NIST CSF 2.0 Training: Govern, Profiles, Tiers and Your Action Plan

Opens with a self-check: who owns cybersecurity risk in your organisation, and how long could the business keep running if your main systems went down? Presents two incidents from logistics: DP World Australia, which disconnected its systems from the internet in November 2023, suspending container terminals and stranding almost 30,000 containers, and the Port of Seattle, whose airport check-in systems, display boards, website and app were disrupted, and which refused to pay a ransom. Draws four questions: who decides, what matters most, can we keep running, and who tells whom. Explains the CSF as a voluntary framework of outcomes, not a checklist, with the Core, Profiles and Tiers. Introduces STU Logistics Pte. Ltd. in Singapore, a freight forwarder with two warehouses and customs brokerage. Ends with myths, the thirteen modules and exam, and a recap.

What you will be able to do

• Explain why cybersecurity risk is a business decision, using two port incidents
• Describe the CSF as a framework of outcomes with Core, Profiles and Tiers
• Ask the four questions every incident raises

Why it matters

Seeing how cyber incidents stopped ports shows why leaders, not only IT, must decide cybersecurity risk in advance.

Practice: Practice: Welcome, and why the CSF matters · 3 questions

Starts with two board meetings at STU a year apart: one where the IT manager presents firewall rules and patch counts and nobody can decide anything, and one where he shows where STU stands on each CSF Function and where it needs to be. Explains the purpose of the CSF: to understand and assess, prioritise, and communicate cybersecurity risk. Covers what changed in version 2.0: a framework for all organisations, a sixth Function called Govern, more focus on supply chains, and online resources. Shows the six Functions in NIST's own short definitions, and the three parts: six Functions, 22 Categories and 106 Subcategories in the Core, Profiles, and four Tiers. Then covers the resources you will use most, such as Implementation Examples, Informative References, Quick-Start Guides and the CSF 2.0 Reference Tool, and how STU starts. Ends with a recap.

What you will be able to do

• Explain the purpose of NIST CSF 2.0
• Describe what changed in version 2.0, including the Govern Function
• Name the six Functions and the resources that support them

Why it matters

A common language of outcomes lets you report cybersecurity to the board in terms it can decide on.

Practice: Practice: What the CSF is, and what changed in 2.0 · 3 questions

Opens with a critical flaw in STU's warehouse management system, where IT wants to patch tonight, operations refuses because the warehouse runs all night, and with no agreed risk appetite the patch waits three weeks. Explains the first two Categories of Govern. Organisational context covers the mission, stakeholders, obligations and dependencies in both directions, shown in STU's one-page context record approved by the leadership. Risk management strategy covers agreed objectives, appetite and tolerance statements, response options and one method for rating risk, shown in how STU applies GV.RM-04 and GV.RM-06 with a five-step method feeding the enterprise risk register. Includes a business process outsourcer in Mumbai with clients on three continents that now keeps one obligations register. Ends with the evidence, a recap and how these decisions are used in practice.

What you will be able to do

• Record the organisational context: mission, stakeholders, obligations and dependencies
• Write risk appetite and tolerance statements
• Apply one method for rating cybersecurity risk in the enterprise register

Why it matters

Decide the appetite once and every decision gets easier, from patch timing to client commitments.

Practice: Practice: Govern: context and risk strategy · 3 questions

Starts with STU's new security lead finding shared logins on warehouse scanners, where nothing changes until the chief operating officer sets the rule and warehouse managers own its delivery. Explains roles and responsibilities: leadership accountable, roles and authorities enforced, adequate resources, and security built into HR practices, shown in STU's short roles table approved by the board. Covers policy: built from the context and strategy, communicated and enforced, and reviewed when requirements, threats, technology or the mission change, with STU's policy set. Then covers oversight: reviewing results and performance to adjust the strategy, with practitioners providing indicators to managers and executives, shown in STU's one-hour quarterly review with the leadership team. Ends with a simple test, asking a warehouse manager about their role and who checks it, and a recap.

What you will be able to do

• Assign cybersecurity roles and authorities in a roles table
• Keep cybersecurity policy reviewed, communicated and enforced
• Run a quarterly oversight review that adjusts the strategy

Why it matters

Leaders own it, policy carries it and oversight steers it; clear roles turn a security lead's request into a business rule.

Practice: Practice: Govern: roles, policy and oversight · 3 questions

Opens with a trucking company STU works with whose mailbox is taken over by criminals, who then e-mail STU's clients asking for payments to new bank details. Explains the largest Category in Govern and its ten outcomes: a supply chain risk programme agreed by stakeholders, with roles for suppliers and partners, built into risk management. Shows how STU knows its suppliers and prioritises them by criticality, checks them before signing, and what it puts into contracts with critical and high-risk suppliers. Covers monitoring throughout the relationship, with a yearly re-check of critical suppliers, including suppliers in incident planning through a two-hour exercise with STU's cloud transport system provider that found no agreed way to get shipment data out during an outage, and provisions for the end of the relationship. Ends with a recap.

What you will be able to do

• Tier suppliers by criticality in a supplier register
• Write cybersecurity requirements into supplier contracts
• Run an incident exercise with a critical supplier

Why it matters

A supplier's incident can become your incident; tiering and exercising suppliers finds gaps before a criminal does.

Practice: Practice: Govern: supply chain risk management · 3 questions

Starts with an old test server for STU's customer portal, left online and unpatched after the project ended, and an inventory sweep that finds it. Explains asset management and its seven outcomes: inventories of hardware, software, services and data, data flows, priorities and life cycles, shown in four lines from STU's asset register with an owner, criticality and life cycle stage for each asset. Covers risk assessment, the largest Category in Identify with ten outcomes: vulnerabilities, threat intelligence, impacts and likelihoods, responses, disclosures and checks before buying, following STU's ageing warehouse server through them, with a payments company in Hong Kong using threat intelligence. Then covers improvement from evaluations, tests, exercises and daily operations, captured in one simple log at STU. Ends with a recap.

What you will be able to do

• Build an asset register with owners, criticality and life cycle
• Take one risk through the CSF risk assessment outcomes
• Capture improvements from tests, exercises and operations in one log

Why it matters

You can only protect what you know you have; an asset register finds the forgotten server before an attacker does.

Practice: Practice: Identify: assets, risks and improvement · 3 questions

Opens with STU's customer portal, where carriers share a single account until a dispatcher's reused password leaks and someone downloads shipment data for every client that carrier serves. Explains identity management, authentication and access control: identities and credentials managed, proofed, bound and authenticated. Shows how STU applies these outcomes across a working life through its joiner, mover and leaver process, how least privilege and separation of duties look at STU, devices registered before they connect, and physical access managed in line with risk. Then covers awareness and training: for all personnel, so they can perform general tasks with cybersecurity risks in mind, and specialised training for specialised roles, measured by skills rather than attendance. Ends with a recap.

What you will be able to do

• Manage identities and credentials through joiners, movers and leavers
• Apply least privilege and separation of duties
• Plan awareness and role-based training measured by skills

Why it matters

Named accounts and least privilege mean one leaked password exposes one user, not every client a carrier serves.

Practice: Practice: Protect: identity, access and training · 3 questions

Starts with a scenario STU took seriously after the port incidents: ransomware reaching the warehouse management server, where backups on the same network are encrypted too, versus one offline copy restored by the team. Explains data security: confidentiality, integrity and availability of data at rest, in transit and in use, with the safeguards STU chooses and backups that are tested. Covers platform security: one secure baseline for each platform type, from office laptops to warehouse scanners, servers and cloud accounts, configuration management, maintenance and replacement, logs sent for monitoring, no unauthorised software, and secure development with automated checks in every build. Then covers infrastructure resilience across STU's sites: protected networks, protection from environmental threats, resilience mechanisms and enough capacity. Ends with a recap.

What you will be able to do

• Protect data at rest, in transit and in use
• Set secure configuration baselines for each platform type
• Test that backups can actually be restored

Why it matters

A backup counts only when its restore is tested; one offline copy decides whether a warehouse restarts in hours or days.

Practice: Practice: Protect: data, platforms and resilience · 3 questions

Opens with a three in the morning alert: a customer service manager's account signs in to the transport system from another country, and either sits in an unread inbox for a week or is checked within minutes by the provider's monitoring team, who call STU's on-call lead. Explains continuous monitoring and its five outcomes, covering networks, the physical environment, personnel activity, service providers, and systems and their data, with three key Detect terms made simple. Shows STU's one-page monitoring map, tested against every critical asset in the register, and how STU turns logs into alerts. Then covers adverse event analysis: events understood, correlated, enriched with threat intelligence from a regional logistics sharing group and with asset criticality, impact estimated, and incidents declared against criteria set in advance. Ends with a recap.

What you will be able to do

• Map monitoring coverage against every critical asset
• Analyse an alert using threat intelligence and context
• Declare an incident against criteria set in advance

Why it matters

Monitoring matters only when someone analyses what it finds; a monitored alert at night can stop a week of data theft.

Practice: Practice: Detect: monitoring and analysis · 3 questions

Returns to the two incidents from Module 1: DP World Australia disconnecting its systems to contain the attack, and the Port of Seattle refusing the ransom and later sending notification letters. Explains Respond: incidents managed and escalated, analysed with records preserved, communicated as required and contained and eradicated. Shows how STU applies triage, categorising and escalation with three simple levels, why the authority to contain must be agreed in advance, notification duties from the obligations register, and the ransom position its board agreed after legal advice and discussion with its insurer. Covers Recover: the recovery plan executed with critical functions first, backups and restored assets verified, progress communicated and an end declared, with every step in the incident log. Ends with finding the root cause, improving the plans, a simple test and a recap.

What you will be able to do

• Triage and escalate an incident using defined levels
• Agree containment authority and ransom decisions in advance
• Execute a recovery plan with critical functions first

Why it matters

Decide it before the night comes; containment and ransom decisions made in advance save hours when an incident hits.

Practice: Practice: Respond and Recover · 3 questions

Starts with a choice STU faced when it began: buying the tools vendors recommend and finding the biggest gaps still open a year later, or first mapping where it stands against the CSF outcomes and funding the gaps that matter most. Explains the two Profiles: a Current Profile showing how far each outcome is achieved, and a Target Profile that is selected and prioritised, with inputs such as enterprise risk profiles and business impact analysis registers. Walks through NIST's five steps: scope, gather information, create the Profiles, analyse the gaps and plan, then implement and update. Shows four sample rows from STU's Current Profile, and how STU ranks its gaps by risk first and effort second, asking which risks in the register each gap leaves open, with the reasoning written down. Ends with action plan formats and a recap.

What you will be able to do

• Create a Current Profile and a Target Profile
• Follow NIST's five steps for using a Profile
• Rank gaps by risk first and effort second

Why it matters

Start from outcomes, not from products; a Profile makes sure the security budget goes to the gaps that matter most.

Practice: Practice: Profiles in practice · 3 questions

Opens with two requests reaching STU in the same month: a US electronics client asking for its cybersecurity programme in CSF terms, answered with a Current Profile and a Tier, and a European pharmaceutical client asking for an ISO/IEC 27001 certificate, which only a certification body can issue after an audit. Explains the four Tiers, from Partial to Adaptive, which describe the rigour of governance and management practices and which NIST calls notional and optional. Covers choosing Target Tiers that fit your risks, following suppliers through the Tiers, and why being at different Tiers in different areas is useful. Then shows a few rows from STU's mapping to ISO/IEC 27001 by clause and control title, using Informative References, and how STU reports to the board and clients from one evidence library. Ends with a simple test and a recap.

What you will be able to do

• Explain the four CSF Tiers and when to move higher
• Map CSF outcomes to ISO/IEC 27001 clauses and controls
• Report to the board and clients from one set of evidence

Why it matters

One programme described in two languages lets you answer both CSF and ISO/IEC 27001 clients without double work.

Practice: Practice: Tiers, and connecting to ISO/IEC 27001 · 3 questions

Starts where Module 11 ended, with STU's ranked gaps, and turns each into an action with five parts: the gap, the action in plain words, one named owner, a date with milestones, and a measure of when the gap is closed. Shows the top of STU's action plan and how it balances its first year, with quick wins first, such as one-page incident criteria, a one-day restore test and supplier tiers built from the existing register. Covers measurement through performance and risk indicators, and STU's one-page quarterly report that ends with decisions. Then covers keeping the cycle going: Profiles updated after any incident or exercise, Tiers judged again, and the plan renewed every quarter and every year. Ends with a recap and the final exam.

What you will be able to do

• Turn each gap into an action with an owner, date and measure
• Write a quarterly progress report that ends with decisions
• Keep Profiles and Tiers current after incidents and exercises

Why it matters

Govern it, measure it and keep improving it; an action plan with named owners is what turns a Profile into progress.

Practice: Practice: Your action plan, the case and the exam · 3 questions