Lesson 3 of 5

Security Frameworks (NIST, ISO)

Security frameworks provide structured approaches to building, managing, and improving an organization's cybersecurity posture. You will learn the NIST Cybersecurity Framework, ISO 27001, and SOC 2, understanding how each is used and in what contexts. Familiarity with these frameworks is essential for security professionals working in enterprise environments or pursuing compliance-related roles.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "the NIST Cybersecurity Framework (CSF)" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

This objective builds a foundational skill that every security professional uses regularly. Mastering it gives you the vocabulary, mental models, and practical ability to tackle more advanced topics with confidence — and to communicate clearly with both technical and non-technical colleagues.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Security Frameworks (NIST, ISO) · Objective 1 of 4

VIDEO

Loading video…

Download the NIST CSF

Download the NIST Cybersecurity Framework version 2.0 from nist.gov/cyberframework — it is a free PDF. The CSF organizes security activities into six Functions: Govern, Identify, Protect, Detect, Respond, and Recover (version 2.0 added Govern to the original five). Each Function contains Categories and Subcategories that describe specific security outcomes — for example, the Protect Function includes the PR.AC category (Identity Management and Access Control) with subcategories like PR.AC-1 (identities and credentials are managed for authorized devices, users, and processes). The CSF is not a checklist — it is a risk management framework that helps organizations prioritize security investments based on their specific risk profile and business context.

Assess a hypothetical organization

Apply the NIST CSF to a hypothetical small healthcare clinic with 50 employees, an electronic health records (EHR) system, and a website. Work through each of the five original Functions and rate the clinic's current maturity on a scale of 1 (Partial) to 4 (Adaptive) using the CSF's Tier definitions. A typical small clinic might score Tier 1 on Detect (no security monitoring) and Tier 2 on Protect (basic access controls exist but are not consistently applied). Document your assessment in a spreadsheet with one row per CSF Subcategory, columns for current state, target state, and gap. This exercise teaches you to think like a security assessor rather than just a technical practitioner.

Identify gaps

Compare your current-state assessment against the target state appropriate for a healthcare organization — HIPAA requires specific controls that map directly to NIST CSF subcategories. Common gaps in small healthcare organizations include: no formal asset inventory (ID.AM-1), no vulnerability scanning program (ID.RA-1), no security awareness training (PR.AT-1), no log monitoring (DE.CM-1), and no tested incident response plan (RS.RP-1). Prioritize gaps by risk: a missing incident response plan is higher priority than a missing formal asset inventory because the consequences of an unmanaged breach are more severe than the consequences of an incomplete asset list. Document each gap with its CSF subcategory reference, current state, target state, and risk rationale.

Prioritize improvements

Create a prioritized remediation roadmap with three tiers: Quick Wins (low effort, high impact — implement within 30 days), Medium-Term (moderate effort — implement within 90 days), and Strategic (high effort, requires planning — implement within 12 months). Quick wins for the hypothetical clinic might include enabling MFA on all accounts, implementing automated patch management, and creating a basic incident response contact list. Medium-term items might include deploying endpoint detection and response (EDR) software and conducting a security awareness training program. Strategic items might include implementing a SIEM for centralized log monitoring and conducting an annual penetration test. A prioritized roadmap is more actionable than a flat list of gaps and demonstrates business-aligned security thinking.

Previous: Threat Actors & Attack Vectors Next Lesson