The NIST Cybersecurity Framework
Understand the world's most widely used cybersecurity framework and how Kaliteq draws on it.
Try for freeThe NIST Cybersecurity Framework (NIST CSF) is a framework published by the US National Institute of Standards and Technology, which has become the reference lens for structuring a cybersecurity strategy, well beyond US borders.
Unlike a certification standard, the NIST CSF imposes no direct legal obligation: it offers a common language and a voluntary maturity grid, which explains its wide adoption by organizations of every size and sector.
The framework's five functions
The NIST CSF structures cybersecurity around five functions: identify risks and assets, protect critical systems, detect incidents, respond to detected incidents, and recover after an incident to restore affected capabilities. This structure covers the full lifecycle of a risk, from prevention to remediation.
- Identify: mapping assets and risks
- Protect: preventive security measures
- Detect: ability to spot an incident
- Respond: incident response procedures
- Recover: recovery and continuity plans
Why this framework became dominant
Its technology neutrality and accessible language, rather than highly specialized jargon, let organizations without deep cybersecurity expertise use it as a self-assessment grid, while remaining rigorous enough to structure a large enterprise's strategy.
How Kaliteq draws on it
Kaliteq's cybersecurity diagnostic draws on the NIST CSF's structure to organize its assessment domains, without claiming official compliance with the standard. The goal is to offer a pragmatic, immediately usable maturity grid, rather than a formal certification exercise.
Related Kaliteq diagnostics
Related glossary terms
Frequently asked questions
Is the NIST CSF mandatory in Europe?
No, it is a voluntary US framework. European organizations can draw on it with no legal obligation, unlike regulations such as NIS2.
What is the difference between the NIST CSF and the CIS Controls?
The NIST CSF offers a high-level strategic structure; the CIS Controls provide a prioritized list of concrete actions, more operational for immediate implementation.
Does a Kaliteq diagnostic equal NIST certification?
No, NIST does not issue certification. Kaliteq draws on its structure to organize a pragmatic maturity diagnostic, without claiming official compliance.
Does the NIST CSF suit a small business?
Yes, its structure remains applicable to any organization size, simply adapting the level of detail of actions implemented within each function.
See also
Ready to assess your organization?
Create your free account and start your first diagnostic in a few minutes.
Try for free