The NIST Cybersecurity Framework

Lesson plan

Level

Beginner

Time

About 50 minutes; the steps below add up to 50

Learners invent a handful of headings for a small business’s security work, and decide whether headings name products, before the framework is introduced. Predictions then precede the six plain questions, one action per Function at a vet practice, whether Identify must finish first, where governance used to sit, which Function account management belongs to and whether backups sit in one Function; checks follow certification, Detect and an insider’s mistake. The habit to build: place any activity by asking which of the six questions it answers.

Objectives

• Describe what the NIST CSF is and is not
• Name the six Functions of CSF 2.0 and the question each answers
• Explain why the Functions are concurrent, not a one-way sequence
• Relate the earlier five-function model to CSF 2.0
• Place activities, including identity and access management, in the right Function

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Frameworks and Standards and Identity and Access Management lessons first.
• Write the six Function names round the edge of the board, with Govern across the top.
• The lesson takes about 50 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe what the NIST CSF is and is not
   • Name the six Functions of CSF 2.0 and the question each answers
   • Explain why the Functions are concurrent, not a one-way sequence
   • Relate the earlier five-function model to CSF 2.0
   • Place activities, including identity and access management, in the right Function

   Purpose: Learners invent a handful of headings for a small business’s security work, and decide whether headings name products, before the framework is introduced. Predictions then precede the six plain questions, one action per Function at a vet practice, whether Identify must finish first, where governance used to sit, which Function account management belongs to and whether backups sit in one Function; checks follow certification, Detect and an insider’s mistake. The habit to build: place any activity by asking which of the six questions it answers.

2. 1. A handful of headings Think 5 min

   Purpose: Let learners invent headings that turn out to match the Functions.

   Ask

   • Ask which headings they would choose.
   • Do headings name products?

   Responses to expect

   • Protect and Recover come quickly; Govern rarely does.
   • On screen in turns: the opening question, its answer; then the question on whether a framework names products, and its answer.

   Discussion pause: Collect headings on the board, then compare them with the six.

   In the lesson window

   • Think it through: You have been asked to sort all the security work of a small business under a handful of headings that anyone could understand. What headings would you choose?
   • Think it through: Does a framework of headings like that tell you which product to buy?

3. 2. What the framework is Explain 4 min

   Purpose: Set out what the framework is: outcomes, any organisation, voluntary, no certificate.

   Ask

   • Does an assessment give a certificate?

   Responses to expect

   • No: NIST does not certify.
   • On screen in turns: the opening; then four things to know, starting with outcomes; for any organisation; voluntary; no certificate; the check question on a consultant’s assessment, and its answer; Categories and Subcategories.

   Misconceptions to challenge

   • A learner may believe: “The NIST CSF is a checklist of controls.” Respond: It describes results to aim for, not controls to install.
   • A learner may believe: “An organisation can be NIST CSF certified.” Respond: NIST offers no certification.

   In the lesson window

   • Check your understanding: An organisation pays a consultant to assess it against the NIST CSF. Does it now hold a NIST certificate?

4. 3. The six Functions Predict 6 min

   Purpose: Name the six Functions and their questions, with the diagram.

   Ask

   • Write one question for each.
   • Which asks about suspicious activity?

   Responses to expect

   • Learners’ questions are usually close to NIST’s.
   • Diagram: reveal Govern first, then each Function in turn; ask the class for its plain question before it appears.
   • On screen in turns: the opening question, its answer; then the six Functions, starting with Govern; Identify; Protect; Detect; Respond; Recover, and how they connect; the six shorthand questions; the check question on noticing something suspicious, and its answer; safeguards and controls.

   In the lesson window

   • Think it through: Write one plain question for each of these: Govern, Identify, Protect, Detect, Respond, Recover.
   • Check your understanding: Which Function asks “How do we know something suspicious is happening?”

5. 4. One organisation, six Functions Predict 7 min

   Purpose: Apply the Functions to the fictional vet practice, and to internal and external threats.

   Ask

   • One action for each Function?
   • Is a misdirected email internal or external?

   Responses to expect

   • Some think mistakes are not threats.
   • On screen in turns: the opening question, its answer; then a veterinary practice, starting with Govern; Identify; Protect; Detect; Respond; Recover; the numbers follow the story; internal and external threats; the check question on a wrong recipient, and its answer; the Functions apply to both.

   If the explanation does not land: Give each pair one Function and ask what the practice would do under it.

   In the lesson window

   • Think it through: A twelve-person veterinary practice keeps client records in an online booking system. Suggest one thing it could do under each of the six Functions.
   • Check your understanding: A member of staff emails client records to the wrong person by mistake. Is that an internal or an external threat?

6. 5. Not a one-way lifecycle Predict 5 min

   Purpose: Show that the Functions are concurrent and continuous.

   Ask

   • Must Identify finish first?

   Responses to expect

   • The memorised order makes many say yes.
   • On screen in turns: the opening; then the question on finishing Identify first, and its answer; concurrent and continuous, starting with what happens all the time; what is ready at all times; no Function is finished first; a fair word, not a queue.

   Misconceptions to challenge

   • A learner may believe: “The Functions are steps to complete in order.” Respond: They are concurrent; the order is a memory aid.
   • A learner may believe: “Govern is just the first step.” Respond: Govern informs the others throughout.

   In the lesson window

   • Think it through: Should an organisation finish Identify completely before starting Protect?

7. 6. Five Functions or six Predict 3 min

   Purpose: Compare the earlier five-function model with CSF 2.0.

   Ask

   • Where was governance before?

   Responses to expect

   • It sat within Identify.
   • On screen in turns: the opening question, its answer; then the two versions compared; check which version is meant.

   Misconceptions to challenge

   • A learner may believe: “The framework has five Functions.” Respond: Versions 1.0 and 1.1 did; CSF 2.0 has six.

   In the lesson window

   • Think it through: In the earlier five-function versions, where do you think governance was handled?

8. 7. Where identity and access management fits Predict 4 min

   Purpose: Place identity and access management primarily under Protect, with its links to other Functions.

   Ask

   • Which Function do account controls belong to?

   Responses to expect

   • Identify is the common wrong answer.
   • On screen in turns: the opening question, its answer; then IAM sits primarily under Protect; where identity touches other Functions, starting with Govern; Detect; Respond; the one-Function answer.

   In the lesson window

   • Think it through: Managing accounts, checking that people are who they claim to be and limiting what each account may do: which Function do these mainly belong to?

9. 8. Placing an activity in a Function Predict 5 min

   Purpose: Practise placing activities, including backups in two Functions.

   Ask

   • Do making and restoring backups share a Function?

   Responses to expect

   • Most say Recover for both.
   • On screen in turns: the opening; then the question on backups twice, and its answer; placing activities, with the Functions held back; the Function for each; why; backups appear twice on purpose; a quick completeness check.

   Discussion pause: The Function and Why columns are held back: let the class place each activity before revealing them.

   To go further

   • Where would you place a staff exercise that rehearses responding to ransomware, and why might it fit more than one Function?

   In the lesson window

   • Think it through: Making a backup, and restoring from it after ransomware: do they belong to the same Function?

10. 9. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The plan tests completeness; the board tests Govern; the laptop tests Respond and Recover.
    • On screen in turns: the opening; then the question on an all-Protect plan, and its answer; the question on the board’s decision, and its answer; the question on an unplugged laptop, and its answer.

    In the lesson window

    • Apply it: A security plan lists firewalls, passwords, training and encryption, and nothing else. Which Functions are missing?
    • Apply it: The board decides how much cyber risk the company will accept. Which Function is that?
    • Apply it: An infected laptop is unplugged from the network. Which Function is that, and which comes after it?

11. 10. Check your understanding Check 5 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The IAM question links to its own step.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

12. 11. What to remember Consolidate 2 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the six Functions.

    Responses to expect

    • Govern first, then Identify, Protect, Detect, Respond and Recover.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

13. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Outcomes, voluntary, no certificate.
    • Six Functions, six plain questions.
    • All running at once.
    • Five before, six now, with Govern.
    • Place an activity by the question it answers.

Consolidation

• Outcomes, voluntary, no certificate.
• Six Functions, six plain questions.
• All running at once.
• Five before, six now, with Govern.
• Place an activity by the question it answers.