NIST Cybersecurity Framework 2.0 Skill

Purpose

Map security implementations across all Hack23 projects to NIST CSF 2.0 framework functions and categories, ensuring comprehensive cybersecurity coverage aligned with the organization's risk profile.

Rules

CSF Core Functions

MUST address all six CSF 2.0 functions:

GOVERN (GV) - Organizational Context

• MUST maintain organizational cybersecurity strategy

• MUST define risk management strategy and appetite

• MUST establish cybersecurity supply chain risk management

• MUST maintain roles, responsibilities, and authorities

IDENTIFY (ID) - Asset & Risk Management

• MUST maintain inventory of all assets (repositories, infrastructure, data)

• MUST conduct risk assessments annually and after significant changes

• MUST identify and document all data flows and processing activities

• MUST assess improvement opportunities based on lessons learned

PROTECT (PR) - Safeguards

• MUST implement identity management and access control

• MUST enforce data security (encryption at rest and in transit)

• MUST maintain platform and infrastructure security

• MUST implement technology infrastructure resilience

DETECT (DE) - Monitoring

• MUST implement continuous security monitoring

• MUST analyze adverse events for potential incidents

• MUST enable GitHub Advanced Security features on all repositories

RESPOND (RS) - Incident Response

• MUST execute incident management procedures

• MUST perform incident analysis and triage

• MUST report incidents per regulatory requirements

• MUST contain and mitigate incidents promptly

RECOVER (RC) - Recovery

• MUST execute incident recovery plans

• MUST communicate recovery status to stakeholders

• MUST incorporate lessons learned into improved procedures

Implementation Tiers

Tier Description Hack23 Target

Tier 1 Partial - Ad hoc responses Not acceptable

Tier 2 Risk Informed - Awareness exists Minimum baseline

Tier 3 Repeatable - Formal policies Target for all projects

Tier 4 Adaptive - Continuous improvement Aspiration

Hack23 ISMS Policy References

• Information Security Strategy - GV

• Information Security Policy - GV

• Risk Assessment Methodology - ID.RA

• Access Control Policy - PR.AC

• Cryptography Policy - PR.DS

• Secure Development Policy - PR.IP

• Vulnerability Management - DE.CM

• Incident Response Plan - RS

• Business Continuity Plan - RC

• Backup Recovery Policy - RC.RP

References

• NIST CSF 2.0: https://www.nist.gov/cyberframework

• NIST CSF Quick Start Guide: https://doi.org/10.6028/NIST.CSWP.29