Cisco Security Portfolio Mapping to NIST CSF 2.0 Solution Guide

 

The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) was initially developed to provide organizations with a comprehensive, yet flexible, approach to managing and mitigating cybersecurity risks. It serves as a foundational guide for improving cybersecurity practices, offering a structured framework that is both cost-effective and adaptable to various industries and organization sizes. The NIST CSF is built around five core functions: IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER, which together create a holistic view of an organization’s cybersecurity posture.

Updated in February 2024, NIST CSF 2.0 has been updated to reflect the evolving cybersecurity landscape. This latest version retains the core principles of the original framework while incorporating new insights and addressing emerging threats and technologies, including increased emphasis on supply chain risk management and the integration of cybersecurity with broader enterprise risk management. It aims to foster communication across organizations and sectors, making it applicable to businesses of all sizes and types.

This Solution Guide provides a detailed mapping of the Cisco Security portfolio to NIST CSF 2.0, showcasing how Cisco’s security solutions align with the framework’s core functions. By utilizing this guide, organizations can enhance their cybersecurity posture and streamline risk management, ensuring alignment with industry best practices.

Figure 1: “Cisco Capability mapping to NIST CSF 2.0” shows the alignment of the Cisco Security portfolio with the NIST CSF 2.0 framework. This table serves as a valuable resource for understanding how Cisco’s security solutions support each function and category of the framework, enabling organizations to strategically integrate these capabilities into their cybersecurity strategies for enhanced risk management and compliance.

This Solutions Guide takes an additional step by mapping the categories of NIST CSF 2.0 to other significant frameworks utilized in both the United States and Europe, including NIST 800-53, CIS Controls v8, ISO 27001:2022, CMMC 2.0, and the MITRE ATT&CK as well as the EU DORA and NIS2. This enables you to cross-reference and align the Cisco Security portfolio with these frameworks, facilitating a comprehensive understanding and application across different regulatory and security standards.

Referencing Figure 1: Cisco Capability mapping to NIST CSF 2.0 in this section and the sections below will allow you to see where the other frameworks match NIST CSF 2.0. This provides a direct mapping of the Cisco Security portfolio.

Cisco Capability mapping to NIST CSF 2.0

Below, you will find a list of these key frameworks, accompanied by a brief description and a link for further exploration:

NIST 800-53: This is a set of guidelines published by the NIST to provide a comprehensive catalog of security and privacy controls for federal information systems and organizations, aiming to protect organizational operations, assets, individuals, and the nation.

CIS Controls v8: The Center for Internet Security (CIS) Controls v8 is a prioritized set of best practices created to help organizations strengthen their cybersecurity posture. It provides specific, actionable ways to stop today’s most pervasive and dangerous attacks.

ISO 27001: ISO 27001 is an international standard that outlines the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS) to manage the security of assets such as financial information, intellectual property, employee details, or information entrusted by third parties.

CMMC: The Cybersecurity Maturity Model Certification (CMMC) is a framework designed by the U.S. Department of Defense to ensure that contractors have the necessary cybersecurity practices and processes in place to protect sensitive information, particularly within the defense industrial base.

MITRE ATT&CK: The MITRE ATT&CK framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used to help organizations understand, detect, and respond to cyber threats.

DORA: The Digital Operational Resilience Act (DORA) is a regulation by the European Union aimed at strengthening the IT security and operational resilience of financial institutions and service providers within the EU, ensuring they can withstand, respond to, and recover from all types of ICT-related disruptions and threats.

NIS2: The Network and Information Security Directive 2 (NIS2) is an EU directive aimed at enhancing the cybersecurity posture across the union by establishing measures for a high common level of cybersecurity for network and information systems across member states.

This is a substantial mapping exercise that follows the methodology outlined in NIST Internal Report (IR) 8477 “Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines”. NIST IR 8477 describes the NIST’s approach to mapping the elements of documentary standards, regulations, frameworks, and guidelines to a particular NIST publication (NIST CSF 2.0 in this instance).

Mapping NIST CSF 2.0 IDENTIFY to Other Frameworks

Below, you will find how NIST CSF 2.0 IDENTIFY categories – ID.AM (Asset Management), ID.RA (Risk Assessment), and ID.IM (Information Management) – correspond to specific categories or controls in the frameworks mentioned.

Note:       The mappings are based on conceptual alignment between the frameworks as per NIST IR 8477 methodology.

 

 

Mapping NIST CSF 2.0 PROTECT to Other Frameworks

Right, you will find how NIST CSF 2.0 PROTECT – PR.AA (Identity Management, Authentication, and Access Control), PR.AT (Awareness and Training), PR.DS (Data Security), PR.PS (Protective Technology), and PR.IR (Technology Infrastructure Resilience) – correspond to specific categories or controls in the mentioned frameworks.

Note:       The mappings are based on conceptual alignment between the frameworks as per NIST IR 8477 methodology.

 

 

 

 

 

Mapping NIST CSF 2.0 DETECT to Other Frameworks

Below, you will find how NIST CSF 2.0 DETECT categories – DE.CM (Security Continuous Monitoring) and DE.AE (Anomalies and Events) – correspond to specific categories or controls in the mentioned frameworks.

Note:       The mappings are based on conceptual alignment between the frameworks as per NIST IR 8477 methodology.

 

 

Mapping NIST CSF 2.0 RESPOND to Other Frameworks

Below, you will find how NIST CSF 2.0 RESPOND categories – RS.MA (Incident Response Management), RS.AN (Incident Analysis), RS.CO (Communications), and RS.MI (Mitigation) – correspond to specific categories or controls in the mentioned frameworks.

Note:       The mappings are based on conceptual alignment between the frameworks as per NIST IR 8477 methodology.

 

 

 

Mapping NIST CSF 2.0 RECOVER to Other Frameworks

Below, you will find how NIST CSF 2.0 RECOVER categories – RC.RP (Incident Recovery Plan Execution) and RC.CO (Incident Recovery Communication) – correspond to specific categories or controls in the mentioned frameworks.

Note:       The mappings are based on conceptual alignment between the frameworks as per NIST IR 8477 methodology.

 

Get Started

As noted above, this Solution Guide offers an in-depth mapping of Cisco’s Security portfolio to the NIST CSF 2.0, illustrating how Cisco’s offerings can assist organizations in aligning with this framework. By leveraging Cisco’s capabilities, businesses can bolster their cybersecurity posture, optimize risk management, and adhere to industry best practices.

Additionally, the Guide maps NIST CSF 2.0 to various well-known and utilized frameworks. This comprehensive approach helps organizations gain a holistic view of their security status across diverse regulatory and security standards.

To fully leverage the insights provided, we encourage you to conduct a thorough assessment of your current cybersecurity strategies and identify areas where Cisco’s solutions can be effectively integrated. Utilize the mappings to align your security posture with NIST CSF 2.0 and other relevant frameworks.

Engage with Cisco’s experts to explore tailored security solutions that meet your specific needs and ensure protection in the digital age.

Together, let’s build a secure and resilient future.

This cross-referencing empowers organizations to strategically address cybersecurity challenges on a global scale, enhancing resilience and adaptability in the face of emerging threats.