The document discusses the NIST Cybersecurity Framework. It defines key terms like information security, CIA triad, and cybersecurity. It explains that the NIST CSF provides guidance on cybersecurity risk management principles and best practices. It outlines the Framework Core, Implementation Tiers, and Profiles to help organizations manage cybersecurity risks in a cost-effective manner. The CSF can be used by organizations of any size or sector to understand and apply cybersecurity risk management.

1. Cybersecurity Framework
Manajemen Risiko Keamanan Informasi [EL5216 17/18]
Muhammad Akbar Yasin [23216322]

2. Terms
• Information Security
• Information security is about the protection of information, regardless of
whether it is stored digitally or not
• CIA Triad
• Cybersecurity
• Is it about securing “cyber”?
• Cyber security is about securing things that are vulnerable through ICT
[1] https://ccis.no/cyber-security-versus-information-security/

3. Terms (continued)
• ISACA Glossary
• Information
• An asset that, like other important business assets, is essential to an enterprise’s
business. It can exist in many forms. It can be printed or written on paper, stored
electronically, transmitted by post or by using electronic means, shown on films, or
spoken in conversation.
• Information security
• Ensures that within the enterprise, information is protected against disclosure to
unauthorized users (confidentiality), improper modification (integrity), and non-access
when required (availability).
• Cybersecurity
• The protection of information assets by addressing threats to information processed,
stored, and transported by internetworked information systems
[3] https://www.isaca.org/Pages/Glossary.aspx

4. Infosec vs Cybersecurity
[2] http://www.cisoplatform.com/profiles/blogs/understanding-difference-between-cyber-security-information

5. NIST Cybersecurity Framework
• Why NIST CSF?
• Provides guidance on risk management principles and best practices,
• Provides common language to address and manage cybersecurity risk
• Outlines a structure for organizations to understand and apply cybersecurity
risk management
• Identifies effective standards, guidelines, and practices to manage
cybersecurity risk in a cost-effective manner based on business needs.
• Who Should Used the Framework?
• for organizations of all sizes, sectors, and maturities. While the Framework
was designed with Critical Infrastructure (CI) in mind, it is extremely versatile
and can be used by organizations regardless of sector or size.
[4] https://www.us-cert.gov/sites/default/files/c3vp/framework_guidance/HPH_Framework_Implementation_Guidance.pdf, page 11

6. NIST Cybersecurity Framework
[5] Implementing The Nist Cybersecurity Framework Using Cobit 5: a step-by-step guide for your enterprise

7. [6] https://www.orbussoftware.com/governance-risk-and-compliance/nist/benefits/

8. Framework Core
Subcategories are the deepest level of
abstraction in the Core. There are 98
Subcategories, which are outcome-
driven statements that provide
considerations for creating or improving
a cybersecurity program.
[7] https://www.nist.gov/cyberframework/online-learning/components-framework

9. Implementation Tiers
Tiers describe the degree to which
an organization’s cybersecurity risk
management practices exhibit the
characteristics defined in the
Framework.
The Tiers range from Partial (Tier 1)
to Adaptive (Tier 4) and describe an
increasing degree of rigor, and how
well integrated cybersecurity risk
decisions are into broader risk
decisions, and the degree to which
the organization shares and
receives cybersecurity info from
external parties

10. Implementation Tiers
[8] https://supplier.intel.com/static/governance/documents/The-cybersecurity-framework-in-action-an-intel-use-case-brief.pdf

11. Profiles
Profiles are an organization's unique alignment of their
organizational requirements and objectives, risk
appetite, and resources against the desired outcomes of
the Framework Core.
Profiles can be used to identify opportunities for
improving cybersecurity posture by comparing a
“Current” Profile with a “Target” Profile.

12. Reference
• [1] https://ccis.no/cyber-security-versus-information-security/
• [2] http://www.cisoplatform.com/profiles/blogs/understanding-difference-between-
cyber-security-information
• [3] https://www.isaca.org/Pages/Glossary.aspx
• [4] https://www.us-
cert.gov/sites/default/files/c3vp/framework_guidance/HPH_Framework_Implementatio
n_Guidance.pdf, page 11
• [5] Implementing The Nist Cybersecurity Framework Using Cobit 5: a step-by-step guide
for your enterprise, page 5
• [6] https://www.orbussoftware.com/governance-risk-and-compliance/nist/benefits/
• [7] https://www.nist.gov/cyberframework/online-learning/components-framework
• [8] https://supplier.intel.com/static/governance/documents/The-cybersecurity-
framework-in-action-an-intel-use-case-brief.pdf