NIST CSF 2.0 & SP 800-53 interview questions

NIST CSF 2.0, released in February 2024, is a voluntary framework that helps organisations of any size or sector understand, assess, prioritise and communicate cybersecurity risk.

• It is outcome-based: it says what to achieve, not exactly how.
• Version 2.0 broadened the scope beyond critical infrastructure to all organisations.
• Its core is organised into Functions, Categories and Subcategories, supported by implementation examples and informative references to other standards.

• Govern (GV): establish and monitor the organisation's cybersecurity risk management strategy, expectations and policy. New in 2.0.
• Identify (ID): understand current cybersecurity risks — assets, risk assessment, improvement.
• Protect (PR): safeguards to manage risk — identity and access, awareness, data security, platform security, resilience.
• Detect (DE): find and analyse possible attacks and compromises.
• Respond (RS): take action on a detected incident.
• Recover (RC): restore assets and operations affected by an incident.

Govern sits at the centre, informing how the other five are implemented.

• The CSF Core: a hierarchy of cybersecurity outcomes arranged as Functions (6), Categories and Subcategories.
• CSF Organizational Profiles: a description of an organisation's current and/or target posture in terms of Core outcomes, used to find and prioritise gaps.
• CSF Tiers: a way to describe how rigorous the organisation's cybersecurity risk governance and management practices are, from Tier 1 (Partial) to Tier 4 (Adaptive).

NIST also publishes supporting online resources such as Implementation Examples, Informative References and Quick Start Guides.

• The first part is the Function (PR = Protect).
• The second part is the Category (AA = Identity Management, Authentication, and Access Control).
• The number is the specific Subcategory outcome (01 = identities and credentials for authorised users, services and hardware are managed by the organisation).

CSF 2.0 reorganised many categories compared with 1.1. For example, the old PR.AC was replaced by PR.AA, and the supply chain category moved under Govern as GV.SC.

• GV.OC Organizational Context: mission, stakeholder expectations and legal and regulatory requirements.
• GV.RM Risk Management Strategy: priorities, constraints, risk appetite and tolerance statements.
• GV.RR Roles, Responsibilities, and Authorities: accountability, including leadership's.
• GV.PO Policy: establishing, communicating and enforcing cybersecurity policy.
• GV.OV Oversight: results of risk management activities are used to inform and adjust strategy.
• GV.SC Cybersecurity Supply Chain Risk Management.

• Use their world, not framework language. For a clinic operations director, for example:
• Govern: who decides how much cyber risk the clinics can take, and who is accountable.
• Identify: knowing which systems and data the clinics rely on, and what could go wrong.
• Protect: the safeguards, such as logins with MFA, trained staff and backups.
• Detect: noticing quickly when something is wrong.
• Respond: what the clinic does in the first hours of an incident.
• Recover: getting back to normal, such as restoring systems and catching up on records.

Then give one concrete action their department owns under each function.

Govern elevates cybersecurity governance to a top-level function. Its categories cover:

• Organisational context (mission, stakeholders, legal and regulatory requirements).
• Risk management strategy (priorities, appetite, tolerance).
• Roles, responsibilities and authorities.
• Policy.
• Oversight (reviewing and adjusting the strategy).
• Cybersecurity supply chain risk management.

It reflects the view that cybersecurity is an enterprise risk that leadership must direct, not just an IT activity.

• Profiles: a Current Profile describes the outcomes an organisation is achieving today; a Target Profile describes the outcomes it wants to achieve. The gap between them drives an action plan. Community Profiles are shared baselines for a sector or use case.
• Tiers: describe the rigour of cybersecurity risk governance and management — Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable, Tier 4 Adaptive.

Tiers are not a maturity certification; organisations choose the tier that fits their risk and resources.

NIST Special Publication 800-53 (currently Revision 5) is a comprehensive catalogue of security and privacy controls for information systems and organisations.

• It contains 20 control families, e.g. Access Control (AC), Audit and Accountability (AU), Configuration Management (CM), Contingency Planning (CP), Incident Response (IR), Risk Assessment (RA), System and Communications Protection (SC), and Supply Chain Risk Management (SR), which was added in Rev 5.
• Rev 5 integrated privacy controls into the catalogue and made controls more outcome-focused so they can be used by any organisation, not only US federal agencies.
• Control baselines (Low, Moderate, High, plus a privacy baseline) are published separately in SP 800-53B.

It is mandatory for US federal systems and is the basis of programmes such as FedRAMP; many private organisations use it as a detailed control reference.

• CSF is a high-level, outcome-based framework for managing and communicating cybersecurity risk. It is concise and voluntary.
• SP 800-53 is a detailed catalogue of specific security and privacy controls and enhancements.
• They are complementary: CSF says what outcomes to achieve; 800-53 provides detailed controls that can achieve them. NIST publishes mappings between the two.

• SP 800-30: guide for conducting risk assessments.
• SP 800-37: Risk Management Framework.
• SP 800-61: computer security incident handling guide (Revision 3 aligns incident response with CSF 2.0).
• SP 800-34: contingency planning guide for information systems.
• SP 800-161: cybersecurity supply chain risk management.
• SP 800-171: protecting Controlled Unclassified Information in non-federal systems.
• NIST Privacy Framework: a companion to the CSF for privacy risk.

• Tier 1 Partial: ad hoc, reactive cybersecurity risk management.
• Tier 2 Risk Informed: practices approved by management but not organisation-wide policy.
• Tier 3 Repeatable: formally approved, expressed as policy and regularly updated.
• Tier 4 Adaptive: adapts based on lessons learned and predictive indicators, and is part of the organisational culture.

NIST says Tiers describe the rigour of risk governance and management practices. They are not meant as a strict maturity model for every subcategory, and not every organisation needs Tier 4. Many organisations still use them, or their own scale, to express maturity.

1. Agree scope and objectives with sponsors (whole enterprise or a business unit).
2. Select the relevant subcategories and consider using a Community Profile for your sector.
3. Collect evidence through interviews, documents and technical data for each outcome.
4. Rate the current state with a consistent scale and record it in a current profile.
5. Agree the target profile with leadership, based on risk, regulation and appetite.
6. Analyse and prioritise the gaps, then build an action plan with owners, cost and timing.
7. Reassess periodically to track progress.

SP 800-53 Rev. 5 groups controls into 20 families, such as AC (Access Control), AU (Audit and Accountability), CM (Configuration Management), IR (Incident Response), RA (Risk Assessment), SC (System and Communications Protection), SR (Supply Chain Risk Management) and PT (PII Processing and Transparency).

• A base control states the main requirement (for example AC-2 Account Management).
• Control enhancements add strength or capability, shown in brackets, such as AC-2(1) Automated System Account Management.
• Baselines (Low, Moderate, High and a Privacy baseline) are published in SP 800-53B.
• Rev. 5 made controls outcome-based and integrated privacy and supply chain controls into the main catalogue.

FIPS 199 categorises information and systems by the potential impact (Low, Moderate, High) of a loss of confidentiality, integrity or availability.

• Each information type gets a rating for C, I and A.
• The system's overall category is usually the highest rating across them (the high-water mark).
• SP 800-60 helps map information types to provisional impact levels.
• The category drives which SP 800-53B baseline applies in the RMF Select step.

• Do not create a second programme. Use the CSF as a lens and communication tool on top of the existing ISMS.
• Map the CSF subcategories to your ISO 27001 Annex A controls and SoA (NIST provides informative references to help).
• Use CSF profiles to show current versus target posture to the board, especially for Govern, Detect, Respond and Recover.
• Close the gaps the mapping reveals, often in supply chain governance, continuous monitoring and recovery testing.
• Report using CSF functions if leadership finds that clearer, while keeping ISO certification evidence in the ISMS.

• Clarify what they need: a self-assessment, a mapping, or evidence for specific outcomes.
• Use an existing mapping from your current framework (ISO 27001 or SOC 2) to the CSF to produce a profile quickly.
• Be honest about partial areas and include planned improvements with dates.
• Provide supporting evidence such as certificates and SOC 2 reports instead of raw internal documents.
• Keep the result as a reusable asset for other customers.

• Start from the drivers: customers, regulations (HIPAA in the US, local health rules elsewhere), and what buyers ask for.
• CIS Controls (with their Implementation Groups) give a practical, prioritised technical starting point for a small team.
• NIST CSF 2.0 gives a business-friendly structure and board language, plus the Govern function.
• ISO 27001 gives a certifiable management system that customers recognise, especially outside the US.
• A common answer: use CIS IG1 for quick wins, CSF to structure and report, and plan ISO 27001 (or SOC 2) when sales require it.

There is no single correct answer. Interviewers want your reasoning.

The RMF (NIST SP 800-37 Rev 2) has seven steps:

1. Prepare: establish context and priorities at organisation and system level.
2. Categorise: determine system impact level based on the information processed (using FIPS 199 / SP 800-60).
3. Select: choose and tailor controls from SP 800-53.
4. Implement: put controls in place and document them.
5. Assess: determine whether controls are implemented correctly and producing the desired outcome.
6. Authorise: a senior official accepts the residual risk and authorises the system to operate (ATO).
7. Monitor: continuously monitor controls, changes and risk.

• SP 800-171 sets security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems. Revision 3 was published in 2024.
• The US Department of Defense's CMMC programme uses SP 800-171 as the basis for its assessment levels for defence contractors.
• Outside the US, these matter for companies in the defence supply chain or those serving US government clients, including overseas subsidiaries.
• They also offer a useful, well-structured control set for protecting sensitive data in general.

The NIST AI RMF 1.0 (2023) is a voluntary framework for managing risks of AI systems. It has four functions:

• Govern: culture, policies, accountability for AI risk.
• Map: understand the context and identify risks of an AI system.
• Measure: analyse, assess and track AI risks (accuracy, bias, robustness, security).
• Manage: prioritise and act on risks.

It complements the CSF. The CSF addresses cybersecurity outcomes, while the AI RMF covers wider trustworthiness issues such as fairness, transparency and safety. NIST has also published a Generative AI profile for the AI RMF.

• In the RMF Monitor step, controls and risks are monitored on an ongoing basis according to a continuous monitoring strategy (SP 800-137).
• Monitoring frequency is based on control volatility and risk: automated controls might be checked daily, policies yearly.
• Results feed ongoing authorisation decisions, so the authorising official sees current risk instead of a 3-year-old assessment.
• It requires good asset data, automation and clear thresholds for when changes trigger reassessment.

• Review the Plan of Action and Milestones (POA&M) with the system owner and prioritise by risk.
• Close quick wins and get realistic dates and resources for the rest.
• Identify compensating controls that reduce risk while items are open.
• Present a clear risk picture to the authorising official: what is open, the residual risk and the plan.
• Options include a time-limited or conditional authorisation, reduced system scope, or delaying go-live. The AO decides; GRC makes sure the decision is informed and documented.

• Read the new revision (SP 800-61 Rev. 3, finalised in 2025), which describes incident response through the CSF 2.0 functions rather than the older four-phase lifecycle.
• Map your existing plan and playbooks to the CSF functions: preparation lives largely in Govern, Identify and Protect, while Detect, Respond and Recover cover the incident itself.
• Check gaps such as governance roles, supplier involvement and lessons-learned feedback into risk management.
• Update the plan, train the team and test with a tabletop exercise.
• Keep what works. Revision changes are about alignment and integration, not discarding effective processes.