An official website of the United States government
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
A locked padlock
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
What is the Framework, and what is it designed to accomplish?
Is my organization required to use the Framework?
Does it provide a recommended checklist of what all organizations should do?
See all questions
What critical infrastructure does the Framework address?
Does the Framework apply only to critical infrastructure companies?
Does the Framework benefit organizations that view their cybersecurity programs as already mature?
What is the Framework Core and how is it used?
What are Framework Profiles and how are they used?
What are Framework Implementation Tiers and how are they used?
What is the difference between 'using', 'adopting', and 'implementing' the Framework?
Would the Framework have prevented recent highly publicized attacks?
Does the Framework address the cost and cost-effectiveness of cybersecurity risk management?
Does the Framework apply to small businesses?
Will NIST provide guidance for small businesses? Is there a starter kit or guide for organizations, just getting started with cybersecurity?
Will NIST provide guidance for small businesses? Is there a starter kit or guide for organizations just getting started with cybersecurity?
Are U.S. Federal agencies required to apply the Framework to Federal information systems?
Can U.S. Federal agencies apply the Framework to Federal information systems?
How is NIST integrating the Cybersecurity Framework into the cybersecurity risk management practices of federal agencies?
What is the relationship between the Cybersecurity Framework and the NICE Cybersecurity Workforce Framework?
What is the relationship between the Cybersecurity Framework and the NIST Privacy Framework?
What is the relationship between the Framework and the DHS Critical Infrastructure Cyber Community (C3) Voluntary Program?
Why is NIST deciding to update the Framework now?
How can I engage in the Framework update process?
Should I use CSF 1.1 or wait for CSF 2.0?
What are Informative References?
What is the National Cybersecurity Online Informative References (OLIR) Program?
Why were Online Informative References necessary?
How can I ensure resources or case studies my organization has released publicly are visible for others to use?
Does NIST encourage translations of the Cybersecurity Framework? If so, is there a procedure to follow?
Who can answer additional questions regarding the Framework?
How can I engage with NIST relative to the Cybersecurity Framework?