During the annual business review, the CEO asked a question.
“Can you walk us through our cybersecurity program?”
This question sounds so simple, but it’s often where things start to break down.
You know you’ve done the work. You have the tools in place, you’ve implemented controls, and you have defined the processes involved. Your cybersecurity team may have even handled real-world incidents. You put in time and resources into building a cybersecurity program that protects your business.
Yet when you try to explain about your cybersecurity program, the conversation becomes harder. Your planned simple answer turns to a long-winded explanation filled with technical terms. You assumed that you gave context to make it easier to understand, but in reality it is nothing more than fragmented details. You shared about the tools, the systems, and everything you have.
The CEO and leadership team listen. They may even nod along. The conversation moves forward.
But uncertainty hangs in the air.
Not because you do not have the cybersecurity program that they’re looking for, but because the way you communicated it does not connect. You use technically-correct buzzwords and jargon that accurately describe your program, but don’t help your leaders understand what it exactly does.
What Is the NIST Cybersecurity Framework
The National Institute of Standards and Technology Cybersecurity Framework, which most people call the NIST Cybersecurity Framework or NIST CSF, is one of the most widely recognized approaches for managing cybersecurity risk. NIST created the CSF to help companies and organizations build, assess, and improve their security programs in a more structured and repeatable manner.
This framework is made of six core functions:
- Govern
- Identify
- Protect
- Detect
- Respond
- Recover
A cybersecurity program provides these six core functions. The framework covers setting direction, understanding the risks and assets, protecting systems, detecting threats early, responding when something happens, and recovering to keep the company back on track.
This definition highlights the NIST CSF’s role in guiding the internal efforts on security, but it does not capture how useful the framework is when communicating about those security efforts.
Teams often use the NIST CSF to give structure to and organize cybersecurity efforts. It provides a method for mapping controls, documenting processes, and aligning security activities across the organization. You structure your controls in a way that is clear, logical, and accessible to non-technical personnel.
A NIST CSF-mapped cybersecurity program makes it easy to demonstrate to leaders, customers, and prospects that your program covers all the bases.
Why Most Cybersecurity Programs Fail to Communicate Value
Your leadership wants to know that you are managing the cybersecurity risk your organization faces.
The problem is that many security personnel want to focus on the technical aspects of their program. For leadership, technical details about specific controls or software vulnerabilities rarely clarify anything.
For example: domain controllers. Handling authentication and permissioning, they control access to email, files, applications, and nearly every operational function within an organization. When they fail, everything stops.
Trying to explain that risk using technical implementation details will not be very effective.
However, framing the conversation around how a domain controller impacts the business will change the conversation. When you explain that a domain controller outage could stop the business from running because employees will lose access to email (and most other systems), leadership understands.
Then, they’ll be ready to support your request for an improved backup system as part of the “Recover” function of your cybersecurity program.
The difference between the two is not the security system itself, but how you communicate it.
If you fail to communicate cyber risk effectively, decision-makers in your organization will not fully understand it. They won’t see it as important, and will be less willing to provide funding to support your goal.
Using NIST CSF as a Communication Framework
This is where the NIST Cybersecurity Framework becomes more than just a planning tool to build your cybersecurity program. It is a guide that helps you communicate your security structure to your leadership team.
Instead of presenting your security program as a bunch of tools, controls, and activities, you present it as a set of functions. It is a structure that helps people understand what each control does for the business.
How to Use EACH NIST CSF Function to Communicate Your Program
When we apply the NIST Cybersecurity framework in real-world environments, we use it to guide conversations rather than just showing internal documentation.
Here are the 6 Core Functions of the NIST CSF framework:
Govern
Govern is the function that sets the direction of your cybersecurity program. This is where you determine how cybersecurity aligns with your business goals including your risk tolerance and leadership expectations.
This function answers questions such as:
- Who is responsible for cybersecurity?
- Who makes decisions?
- How does the organization manage risk?
A common Govern activity is a cybersecurity steering committee that includes stakeholders from IT, operations, legal, and executive management to discuss and plan security decisions. The policies and procedures you create under Govern tie cybersecurity to the broader business strategy.
Identify
Once governance sets the direction and expectations, the next step is to identify what you need to protect.
The Identify function focuses on determining what assets matter most to your business. Beyond inventorying your assets and systems, Identify wants you to understand which parts of your environment are most important to your operations. This includes the systems, data, and processes that, if disrupted, would have a direct impact on your ability to operate, serve customers, or generate revenue.
Identify includes controls such as:
- Inventory management
- Vendor management
- Risk assessments
- And more!
Risk assessments are especially valuable beyond basic inventory management, because they connect assets to risks that threaten them. They identify which assets and which risks the rest of the program should prioritize.
Protect
Protect covers controls related to prevention. This is the category that people most commonly think of when they think of cybersecurity controls.
Multi-factor authentication (MFA) is a very common Protect control. MFA helps reduce the likelihood of account compromise by providing a second layer of authentication. Even if someone compromises your password, MFA still protects the account. Attackers must also compromise MFA or bypass it in order to pull off a successful attack.
Detect
Detect is about visibility. No organization is immune to cybersecurity incidents, no matter how strong their programs are. These controls help you quickly detect when something goes wrong. Recognizing an incident faster will help limit damage in the long-term.
One example is Security Information and Event Management (SIEM) monitoring. A SIEM platform collects and analyzes logs from systems, applications, and devices to help security teams identify suspicious activity such as unauthorized access attempts, unusual login behavior, or any malware-related events before they escalate into larger incidents.re
Anomalies detected by a well-configured SIEM trigger alerts, prompting users to initiate a response.
Respond
When something does go wrong, what do you do? That’s the question Respond addresses.
When an incident takes place, or even when your team detects a potential anomaly, what steps does your team take? Who handles which response duties? How quickly should they get information to leadership so they can make decisions?
An important Respond control is an Incident Response (IR) Plan. It’s also important to practice your IR Plan with incident response tabletop exercises. These controls help you to identify weaknesses in your IR plan and keep everyone trained on it.
Recover
The Incident Response plan often mentions Recover controls, but they differ from Respond in that they focus on restoring the business to normal operations.
Maintaining secure and tested backups of critical systems is a critical Recover control. If a domain controller suffers an outage, rapidly deploying backups will minimize impact on the organization.
You can’t entirely eliminate cyber attacks, but good Detect, Respond, and Recover controls can minimize the amount of damage one does. They keep events to minor incidents instead of full-blown disasters.
Turn NIST CSF Into Executive-Level and Executive-Facing Reporting
Once you structure your cybersecurity program around the six NIST CSF functions, it is much easier to communicate it consistently across different audiences.
Instead of presenting isolated updates or technical summaries, you can walk the leadership team through a cohesive explanation of how your company manages cyber risk. This framework helps you show what you’ve identified as critical, how you protect those assets, how you maintain visibility, how you handle incidents, and how you ensure recovery.
You demonstrate to your executives not just what you’re doing, but why it matters, and how it affects them. It creates alignment on what the internal team is doing and how you communicate it externally. The same strategy that guides internal strategy also guides the understanding of leadership and partners.
Answering the Question Your Organization’s Leaders Actually Care About
Cybersecurity is an inherently techy field. It’s adjacent to IT, astoundingly deep, and attracts people who love computers. The fascination with tech is a strength in a cybersecurity and tech leader, but creates blind spots when planning presentations.
The NIST Cybersecurity Framework provides a leadership-ready structure for explaining cybersecurity in a way that connects the technical work to the business’s priorities. By organizing conversations around the functions of the NIST CSF, you’ll communicate cybersecurity more clearly, and be more likely to win support from your executive team and board!
—
Want to get great cybersecurity content delivered to your inbox? Click here to sign up for our monthly newsletter, Tales from the Click.
