Study Guide
The NIST Cybersecurity Framework
The six Functions of NIST CSF 2.0 explained from the beginning, why they are not a one-way lifecycle, how the earlier five-function model fits, and where identity and access management sits.
Lesson 5.13 Governance, Risk & Compliance
An organisation trying to manage cybersecurity has hundreds of possible things to do. A framework gives that work a shape. This lesson works out how one widely used framework sorts all of it into six Functions, how they work together, and why you will also meet a version with only five.
Stage: Think
A handful of headings
Think it through
You have been asked to sort all the security work of a small business under a handful of headings that anyone could understand. What headings would you choose?
- Hint 1: What happens before, during and after an incident?
Show what happens
Something like: deciding how security is run, knowing what you have, protecting it, noticing problems, acting on them and getting back to normal. The framework in this lesson uses six headings of almost exactly that kind.
Think it through
Show the answer
Answer: A. No: it says what to achieve.
No. It describes what good security achieves; how to achieve it, and with what, is left to the organisation.
Stage: Explain
What the framework is
NIST is the National Institute of Standards and Technology, a United States government agency that publishes widely used security guidance. Its Cybersecurity Framework, usually shortened to CSF, is now at version 2.0, published in February 2024.
Four things are worth knowing before the detail.
- It describes outcomes, not instructions. The framework says what good cybersecurity achieves, such as “the organisation understands its risks”. It does not say which product to buy or which setting to choose.
- It is for any organisation. NIST describes it as usable regardless of size, sector or maturity.
- It is voluntary. It is not a law, and it is not a UK scheme. Organisations choose to use it because it gives them a common language.
- There is no certificate. NIST does not certify organisations against the framework. An organisation can assess itself against it, or pay someone to do so, but that is not the same as holding a certification.
Check your understanding
Show the answer
Answer: C. No: NIST offers none.
No. NIST does not certify organisations against the framework; an assessment is not a certificate.
Each Function is divided into Categories and then Subcategories, which describe outcomes in finer detail. This lesson stays at the level of the Functions. Security Frameworks and Standards compares the framework with ISO/IEC 27001, Cyber Essentials and others.
Stage: Predict
The six Functions
Think it through
Write one plain question for each of these: Govern, Identify, Protect, Detect, Respond, Recover.
- Hint 1: What would each word mean in a school or a shop?
Show what happens
One version: How will we manage it? What do we have, and what could go wrong? How do we reduce harm? How do we know something is wrong? What do we do when it happens? How do we get back to normal? The diagram gives the framework’s own wording.
An original diagram, not a reproduction of NIST’s own. Govern is drawn as a frame around the other five because it sets direction for all of them. The five carry no arrows and no numbers, because they have no fixed order.
Sets direction for the other five
Govern
How will we manage cybersecurity?
Leaders set the strategy and the policy, decide who is responsible and how much risk is acceptable, and check that it is all working.
Identify
What do we have, and what could go wrong?
Know the systems, data, people and suppliers the organisation depends on, and understand the risks to them.
Happening all the time
Protect
How do we reduce the likelihood or impact of harm?
Use safeguards: access control, training, data protection, updates and backups.
Happening all the time
Detect
How do we know something suspicious is happening?
Monitor systems and logs, and analyse alerts and unusual events.
Happening all the time
Respond
What do we do when an incident occurs?
Contain the incident, investigate it, tell the people who need to know and limit the damage.
Ready at all times · used when an incident occurs
Recover
How do we restore operations and improve afterwards?
Restore systems and data, return to normal working and learn from what happened.
Ready at all times · used when an incident occurs
No fixed order. What Detect finds changes what Protect does, and lessons from Respond and Recover feed back into Govern and Identify.
Versions 1.0 and 1.1 of the framework had five Functions: Identify, Protect, Detect, Respond and Recover. CSF 2.0 added Govern.
The six questions are the quickest way to hold the framework in your head.
| Function | Shorthand question | What it is about |
|---|---|---|
| Govern | How will we manage cybersecurity? | Strategy, policy, roles, oversight and decisions about risk. |
| Identify | What do we have, and what could go wrong? | Understanding assets and the risks to them. |
| Protect | How do we reduce the likelihood or impact of harm? | Using safeguards. |
| Detect | How do we know something suspicious is happening? | Finding and analysing possible attacks and compromises. |
| Respond | What do we do when an incident occurs? | Taking action on a detected incident. |
| Recover | How do we restore operations and improve afterwards? | Restoring what the incident affected. |
Check your understanding
Show the answer
Answer: C. Detect
Detect: monitoring and analysing activity for signs that something is wrong.
“Safeguards” here means the same as security controls. Security Controls: Categories and Functions explains what a control is and how controls are classified.
Stage: Predict
One organisation, six Functions
Think it through
A twelve-person veterinary practice keeps client records in an online booking system. Suggest one thing it could do under each of the six Functions.
- Hint 1: Start with who is in charge, and end with getting back to normal.
Show what happens
For example: the owners agree who is responsible (Govern); list laptops, systems and suppliers (Identify); add multi-factor authentication and backups (Protect); watch for unusual sign-ins (Detect); disable a taken-over account (Respond); restore and learn (Recover).
A fictional veterinary practice has twelve staff. Client and animal records are held in an online booking system run by a supplier. There are laptops at reception and in the consulting rooms.
- Govern. The two owners agree who is responsible for security, approve a short security policy, decide that client records are what they most need to protect, and ask for a report every three months.
- Identify. The practice manager lists the laptops, the booking system, the supplier that runs it and the records it holds. They work out what could go wrong, from a lost laptop to ransomware, and from an outside attacker to a member of staff emailing records to the wrong person.
- Protect. Every account gets multi-factor authentication and only the permissions its user needs. Laptops are encrypted and kept up to date, staff are trained, and the records are backed up.
- Detect. The booking system alerts the manager to sign-ins from unusual places, and the security software on the laptops reports anything suspicious.
- Respond. An alert shows a receptionist’s account signing in from another country. The manager disables the account, checks what it opened and tells the owners.
- Recover. The account is given back to the receptionist with a new password. The practice returns to normal working, reviews what happened and changes its training.
The numbers follow the story, not the framework. In real life the owners’ quarterly review, the asset list, the safeguards and the monitoring all run at the same time.
Internal and external threats
Threats can be internal or external. An external threat comes from outside the organisation, such as a criminal on the internet. An internal threat comes from someone inside it, such as an employee or a contractor, whether they mean harm or simply make a mistake.
Check your understanding
Show the answer
Answer: A. Internal.
Internal: it comes from someone inside the organisation, even though nobody meant harm.
The Functions apply to both. Identify has to consider insiders as well as outsiders. Protect limits what any one account can do. Detect watches activity inside the organisation, not only at its edge. Threat Actors looks at people and mistakes in more detail.
Stage: Predict
Not a one-way lifecycle
The Functions are often drawn in a row or a ring, and the earlier five are often taught as a sequence: Identify → Protect → Detect → Respond → Recover. That order is a good way to remember them, and it tells a sensible story: know what you have, protect it, notice problems, act on them, restore things.
Think it through
Show the answer
Answer: C. No: they run together.
No. The Functions run at the same time, and what one finds changes another.
It is not, however, a set of steps that are completed once and in order. NIST’s own guidance describes the Functions as concurrent and continuous:
- actions that support Govern, Identify, Protect and Detect should be happening all the time;
- actions that support Respond and Recover should be ready at all times, and happen when an incident occurs.
So an organisation does not finish Identify and then start Protect. It keeps its asset list current while its safeguards run and its monitoring watches. A finding from one Function changes another: an incident reveals a system nobody had listed, so the asset list is corrected and a safeguard is added.
“Lifecycle” is therefore a fair word, as long as it is not read as a queue. For revision, learn the six names, learn which activities belong to which, and treat the order as a memory aid.
Stage: Predict
Five Functions or six
Think it through
Show the answer
Answer: B. Inside Identify.
Inside Identify. CSF 2.0 made it a Function of its own, informing the other five.
You will see the framework drawn both ways, because it has changed.
| Aspect | Earlier versions (1.0 and 1.1) | CSF 2.0 |
|---|---|---|
| Functions | Five: Identify, Protect, Detect, Respond, Recover | Six: Govern, Identify, Protect, Detect, Respond, Recover |
| Where governance sits | Inside Identify | Its own Function, informing the other five |
| Intended audience | Written with critical infrastructure in mind | Any organisation in any sector |
A five-function diagram is not wrong. It shows the earlier model. When a document, a colleague or a question mentions the NIST CSF, check which version is meant. If it is CSF 2.0, there are six Functions and the first is Govern.
Stage: Predict
Where identity and access management fits
Think it through
Show the answer
Answer: A. Protect
Protect: they are safeguards. They touch other Functions too, as the next paragraph explains.
Identity and access management (IAM) belongs primarily under Protect. Managing identities, checking that people are who they claim to be and limiting what each account may do are all safeguards, and safeguards are what Protect is about. CSF 2.0 has a Protect Category covering identity management, authentication and access control.
“Primarily” is the right word, because identity touches other Functions too:
- Govern decides the policy: who may have access to what, and who approves it.
- Detect watches for unusual sign-ins.
- Respond disables an account that has been taken over.
If you are asked to place IAM in one Function, the answer is Protect. Identity and Access Management: Identification and AAA teaches the subject itself.
Stage: Predict
Placing an activity in a Function
To place any activity, ask the six questions and see which one it answers.
Think it through
Show the answer
Answer: C. No, two Functions.
No. Making the backup is Protect; restoring from it is Recover. The same technology serves two Functions at two moments.
| Activity | Function | Why |
|---|---|---|
| The board agrees how much risk is acceptable. | Govern | It is a decision about how cybersecurity will be managed. |
| Keeping a list of every laptop and who uses it. | Identify | It is knowing what the organisation has. |
| Assessing what could go wrong with the booking system. | Identify | It is understanding risk. |
| Requiring multi-factor authentication. | Protect | It is a safeguard. |
| Training staff to spot phishing. | Protect | It is a safeguard that works through people. |
| Making backups of the records. | Protect | The copy is made in advance, as a safeguard. |
| Reviewing logs for unusual sign-ins. | Detect | It is looking for signs that something is wrong. |
| Isolating an infected laptop from the network. | Respond | It is acting on an incident. |
| Restoring the records from backup after ransomware. | Recover | It is restoring what the incident affected. |
Backups appear twice on purpose. Making the backup is Protect; restoring from it is Recover. The same piece of technology serves two Functions at two different moments, which is another reason the Functions cannot be a simple sequence.
The six questions work as a quick completeness check on any security plan. If a plan is all Protect, with nothing about how a problem would be noticed or what would happen next, it is missing Detect, Respond and Recover. If nobody is named as responsible, it is missing Govern.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: B. Most of them.
Most of them: it is all Protect. Nothing says who is responsible, how a problem would be noticed, or what would happen next.
Apply it
Show the answer
Answer: C. Govern
Govern: it is a decision about how cybersecurity will be managed.
Apply it
Show the answer
Answer: C. Respond, then Recover.
Respond, acting on the incident; then Recover, restoring the laptop and learning from what happened.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Respond
Each Function answers a question, and Respond asks what to do when an incident occurs. Disabling the account and checking what it opened are actions taken on a detected incident, so they belong to Respond. The alert itself was Detect, which asks how the organisation knows something suspicious is happening. Protect covers the safeguards put in place beforehand, and Recover covers restoring normal operation afterwards. All four are among the six Functions of NIST CSF 2.0.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · The NIST Cybersecurity Framework (Supplementary Study Guide explanation)
Show answer
Answer: Requiring multi-factor authentication; Training staff to spot phishing emails
Protect asks how to reduce the likelihood or impact of harm, which is the job of safeguards. Requiring multi-factor authentication and training staff are both safeguards. Reviewing logs for unusual sign-ins is finding out that something suspicious is happening, which is Detect. Isolating an infected laptop is acting on an incident, which is Respond. Keeping a list of laptops is knowing what the organisation has, which is Identify.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · The NIST Cybersecurity Framework (Supplementary Study Guide explanation)
Show answer
Answer: Protect, because managing identities and access is a safeguard
Identity and access management belongs under Protect: managing identities, authentication and permissions are safeguards, and Protect is the Function about using safeguards. Identify is about understanding assets and risks, not about managing who may sign in. Identity does touch other Functions, since Govern sets the access policy, Detect watches sign-ins and Respond may disable a compromised account, but when it is placed in one Function, that Function is Protect.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · The NIST Cybersecurity Framework (Supplementary Study Guide explanation)
Show answer
Answer: False
False. The Functions are related activities in a continuous security lifecycle, not a rigid one-pass sequence. They are concurrent and continuous: Govern, Identify, Protect and Detect happen all the time, while Respond and Recover are ready at all times and happen when an incident occurs. An organisation keeps its understanding of assets and risks current while its safeguards run. The familiar order is a memory aid, not a queue of steps to finish one after another.
Revision sources: Session 3: Governance, Risk and Compliance (Classroom session record) · Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · The NIST Cybersecurity Framework (Supplementary Study Guide explanation)
Show answer
Answer: Making the backup is Protect; restoring from it is Recover.
Making a backup is a Protect activity, because the copy is a safeguard made in advance, and restoring from it after an incident is a Recover activity, because Recover is about restoring what the incident affected. The same technology serves two Functions at two different moments. Detect is about noticing that something is wrong, and Respond is about acting on the incident itself, so neither describes making a backup or restoring from one.
Revision sources: The NIST Cybersecurity Framework (Supplementary Study Guide explanation)
Show answer
Answer: It sets direction, oversight and risk decisions that inform the other Functions.
Govern addresses direction, oversight and risk decisions across the other Functions. It is one of the Functions that happen all the time, so it is not a first step that is finished and left behind. It did not replace Identify, which remains one of the six Functions; in the earlier five-function model, governance sat inside Identify. Technical safeguards such as firewalls and encryption belong to Protect.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · The NIST Cybersecurity Framework (Supplementary Study Guide explanation)
Study and revision
Practise through the Governance & Policy revision topic. Questions cover placing an activity in a Function, which activities belong to Protect, where identity and access management fits, why the Functions are not a sequence, and the role of Govern; three flashcards recall the six shorthand questions and why the Functions are not carried out one after another. Items that use this lesson’s supplementary explanation say so. They are learning-only, and the lesson does not establish exam alignment or practical experience.
Stage: Consolidate
What to remember
- NIST CSF 2.0 is a voluntary framework of outcomes, with no certificate.
- Six Functions: Govern, Identify, Protect, Detect, Respond, Recover; each answers a plain question.
- The Functions are concurrent and continuous; the familiar order is a memory aid, not a queue.
- Earlier versions had five Functions; CSF 2.0 added Govern, which informs the other five.
- Identity and access management sits primarily under Protect; making backups is Protect, restoring them is Recover.
Key terms
- NIST CSF (CSF: Cybersecurity Framework)
A framework organising cybersecurity outcomes into Functions: six in version 2.0 (Govern, Identify, Protect, Detect, Respond and Recover), and five, without Govern, in earlier versions.
Common misunderstandings
It is a set of outcomes. It does not prescribe how to achieve them or which controls to use.
They are concurrent and continuous. The familiar order is a memory aid, not a queue.
Versions 1.0 and 1.1 had five. CSF 2.0 has six, having added Govern.
Govern informs all the other Functions throughout. That is why the six-Functions diagram draws it around the other five, not at the start of a row.
NIST offers no certification against the framework. An assessment against it is not a certificate.
Further reading
- NIST: The NIST Cybersecurity Framework (CSF) 2.0
- NIST Cybersecurity Framework: frequently asked questions
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 3 (see the Session 3 Learning Log): the five-function sequence, described as a continuous security lifecycle.
- Recorded in Session 4 (see the Session 4 Learning Log): the six Functions of CSF 2.0; Govern as direction, oversight and risk decisions across the other Functions; and that the Functions are not a rigid one-pass sequence.
- Covered in Session 7 (see the Session 7 Learning Log): a framework diagram with the five Functions; discussion of internal and external threats, identifying assets and risks, safeguards and protection, detection and monitoring, incident response and recovery; a walk-through of the NIST framework document; and a gap-analysis example that listed Identity and Access Management under Protect.
- Accuracy qualification: the diagram shown in Session 7 resembles the earlier five-function model. NIST CSF 2.0 has six Functions, including Govern, and they are not a rigid one-time sequence.
- Supplementary explanation: the description of what the framework is, the six shorthand questions, the diagram, the veterinary-practice example, the definitions of internal and external threats, the explanation of concurrent Functions, the version comparison, the detail on where IAM fits, the table of activities, the practical note and the misunderstandings. These are my explanations, not the tutor’s words, checked against the NIST pages linked below on 1 October 2026. The diagram is original.
- Not recorded: which version of the NIST document was shown in Session 7, and which parts of it. No Profiles or Tiers are recorded as taught.
- Fictional example: the veterinary practice is invented.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening questions about organising security work, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. I have not assessed an organisation against the framework.
Something an organisation values, such as information, a service, equipment or a business capability.
Establishing or verifying a claimed identity, for example when a user signs in.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A UK certification scheme covering five technical control areas and based on verified self-assessment. Cyber Essentials Plus adds technical verification.
The direction, accountability and oversight through which an organisation sets and checks its security decisions.
The discipline of managing identities and what they can reach: accounts, roles, permissions, authentication and the access lifecycle.
How serious the consequences of an event would be for the organisation and the people affected.
The international standard specifying requirements for an ISMS within a defined scope. Organisations can be certified against it.
How probable it is that a defined event will happen over a stated period.
Authentication that requires two or more different types of factor, such as something you know and something you have.
A framework organising cybersecurity outcomes into Functions: six in version 2.0 (Govern, Identify, Protect, Detect, Respond and Recover), and five, without Govern, in earlier versions.
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
A document that sets organisational rules and expectations, defining what is and is not permitted.
Malicious software that denies access to systems or data, typically by encrypting them, in order to extort payment. Some incidents also involve data theft.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A potential cause of harm, such as an attacker seeking unauthorised access.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.