NIST SP CSF 2.0

Incident Response as a part of Cyber Security

• Incident Response Life Cycle

• Incident Response Roles and Responsibilities

1. CSF 2.0 Community Profile for Cyber Incident Risk Management

• Preparation and Lesson Learned

• Incident Response

Comparision Between NIST Older vs CSF 2.0

Previous Incident Response Life Cycle Model Phase	CSF 2.0 Functions
Preparation	Govern Identify (All Category) Protect
Detection & Analysis	Detect Identify (Improvement Category)
Containment, Eradication & Recovery	Respond Recover Identify (Improvement Category)
Post-Incident Activity	Identify (Improvement Category)

• Govern (GV): This is like setting the rules and making sure everyone understands the security strategy, expectations, and policies. It’s the leadership and oversight part.

• Identify (ID): Knowing what you have (your digital assets) and understanding the cybersecurity risks you face is crucial

• Protect (PR): Putting safeguards in place to manage those risks and prevent incidents from happening in the first place

• Detect (DE): Continuously looking for signs of attacks and potential problems

• Respond (RS): Taking action when an incident is detected. This includes managing, prioritizing, containing, and getting rid of the threat, as well as communicating about it

• Recover (RC): Restoring your systems and operations after an incident

Roles and Responsibilities

Here’s a cheat sheet summarizing Incident Response Roles and Responsibilities in a tabular format:

Role	Responsibilities	Key Actions/Participants
Leadership	Oversees incident response, allocates funding, and makes high-impact decisions.	Management and executive team.
Incident Handlers	Verify incidents, collect/analyze data, prioritize activities, mitigate damage, and restore operations.	On-staff team, contracted MSSPs, or on-call personnel.
Technology Professionals	Involved in cybersecurity, privacy, system/network architecture, and recovery efforts.	Architects, engineers, administrators, software developers.
Legal	Ensures compliance with laws/regulations, reviews contracts, and provides legal guidance.	Legal experts and advisors.
Public Affairs	Manages communication with media and public during incidents.	Public relations and media engagement personnel.
Human Resources	Handles pre-employment screening, onboarding/offboarding, and employee conduct investigations.	HR department.
Physical Security	Addresses physical breaches/logical attacks and facilitates access to compromised facilities.	Security and facilities management teams.
Asset Owners	Provide insights on priorities for affected assets and stay updated on response progress.	System owners, data owners, and business process owners.
Third-Party Providers	Perform incident detection/response, define shared responsibilities, and mitigate risks (e.g., insider threats).	MSSPs, CSPs, ISPs, and contracted service providers.

Roles and Responsibility

Incident Response Policies, Processes and Procedures

"Organizations need tailored cybersecurity incident response policies, typically covering key elements."

• Statement of management commitment

• Purpose and objectives of the policy

• Scope of the policy (i.e., to whom and what it applies and under what circumstances

• Definition of events, cybersecurity incidents, investigations, and related terms

• Roles, responsibilities, and authorities, such as which roles have the authority to confiscate, disconnect, or shut down technology assets

• Guidelines for prioritizing incidents, estimating their severity, initiating recovery processes, maintaining or restoring operations, and other key actions

• Performance measures

---

CSF 2.0 Community Profile for Cyber Incident Risk Management

A CSF Community Profile is a baseline of CSF outcomes that is created and published to address shared interests and goals for reducing cybersecurity risk among a number of organizations. A Community Profile is typically developed for a particular sector, subsector, technology, threat type, or other use case [CSF2.0].

• Purpose: Defines NIST CSF 2.0 Community Profile for cyber incident risk management.

• Core Framework: Uses CSF Core to prioritize cybersecurity outcomes for incident response.

• Structure:

  • Table 2: Covers Preparation (Govern, Identify, Protect) and Lessons Learned (Identify-Improvement).

  • Table 3: Focuses on Incident Response (Detect, Respond, Recover).

• Priority Levels:

  • High: Core incident response activities.

  • Medium: Direct support for incident response.

  • Low: Indirect support for incident response.

• Customizable Profiles: Organizations are encouraged to adapt the profiles to meet their specific needs.

• Annotations:

  • R: Recommendations (mandatory actions).

  • C: Considerations (optional actions).

  • N: Notes (additional information).

• Unique Identifiers: Each annotation is appended to a CSF ID, e.g., GV.OC-03.R1.

• Applicability: Recommendations, considerations, and notes apply broadly to Functions, Categories, and Subcategories.

• Supplementary Resources: Provides additional documents and online tools to support CSF outcomes.

• Updates: Technologies and terms mentioned may become outdated; organizations should define terms based on context, laws, and regulations.

• Audience: Applicable to organizations across all sectors and sizes; versions for narrower audiences may be developed.

Cheat Sheet Table

Aspect	Details
Focus	Incident response within cybersecurity risk management.
Framework Used	NIST CSF 2.0 (Functions, Categories, Subcategories).
Priority Levels	High (Core activities), Medium (Direct support), Low (Indirect support).
Customizable	Tailored to reflect organizational priorities.
Annotations	R (Recommendation), C (Consideration), N (Note).
Examples	GV.OC-03.R1 (Govern > Organizational Communications > Recommendation 1).
Audiences	Broad sectors; customized profiles for specific groups like small businesses or federal entities.
Resources	Supplementary documents, glossary, and NIST Framework Resource Center.