YTYK You think you know

Card 1 of 15 What the Framework is ●○○ Foundational

It describes outcomes, not controls

The CSF describes cybersecurity outcomes to be achieved, not the controls or activities that achieve them. It deliberately does not say *how*: Informative References map each outcome to the places that do, such as SP 800-53, ISO/IEC 27001 and the CIS Controls.

Why it is like this

A control catalogue written for every sector and every size would have to be either vague or wrong. Specifying the outcome and pointing elsewhere for the method lets one framework sit above many catalogues — and lets you keep the catalogue you already use.

Not to be confused with

A control framework or a checklist you can tick. There is no control numbered in the CSF to implement; there is an outcome to achieve, and the evidence that you achieved it is yours to choose.

In practice

"GV.SC-04: Suppliers are known and prioritized by criticality" is an outcome. Which tool holds the supplier list, and how criticality is scored, is not the CSF's business.

Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §1 and §2. Read on .

Predict Check yourself

A team asks which CSF control requires multi-factor authentication. What is the answer?

  1. None — the CSF states outcomes, and points to Informative References such as SP 800-53 for the controls that implement them.
  2. PR.AA-03, which mandates MFA for all remote access.
  3. It depends on the Tier the organisation has selected.
  4. MFA is out of scope for the CSF, which covers governance only.
Show the answer

None — the CSF states outcomes, and points to Informative References such as SP 800-53 for the controls that implement them.

This is the question that reveals whether someone has read the Framework or heard about it. The CSF never mandates a control.