.

Why it is like this

Drawn as a sequence, the framework would suggest that RECOVER is something you reach after mastering PROTECT, which would leave most organisations with no recovery plan on the grounds that they are not ready for one.

Not to be confused with

An incident response lifecycle. Those exist — SP 800-61 has one — but the CSF Functions are organising categories for outcomes, and the wheel they are usually drawn in is a wheel, not an arrow.

In practice

A team that plans to "do IDENTIFY this year and PROTECT next year" has misread the diagram, and will spend a year with no detection.

Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §2.1. Read on .

Predict Check yourself

A roadmap proposes one Function per quarter, starting with IDENTIFY and ending with RECOVER. What is wrong with it?

  1. The Functions are meant to be addressed concurrently and continuously — they are not phases, and sequencing them leaves whole capabilities absent for months.
  2. Nothing — that is the intended adoption order.
  3. Only the order is wrong; GOVERN should come first and the rest can follow.
  4. Nothing, provided the organisation is at Tier 1.
Show the answer

The Functions are meant to be addressed concurrently and continuously — they are not phases, and sequencing them leaves whole capabilities absent for months.

Prioritising outcomes is fine and is what a Target Profile is for. Scheduling whole Functions is not the same thing.