YT YouTube2Text

YouTube2Text → Transcripts → NIST CSF 2.0 Framework Training - IT/Cybersecurity Audit and Compliance Training

NIST CSF 2.0 Framework Training - IT/Cybersecurity Audit and Compliance Training — Transcript

by Your IT Career with Dr. Peju · 12,900 words · 1,874 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:02all right good morning everybody and
0:04welcome to today's training so today's
0:06training we are going to be talking
0:08about the nist CSF 2.0 framework so this
0:12is something that has been very very hot
0:14off the press the last few weeks it was
0:16released towards the end of February by
0:18nist and everybody's been talking about
0:20it and I've had several of you ask me
0:22questions about this so that's why I
0:24decided to put a training together to
0:26really do a deep dive of Nest CSF 2.0
0:30and more importantly for you guys as um
0:32all part of my it audit training program
0:34I want you to Al also understand the
0:36implications for your it audit or it
0:39compliance career so let me go ahead and
0:42get started with the training so today's
0:46training like I said is the ncsf 2.0 and
0:48we're going to be understanding the
0:50framework so let's take a look at the
0:52topics that we have for
0:54today here are the topics we're going to
0:56cover it seems there are three key areas
0:58that I really want to cover so the first
1:00in the first area is an introduction to
1:02n CSF 2.0 what is it right why is it
1:05even important why are we looking at
1:06this and then the main part of today's
1:09training would be the N CSF 2.0
1:11components so there are several key
1:13components within it that make it that
1:16make the framework what it is so we'll
1:17be doing a deep dive into those
1:19components and then at the end we're
1:21going to talk about the implications for
1:22it cyber security audit and compliance
1:25careers and then we'll have Q&A at the
1:27end I may allow some Q&A in the middle
1:30but let's see how we we we do with time
1:33because I know we have some limited time
1:34today but definitely make sure that if
1:36you have questions you can put them in
1:38the chat or when I ask for questions at
1:41the end you can speak up and ask for
1:42them okay I'll ask your questions so
1:45let's take a look at this I'm going to
1:47stop my camera just for a bit so that we
1:49can get into the main slide here and
1:51then I'll be back on camera for um other
1:53parts of the
1:57training all right so our first topic
2:00today is an introduction to NIS CSF 2.0
2:04what is NIS CSF 2.0 okay so let's take a
2:07look at the official definition first I
2:09always like to go through the official
2:11definition first before we then talk
2:13about it in simple terms that you guys
2:15can all really understand so from the N
2:18CSF website and um at the end of class
2:20today I'll send um an update where you
2:22guys will get all the different links
2:24but from this n CSF website the
2:26definition of the CSF framework is that
2:28the cyber security framework work
2:30provides cyber security risk management
2:33guidance to companies and so when we say
2:35companies this could be Industries or
2:37governmental agencies nist is a
2:39governmental agency so a lot of what
2:41they do applies to both public
2:43organizations as well as government
2:46agencies so that's what the framework is
2:48for and the cool thing about NSF 2.0 is
2:51that 2.0 is the updated version the good
2:54thing about this is it can be used by
2:56all organizations so whether your
2:58organization is small regardless L of
3:00the industry it's in whether it's in
3:02health care or manufacturing or again a
3:05government agency or even regardless of
3:07the maturity level did they just start
3:09building out a cyber security function
3:12or do they already have a function
3:13that's been active for years right
3:16regardless of that companies can use
3:18this framework to understand prior
3:21assess prioritize and communicate their
3:24cyber security efforts so those are four
3:26key wordss from the N CSF website but
3:29before we keep going into an
3:31introduction here one of the challenges
3:33that I've typically seen is that people
3:36don't even understand what a framework
3:38is so when they don't understand what a
3:40framework is it's difficult them for uh
3:43it's difficult for them to understand
3:45what we're talking about so before I get
3:47into the specifics of nist let's talk
3:50about what a framework is as a reminder
3:52some of you might know this from my
3:53class already but let's do a quick
3:55refresher on that so that when we come
3:57back to the definition you will you will
3:59better understand what n
4:02is so what is an IT framework an IT
4:07framework provides guidance on best
4:10practices so let's say that again an IT
4:12framework provides guidance on best
4:15practices that can be used to develop
4:17the it cyber security control um
4:20environment of an organization so let me
4:22come on camera because I want you guys
4:23to really get this piece when you have a
4:26framework the framework is not telling
4:28you exactly what to to do the framework
4:31is giving you an outline and it's
4:32telling you what the best practices are
4:35out there right that a company should
4:36consider implementing into their
4:39Organization for them to have a good
4:41control environment so again when you
4:44think of Frameworks always think of it
4:45as this is providing guidance it's not
4:48prescriptive it's not telling me exactly
4:50what to do but as an organization the
4:53framework is telling us this is what
4:54we've seen work in other places so this
4:57is what you might want to consider when
4:59you are putting it control environment
5:01together so based on that right some
5:03examples we know are nist and there are
5:05so many different Frameworks for nist
5:07right we have CSF RMF 853 there's so
5:10many different ones but that's an
5:12example we have Koso we have kobit right
5:15but the key thing I want you to learn or
5:17remember is that the framework is not a
5:20standard so this is not SS 18 it's not
5:23PCI and it's not a law likee socks that
5:25says You must meet this requirement it's
5:27giving guidance on what you should do in
5:30order to have an effective control
5:32environment and the benefit of following
5:34Frameworks is that once you have a good
5:36control environment then you have a
5:39higher chance right of meeting any other
5:41standards that you have to comply with
5:43like SSA 18 PCI ISO and things like that
5:47all right so based on now you guys
5:49better understanding let me do this
5:52there's folks trying to get in hold on
5:56sorry okay so based on based on that
6:00better understanding of what a framework
6:02is let's now go back to the definition
6:04right so the framework is providing risk
6:08management guidance so this is very
6:10specific to cyber security risk
6:12management guidance for Industries
6:14government agencies and other
6:16organizations so hopefully that
6:18definition of um a framework is is now
6:21helping you better understand why n CSF
6:24is even a thinge why is it that people
6:26need to why is it that people are
6:27talking about n CSF 2.0 and why is it
6:30important it's because it's giv that
6:33framework of how the cyber security risk
6:35management should be handled in an
6:37organization so that they have Best in
6:40Class best practices okay so let me you
6:43put this in simple terms you know I like
6:45to put things in simple terms so in
6:47simple terms the CSF is intended to
6:50provide guidance on practices and
6:52controls it is not to prescribe specific
6:56outcomes what do I mean by that it's not
6:58telling organiz gations you have to do
7:00ABC in order to get this outcome it's
7:03telling organizations here are the
7:05things you should consider for your it
7:07processes for your it controls so that
7:10you can be compliant well so that first
7:13of all you have a good well-designed it
7:15environment which in turn will help you
7:18be compliant with the standards that we
7:20talk about in our it audit programs and
7:23for just to wrap this section off
7:24because we're going to use the word
7:26outcome a lot in this um training so I
7:28want you to understand what what I mean
7:30by outcome the outcome means what the
7:32company is looking to achieve what do
7:35they really want their cyber security
7:36posture to look like because the reality
7:38is a small M and pop you know private
7:41company that doesn't do a lot on cyber
7:44security might not want a very rigorous
7:47or robust cyber security risk posture
7:50like Walmart ra or like Amazon that's
7:52exposed to a lot of risk so companies
7:54get to decide what outcome they want and
7:57then based on the outcome they want then
7:59they have the ability to say that's what
8:01we want and this is how we're going to
8:03follow this guidance in order to achieve
8:06that outcome all right so that gives you
8:08the introduction to CSF now based on
8:11that definition and understanding that
8:13the CSF is providing a framework or
8:16guidance on how to perform controls
8:18we're now going to dive deep into what
8:20CSF is what the different components are
8:23and then we'll continue with the
8:24training there
8:28okay
8:32all right so let's do
8:35this the next section all right so the
8:39next section that we're going to cover
8:40in today's training is what are the N
8:42CSF 2.0 components and we're going to
8:44cover a lot here so I'm going to preface
8:46that by saying don't worry you don't
8:48need to memorize all of this today I
8:50will be sharing links to the actual n
8:53CSF documents and the site where you can
8:55download the different documents and
8:57then whenever I put this on the course
8:58website it also will be uploaded so for
9:00today just focus on understanding and
9:03thinking through how this impacts or um
9:06impacts or the implications for your
9:07career okay so let's talk about the N
9:10CSF 2.0
9:14components there are three to there are
9:17three components to n CSF 2.0 okay so
9:20the first one is the CSF core second is
9:23CSF organizational profiles and third is
9:26CSF tiers we're going to go through each
9:28one in detail but just to do a quick
9:31introduction so you have an idea of what
9:32we're talking about the CSF core is
9:35really the meat right the main part of
9:38the N CSF um 2.0 it's it shows the
9:42hierarchy of functions and if you don't
9:43understand what this terms mean that's
9:45okay I'll be explaining those in a
9:46little bit but it shows the hierarchy of
9:48functions categories and subcategories
9:52that detail the outcomes that a company
9:54wants and we'll talk about those in
9:55detail don't worry and then the
9:57organizational profile oh there's a typo
9:59there sorry but the organizational
10:01profile is showing the current and the
10:04target profile that the organization
10:05wants and then the tiers is the
10:07characterization of the rigor so
10:10remember earlier I said organizations
10:12get to choose whether or not or the
10:15level of cyber security risk management
10:17they want so the ti is what helps
10:19organizations determine what it is or
10:22the level that they want okay so the cor
10:24is the hierarchy of functions the
10:26organizational profile shows the current
10:28and the target Prof profile for the
10:29organization and sorry about that typo
10:31we'll address that later but then the
10:33tiers shows the rigor what's the rigor
10:36of the risk management practices that
10:38the organization wants okay all right so
10:42let's go ahead and talk about the CSF
10:44core and this is the main part of
10:45today's
10:46training so as I mentioned earlier the
10:49CSF core is the hierarchy of functions
10:52categories and subcategories that detail
10:55the outcomes right that detail what is
10:56it that a company wants to achieve and
10:59there are six main functions previously
11:02before CSF 2.0 the Govern that first one
11:06you see there was not there we just had
11:08identify protect detect respond and
11:11recover but one of the big changes with
11:13this particular framework this
11:15particular version is that the Govern
11:17function was added so this is just a
11:20quick overview of what it looks like in
11:22the N presentation and or in the N
11:25document and what you'll see here is
11:27that govern if you look at this image it
11:30really goes around the N cyber security
11:32framework so let me ask you guys a
11:34question I want this to be a little bit
11:36interactive here when you hear govern
11:39right you guys have been in my it a
11:41class we talk about compliance some what
11:43do you think of when you hear the word
11:45govern what what's the first thing that
11:47comes to mind there's an acronym right
11:49that should come to your mind when you
11:50hear the word govern what's that acronym
11:52and if you can't speak up you can just
11:53put it in the chat let's see there's an
11:56acronym that has the word g in it
12:02I just gave you the answer GRC exactly
12:04exactly GRC so believe it or not
12:08previously n tsf did not have the G it
12:11didn't have govern in it now the reality
12:13is that it was kind of embedded in all
12:15the other areas but what they've done
12:17with cfsf 2.0 is they've actually
12:19brought it out and kind of called it out
12:21as its own function as opposed to being
12:24embedded in the other six the other five
12:26functions so now there are six functions
12:28we have govern identify protect detect
12:32respond and recover and we're going to
12:34talk about each one of those as we go
12:36through the training today
12:40okay and here is just a very high level
12:43view of again the five functions and the
12:45you can see on the screen we have the
12:48Govern function and then you have the
12:50category so remember the core function
12:52has the the function the category and
12:55the subcategories which we'll take a
12:57look at but this goes to some sumarize
13:00right what the functions are and the
13:01categories so let's go into each
13:04function so that we can get a better
13:05understanding of what it is and I'm
13:07going you guys are going to start
13:09understanding because now you'll see the
13:10relationship with some of the other
13:12things you've
13:13learned so the Govern function this is
13:16the first function again this impacts
13:18all other functions the Govern function
13:21is really around uh establishing
13:24policies procedures and processes and
13:26one of the things that you guys have
13:27learned from the it or the fundamental
13:29course is like the policies are very
13:31important the policies and procedures
13:33are important because they really detail
13:35the um the processes the detail the
13:37controls so a governance function really
13:40needs to have policies and process uh
13:42procedures in place because that's
13:44what's going to Define what the
13:46organization should be doing so when you
13:48review the Govern function for the Miss
13:50CSF 2.0 you need to understand that it's
13:52a it's about establishing policies
13:54procedures and processes that are
13:56managing the organizational um risk now
13:59the risks don't have to be just it right
14:02because other risks also affect cyber
14:05security so there could be regulatory
14:06risks right because they need to be
14:08compliant with things like maybe um
14:10socks ssa1 18 PCI ISO you have legal
14:14risk if there was a breach and they were
14:16sued what would happen right and if the
14:18breach was caused by it systems right
14:20the risk the environmental risk
14:22operational requirements there are so
14:24many areas that need to be considered
14:26for cyber security it's not always just
14:28it
14:29and the goal of the Govern function when
14:31you think about this from a compliance
14:33perspective is that it's ensuring that
14:35the cyber security strategy is aligned
14:37with the organization's goals let me
14:40come on camera and say this okay one of
14:42the things I've always told you is that
14:44audit and compliance don't exist just
14:47because right because when you really
14:49really think about it from a practical
14:51perspective audit and compliance are
14:53cost functions so when you think about
14:55when I say cost function I mean the a
14:57company is spending money money on them
14:59they're not necessarily making money on
15:01them so if you think about Amazon right
15:03their revenue function is when they sell
15:06when they make money by selling things
15:07on the website when it comes to audit
15:09and compliance they're actually that's
15:11an expense function so it's a cost for
15:14organizations and that's why some
15:16organizations don't give it enough
15:18funding until they have a problem right
15:21so that's why it's a cost function so
15:23they don't exist just because at the end
15:26of the day audit and compliance has to
15:28be linked back to the organizational
15:31strategies okay audit and compliance has
15:33to be linked back to the organizational
15:35strategy what are we trying to achieve
15:37as an organization what are the
15:39compliance obligations we have because
15:41we're in business as a business right do
15:43we what regulations do we need to comply
15:45with so the the Govern function then is
15:48concerned with making sure that the
15:50cyber security strategy whatever
15:51strategy they select is aligned with the
15:54goals objectives and obligations of the
15:57organization because can just say oh I
16:00want to be um compliant U from a cyber
16:02security perspective we're going to
16:04spend this high amount of money that the
16:06company can't even afford it has to
16:09understand what is reasonable based on
16:11the business we're in based on what the
16:13organizational goals are and based on
16:15what we need to comply with so that's
16:17the main thing about govern function and
16:20then so when you look
16:23here all right so with the Govern
16:26function right here are the categories
16:28and we'll take a look at sub categories
16:30at later on but if you look here I have
16:33on the screen it has the Govern category
16:35and it also has the the function and the
16:37category and so the first thing you see
16:39is govern the acronym that using or the
16:41abbreviation is GV and then you have six
16:45key areas here so the first category is
16:48that the organ the organizational
16:50context like I was saying earlier you
16:52first need to understand what's the
16:54mission of the company what are the um
16:57contractual or compliance requirements
16:59that we need to meet so you need to
17:01First understand what business are we in
17:04what are we trying to achieve here
17:06having that context is what's going to
17:08help the Govern function implement or at
17:11least design an appropriate level of
17:14strategy or the appropriate strategy for
17:16the organization okay then it ALS there
17:19has to be a risk management strategy
17:21again this is also part of the Govern
17:23function so with the risk management
17:25strategy the you have to think about
17:27what are their priorities regarding risk
17:30so if you guys remember from it
17:31fundamentals when we talk about risk
17:33management there are different ways
17:35right that a go a company can choose to
17:37address risk they can accept it they can
17:39reduce it they can avoid it right or
17:43they can transfer it so companies have
17:45to think about what are the appropriate
17:47strategies that we want again based on
17:49our mission based on what we're trying
17:51to achieve based on our outcomes so you
17:54need to understand from for for the
17:56Govern function they need to understand
17:58what that risk man management strategy
17:59is also we have roles responsibilities
18:02and authorities what does that mean so
18:04this category is concerned about who is
18:07responsible for what that's really it at
18:09the end of the day who's going to be
18:11responsible for each aspect of the cyber
18:13security strategy the risk management
18:15strategy right and also not just
18:18responsible who's going to be
18:19accountable because sometimes the people
18:21that are actually performing the work
18:22are not the people that are actually
18:24responsible or accountable to it from a
18:27management level and what are some of
18:29the improvements that will be
18:31established and communicated to the
18:33organization the other part um the
18:35fourth um category is policy right what
18:39is the cyber security policy we've
18:41talked about this when I talked about
18:42the definition policies procedures
18:45processes need to be well documented so
18:47one of the main categories for the
18:49Govern function is that you should have
18:51a cyber security policy in place it
18:53should be communicated it should be
18:55enforced enforced rather and also it
18:57should be updated
18:59as
19:00necessary then the fifth one is
19:02oversight this is and we'll again we'll
19:05take a look at the subcategories in a
19:07bit but oversight is how are we going to
19:10manage and have General oversight around
19:13our cyber security risk management
19:15program because you're not just just
19:17going to create a program and that's it
19:19you need to have activities risk
19:22management activities that are done
19:23periodically to make sure that somebody
19:25is monitoring and has overall oversight
19:28to ensure that whatever strategy is
19:31implemented and in place is continuously
19:34working and being improved as
19:36necessary okay and of course any cyber
19:40security supply risk management
19:41processes as well they need to be
19:43identified established monitored and
19:45improved so these are the six categories
19:48for govern one of the things we'll do at
19:50the end hopefully we'll have time is I'm
19:52actually going to pull up the CSF 2.0
19:55spreadsheet where you'll then see the
19:57subcategories and you'll start to see
19:59how this really links with a lot of what
20:02you've already learned in the it a
20:04program so again the first function here
20:06is govern and it's providing that
20:08overall strategy it's for the risk
20:10management function it's well not that's
20:13not the word it's providing the overall
20:15strategy for the cyber security risk
20:17management as well as the policies and
20:19procedures that need to be implemented
20:21okay so let's take a look at the second
20:24one the second component is identify so
20:28when you think about identify right so
20:30govern is setting up the strategy and
20:32then the second thing is well the
20:34strategy is in place we have everything
20:36working what's the next thing that we
20:38need to do identify is concerned about
20:42establishing right an understanding of
20:44what the risks are to the systems now
20:47you've gone you've gone from being very
20:49high level strategic to being more
20:52detailed let's talk about what these key
20:54risks actually are because we can have
20:57policies and processes in place if we
20:59don't do the work to actually identify
21:01those risks then we wouldn't know how to
21:03manage those risks and with this
21:05identify function there are three key
21:08categories you have Asset Management
21:10risk assessment and Improvement okay so
21:14the first one asset management what are
21:16the assets that you have like first of
21:18all what are all the systems that are in
21:19place servers computers the people
21:23people are part of assets right people
21:24are assets to the organization the
21:26buildings software companies use
21:28hundreds some well some large companies
21:30they may have hundreds of applications
21:32and software that they use in the
21:34organization so asset management and
21:36this could be a total role on its own
21:39asset management is really concerned
21:41about let's make sure we have a full
21:43documentation of all the Assets in the
21:46organization because before you can
21:49actually identify the risks associated
21:51with your organization you first have to
21:53know what those assets are so that then
21:56you can document what's the risk to the
21:58assets which is the second one so once
22:00you first of all identify all your
22:03assets the second one is risk assessment
22:06what are the risk to all the assets
22:08right you need to understand what are
22:10the risks to our Hardware what's the
22:12risk to our software what's the risk to
22:14our applications to our buildings right
22:16to our people to the services that we
22:18provide in the um Community what are
22:21those risks and that's part of that risk
22:23assessment process where companies have
22:25to then make sure they conduct a
22:27detailed risk assessment to understand
22:30their risk posture okay and then the
22:32third one with identification is
22:35ensuring that they are improvements
22:37right to the risk management processes
22:38and procedures so once they've
22:40identified the risk essentially you can
22:42think about this as the risk management
22:45process that says we know what our risks
22:47are how are we going to manage the risks
22:49and there are several steps there which
22:51we cover in our module on risk
22:53management so I'm not going to go back
22:54through all of that but this is
22:56identifying how do we manage and improve
23:00on our risk areas all right so the
23:02second function is identify and the um
23:06acronym for that is ID that's what
23:08you're using so when you see ID in CSF
23:112.0 is referring to the identify
23:15function so first we have strategy which
23:18is govern second identify you're
23:20identifying your risks by identifying
23:22your assets and risk assessment and then
23:25we are going to talk about the third one
23:27which is protect
23:29so if you guys recall do you guys let me
23:32make this interactive make sure you guys
23:34are still with me do you guys recall the
23:38first layer of Defense who wants to
23:40remind us what's the first layer of
23:42Defense from it fundamentals
23:47course operations the process owners the
23:50process owners okay I see in the chat
23:52process owners so when you think about
23:54protect and I'm trying to link this with
23:56the audit program because I I want you
23:58to understand why what you've learned is
24:01important here as well protect is really
24:03where you are implementing the
24:04safeguards what are the safeguards they
24:07are the controls right so you are
24:09implementing the critical safeguards to
24:11ensure the delivery of this is the
24:14definition from CSF the critical
24:16infrastructure services or the services
24:18that the organization is providing so
24:21one of the main things here is when you
24:23think about protect is who's actually
24:26implementing the guards and the controls
24:30all right so do you guys see now the
24:32next screen let's talk about the protect
24:35function and again the acronym um that
24:37they're using here is PR or the uh that
24:41prot PR for protect and then we have
24:44five categories here the first one is
24:46identity management authentication and
24:49access control now I want you you guys
24:52all have light bulbs going off here is
24:54that correct I hope you do let's see
24:57what is what do you think about when you
24:59think about this first
25:02one when we talk about our it
25:06gc's logical Access Control logical
25:09Access Control right so the again that's
25:13why I wanted to start off with letting
25:14you remember that the protect is this is
25:16where you're implementing the controls
25:18so the first category is around how do
25:21we how how do we manage identity right
25:24um authentication authorization and just
25:27all our logical IAL security and
25:29physical security um controls this has
25:32so this category is saying these are the
25:34things that you need to do to implement
25:36those controls and then the second one
25:38is also awareness and training so if you
25:40guys remember from the program we talk
25:42about policies but if you also remember
25:44we just don't talk about creating
25:46policies we also talk about making sure
25:48that employees are informed of the
25:51policies right that on a periodic basis
25:53employees get the policy to review and
25:56sign off so there has to be awareness
25:58and training you cannot have a GRC
26:01function let me uh come on camera for a
26:03bit here you cannot have a security
26:07function that's sitting up there in
26:08their office right and putting all this
26:10strategy together and all these controls
26:13and the actual people and employees in
26:15the organization don't know anything
26:16about it right if people are not trained
26:19if employees are not trained about
26:20fishing attacks and things like that
26:22that's when they'll get emails and
26:24they'll click on any link so when you're
26:26in a GRC function you you have to always
26:29remember that whatever strategy policies
26:31and procedures you're putting in place
26:32you also need to inform your employees
26:36on a periodic basis so that they are
26:38aware so just some basic security
26:40awareness training on you know first of
26:43all what their rights are as a user how
26:45they log into systems password
26:47management because believe it or not I
26:49think I've told you guys this story we
26:51have sometimes seen employees put their
26:53passwords in the drawer like right there
26:56so that's not very secure right so just
26:58some basic cyber security um tips and
27:01how to avoid
27:02malware well not knowingly usually it's
27:05an email they get that tells them to
27:07click a link right kind of giving them
27:10that awareness about this is what you
27:12should or shouldn't do whenever you get
27:14efficient email okay so that's the
27:16second U category and then the third one
27:19is data security this is also a little
27:22bit linked to logical security but it's
27:23not just about the systems it's about
27:25the data how is the data in the system
27:28protected so how is information in how
27:32how is the data in the organization
27:34protected so for anyone right that's
27:37going into the Privacy space this is a
27:38pretty big one because there are whole
27:40lots of privacy rules around data right
27:44but it's not just privacy so
27:46confidentiality which is linked to
27:47privacy integrity and Avail availability
27:50that's the CIA Triad right so how is
27:53data managed according to that and then
27:55there's platform security so you have
27:57the hardware right and the software and
27:59then this is where you also have to
28:01think about you know where it's are they
28:03using paths for example platform as a
28:04service and things like that how is the
28:06actual platform being protected so
28:09that's where you have for example the
28:10virtual platforms and then technology
28:12infrastructure resilience so this is
28:14about what's the risk strategy around
28:17ensuring that assets continue all the
28:20assets that we identified in the prior
28:22function how are those ass what is the
28:24strategy in place to make sure that
28:26those assets continue to maintain
28:28confidentiality in integrity and
28:30availability and organizational
28:32resilience when you think of the
28:34resiliences is essentially if there were
28:36an attack if something happened um how
28:38will we be able to come back as a
28:39business so think a little bit of that
28:41is the business impact analysis or
28:43Disaster Recovery might be a better
28:45example so how how resilient is our
28:48infrastructure against just any of the
28:50risks that we've identified so to
28:52summarize again when we talk about the
28:54protect function this is about the
28:57implementation of the actual controls
29:00right and the things that would actually
29:02help protect the it systems and the IT
29:06environment
29:10okay then the next one and I know you
29:12guys may have questions so what I'll do
29:14is we're about we'll wrap up this
29:16particular section on the core
29:18components or the core functions and
29:19then I'll allow some questions before we
29:21go into the next one because I can
29:22already feel maybe you're starting to
29:24get some questions so let's talk about
29:26detect so detect detect is when you
29:29think detect I know you're already
29:30thinking detective controls which is
29:32perfect right but detect is um the
29:36function that's essentially making sure
29:38that you have U activities and processes
29:41in place so that you can quickly um
29:44detect if something goes wrong the
29:47earlier you identify a secur security
29:49incident the better so if something
29:52let's say malare was downloaded on
29:54someone's computer today well you want
29:57to find out today you don't want to find
29:59out tomorrow or weeks down the line
30:00where it's already gotten a lot of data
30:03or or done wrecked a lot of Havoc really
30:05on the organizational systems so the the
30:07tect function is about making sure that
30:09there activities in place to identify
30:12the occurrence of a cyber security event
30:15and again I think I gave you guys the
30:17answer earlier this is where you make
30:18sure you have detective controls in
30:20place you don't just have preventive
30:22controls right preventive controls is
30:24more linked with protect but you and
30:27those are to ident to prevent things
30:29from going wrong right but the tech is
30:32we know things can go wrong what we want
30:34to make sure is that whenever something
30:36does go wrong we quickly identify that
30:40situation and we put in place a process
30:42to quickly address it so let's take a
30:45look here at the two categories for
30:49detect so for detect you have again you
30:53want to make sure that you find this
30:55cyber security potential incidents right
30:57and analyze them and there are two key
31:00categories you have continuous
31:01monitoring and adverse event analysis so
31:05continuous monitoring is essentially for
31:07those of you um that might have some
31:09cyber security background or we might
31:11have even talked about this in the it I
31:13think we've talked about in one of the
31:14it um classes but essentially making
31:17sure that there are continuous
31:18monitoring processes in place this is
31:20where you have security loging I think
31:22we mentioned this in logical security
31:24training right where you have security
31:26logging you have alert that are set up
31:29so that when certain thresholds are
31:31crossed or when someone that doesn't
31:33have appropriate access gets into a
31:34system all of those are being monitored
31:37and for those of you that may have some
31:39prior background in sock when I say sock
31:41I mean the cyber security sock those are
31:44the folks when there are incidents they
31:46get more alerts right they get emails
31:48things that going off in the Operation
31:50Center and they know that something's
31:52gone wrong a ticket gets opened so that
31:54that incident is monitored so I want to
31:57pause because I actually mentioned a few
31:59key different things there that I want
32:01you to think back to when you're
32:03reviewing your it audit program when I
32:06talked about continuous monitor we
32:07talked about security monitoring which
32:08is part of logical security and we also
32:10talked about alerts being set up that's
32:13also part of that security monitoring
32:14and logging but then we also talked
32:16about when the alerts go off and their
32:19incidents they are recorded and trapped
32:21to resolution right what part of our
32:23itgc is that let me see if you guys are
32:26following in management from computer
32:28operations computer operations so are
32:31you guys start you I hope I we're still
32:33going to talk about the implications
32:35later but hopefully as I'm talking
32:37you're already seeing the link with some
32:40of the things you've already learned so
32:42now you're just seeing it from this
32:44framework perspective right so that's
32:46continuous monitoring and then the
32:48second one is adverse event analysis so
32:50whenever it's just a fancy word for
32:53incident monitoring is what I'll say so
32:55it just means when something has gone
32:57wrong right right what do we do so
33:00usually when they are large potential
33:02not just large when they are just
33:04potential incidents uh companies usually
33:07have they might call it like a problem
33:08management or Incident Management but
33:11the goal here is saying that you analyze
33:13the event you just don't say oh that's
33:15okay there has to be a process that deta
33:19does a detailed analysis of that event
33:21to determine if it's a real problem or
33:24if it's um a false positive so
33:27continuous monitoring is you just making
33:29sure that you have those logs and alerts
33:32and security monitoring in place but
33:34then the actual analysis and this is
33:36also linked to that Incident Management
33:37that I talked about for computer
33:39operations this is where you are
33:41actually analyzing the event and trying
33:44to determine what to do and before
33:47closing out the event you have to make
33:48sure that you've done a full analysis
33:50and you've determined what approach to
33:52take and whether the issue is resolved
33:54or marked as a false positive the goal
33:56here is making sure that that analysis
33:58takes place in order to make the right
34:00decisions
34:02okay all right so that's the detect
34:05function so let's do a quick summary
34:07right we started with strategy let well
34:09let me see in the chat make sure you
34:10guys are still with me what was the
34:12first one you can put it in the chat
34:13what was the first
34:16function with the
34:19G govern so we had govern right so that
34:23um concerned with the strategy was the
34:25second
34:26one I don't you
34:28identify right you're identifying your
34:30assets risks okay what the third one
34:34protect protect this is where you
34:35actually implement the controls right
34:38and then the fourth one we just talked
34:39about is detect respond detect yeah
34:43detect yes so this is we have detect
34:46which you have your detective control
34:47you have your continuous monitoring and
34:49then making sure you're analyzing
34:50Adverse Events your Incident Management
34:53processes essentially okay good job guys
34:56you guys are here
34:59and then the next one is respond okay
35:02what is respond so respond is it's kind
35:06of you can start seeing where there's a
35:08thread right so at the end we talked
35:09about the impact or the adverse event
35:11analysis so respond is actually where
35:14you're taking action on those security
35:17detected cyber security incidents so I
35:19think I might have actually talked a
35:21little bit about this when I talked
35:22about detect because I so I might have
35:24bloodred the lines for you but with the
35:26framework right the separating the
35:28actual response right so what do you
35:30actually do what are the actions you
35:32take so this particular response
35:34function is supporting the ability to
35:37contain the impact so you guys when I
35:40say contain the impact what are you guys
35:42thinking now hopefully you're thinking
35:43about impact and likelihood right so
35:46that's our risk when you have a risk is
35:48impact times like likelihood right so
35:50when you have the respond function it's
35:53saying how do we analyze this incident
35:56and if it's a real incident right it's a
35:58real issue how do we reduce the impact
36:01right so instead of it affecting all the
36:045,000 computers in our organization
36:06let's say there was a virus that was
36:08mistakenly downloaded on one um user's
36:10computer how do we quickly contain it so
36:13that it doesn't spread to all the other
36:14computers in the network so that's just
36:16an example of what response you take
36:19right if there was a data breach how do
36:21we stop it so that the data doesn't
36:24continue to flow out to the adverse
36:27party right to the to the thread agent
36:29so let's make sure we have a response
36:33function in place all right so this
36:36itself is actually a function in
36:38organizations right because you have to
36:40plan for your response you have to
36:41communicate with the organization
36:44sometimes you know if you're unlucky and
36:45it's a data Bridge somebody has to
36:47communicate to the public right and then
36:50more importantly what are the mitigation
36:52strategies to make sure that the issue
36:55is contained all right so that's respon
36:57and I've probably talked a little bit
36:59about this so we have respond Incident
37:02Management so I I kind of went a little
37:05bit ahead when we're talking about the
37:07prior detect right but you can see how
37:09detecting flows into actually responding
37:13so with your respond function you have
37:15Incident Management incident analysis
37:17incident response reporting and
37:19communication and incident mitigation
37:22all right so with this again you're
37:23concerned with we've identified issues
37:26how do we respond and address them step
37:28so Incident Management so again this is
37:30the overall when you think about how you
37:32respond to all the incidents that and
37:34how you manage them but part of that is
37:36incident analysis right how do you
37:38conduct the analysis what do you need to
37:40review do you need to bring in forensics
37:42experts to see where it actually all
37:45started from right what do you need to
37:46do and then you actually have to report
37:49so this is what I've always told you so
37:50with audit and compliance you can't get
37:53away with um actually documenting so
37:55it's not just about having meetings and
37:56talking about these things you actually
37:58have to document and report on that
38:01incident response right and make sure
38:04you also communicate so you have to
38:07communicate and you can see here so with
38:09the reporting it's not just the
38:11documentation piece but you also have to
38:12make sure you document and communicate
38:15with agencies so if there's a data
38:17breach you're usually required by law to
38:20report that right so that's why
38:22sometimes you might get a letter in the
38:23mail that says oh your data was recently
38:26part of a data breach blah blah blah so
38:28that's part of making sure you're
38:29communicating the incident right so
38:32making sure that you coordinate all of
38:33that and then the mitigation this is the
38:36very important piece how do we stop the
38:38impact right how do we mitigate this
38:40issue and hopefully make sure that it
38:43doesn't continue in the future so the
38:45respond function has these four
38:48categories and then the last one is
38:51recover okay so recover
38:54means all right we had an incident
38:58we've mitigated we've addressed but
39:00things might have gone wrong right data
39:02is already out there some systems are
39:04already very much compromised so how to
39:07restore capabilities or another good
39:10example is maybe a data center went
39:12offline right how do we restore
39:15capabilities or services that were
39:17impaired one thing I do want you to
39:19realize is that this um detect respond
39:23recover this doesn't have to be
39:25something that necessarily takes weeks
39:27or days this might be something if it's
39:29critical enough that happens within
39:31hours so for example if um a data center
39:34goes down let's say one of the AWS
39:37Amazon um Cloud centers right the data
39:39centers let's say it goes down very
39:43quickly very quickly they probably have
39:46a a failover um process in place right
39:48where they quickly move over to another
39:51um site so their customers are not
39:53impacted or so this might be within
39:56minutes or hours right so it doesn't
39:59because they're separated into different
40:00functions does not mean right that this
40:03takes a length a long period of time
40:06depending on the impact right that's
40:09where so that's where making sure you
40:10identify and understand the risk comes
40:12in depending on the impact they would
40:14just quickly mobilize the whole team to
40:17make sure that services are restored
40:20quickly all right and this is all about
40:22just improving that organizational
40:24resilience again thinking about disaster
40:26recovery and making sure that companies
40:29can get back to servicing their
40:31customers in a timely manner so let's
40:34take a look at the categories
40:39here all right there two categories here
40:42incident recovery plan execution and
40:44incident recovery communication so this
40:47is more around the restoration piece
40:50right so when during the prior phase
40:53where they are responding and they're
40:55getting information together and they
40:57they already say okay this is what we're
40:58going to do so very quickly restoration
41:00activities need to take place to make
41:02sure services are brought back up and of
41:05course then communicated to all the
41:07affected parties so let's um think about
41:09this sometimes I think I can't remember
41:11when this happened but there was a time
41:13where on our course platform right you
41:15guys were like I can't watch the videos
41:16I can't watch the videos something is
41:18wrong so when I checked my email I saw
41:21that the company had sent me an email
41:23when the issue happened saying we notice
41:25that our systems have have gone down
41:28right and so we're trying to resolve
41:30this quickly but you may notice that
41:32you're not able to play videos that is
41:34all part of their incident recovery plan
41:36it's making sure they communicate well
41:38first of all they are communicating with
41:40the stakeholder because I'm a
41:41stakeholder as their customer they are
41:43letting me know there's an issue and
41:45then whenever the issue is fixed I
41:47usually get another email that says this
41:49issue has been resolved and all services
41:51are back up sometimes it takes minutes
41:53sometimes it takes hours and then I
41:55communicate that to you so that's just
41:57just another practical way of seeing
41:59this in in action okay so let's go back
42:02through this summary here I know we
42:05talked a lot there right but I want to
42:07go back through this summary for you to
42:09just um talk about what we talked about
42:10here so there are six main functions
42:12govern identify protect detect respond
42:16and recover so we govern again this has
42:19to do with our overall strategy we have
42:20those categories here identify you want
42:23to make sure you identify your assets
42:24identify the risks which your risk is
42:27assessment together protect is where
42:29you're actually implementing those
42:31controls and the safeguards right so you
42:33have your logical security awareness and
42:35training physical security data security
42:37overall platform security and the making
42:39sure you have resilience um controls in
42:41place to help with your technology um
42:44resilience then you have detect so
42:47detect has to do with making sure you
42:48continuously Monitor and that you are
42:50analyzing Adverse Events respond is how
42:55when something's been detected and done
42:57our analysis how do we actually respond
43:00so you see there's a a process in place
43:01for Incident Management how do you
43:03analyze the incident how do you report
43:05and which is document and communicate
43:07with your key stakeholders and how do
43:09you actually mitigate meaning how do you
43:11address the issue and prevent the issue
43:13from expanding and then the last one is
43:15recover how do you execute that recovery
43:17plan and once everything is back up and
43:19running how do you communicate to your
43:23stakeholders so this is the core guys
43:26this is the core core of CSF 2.0 and one
43:29of the things again I know at the end I
43:31said we'll talk about the implications
43:32for your career but as I was going
43:35through this you guys should already
43:37have been like okay now I see why all
43:40those controls and things that P talks
43:42about in the it audit program right I
43:44see where that's coming from because
43:47again audit is you're not auditing
43:49controls just for the sake of auditing
43:51you are auditing controls because they
43:53are related to the organizational
43:56strategy right the business needs what's
43:58the business trying to achieve what are
44:00the goals what are we trying to do here
44:02from an IT perspective so that's why you
44:05see that several of these functions that
44:06I have on the screen I link to a lot of
44:09the things that you already learned okay
44:11but I also want to mention one thing I
44:13also want to mention one thing CSF is
44:17CSF a prescription or does it prescribe
44:19exactly the way companies need to do
44:22things let me see if you guys were
44:24listening at the beginning is CSF
44:26prescriptive is it telling you this is
44:28exactly what you need to
44:30do no that's good there are guidelines
44:33they are guidelines and that's why you
44:36can see that when I was describing these
44:39functions hold on people are trying to
44:40join so when I'm when I was describing
44:43the functions you could see that I
44:45started blurring the line somewhere
44:47because companies don't need to separate
44:50all their functions into six okay
44:52companies can choose to group this and
44:54say you know what we're just going to
44:56have one one function is going to have
44:58detect respond and recover because you
45:00as we were walking through you you saw
45:02the thread right you saw how everything
45:04was related so what that means is but
45:08from a framework perspective it has to
45:10be very very detailed so that companies
45:13that are not that mature that may not
45:15have that maturity or that understanding
45:16of cyber security so that you're really
45:18just breaking it down into little little
45:22very explanatory pieces for them to say
45:24okay these are all the exact distinct
45:27pieces you must have but as
45:28organizations mature the lines may be
45:31blurred but the key might be even it's
45:33if it's blurred all the act the
45:36categories all the activities are still
45:38taking place because that's what's
45:39important right what's important is not
45:42saying show me how you have everything
45:43separated into six functions no it's
45:45about do you have those controls in
45:47place have you made sure your you're
45:49safeguarding your cyber security assets
45:51what do you have in place so I don't
45:53want you to go out there thinking about
45:55this from a very theoretical perspective
45:57or thinking about it from a textbook
45:59remember I always say I don't want to
46:00give you don't want to give textbook
46:02responses think about it from the
46:04practical application piece how is this
46:07practically implemented in organizations
46:09okay so that brings us to the end of the
46:11core function but before I go on to the
46:14second one which is the CSF
46:15organizational profile let me see if you
46:18guys have any
46:19questions
46:21okay all right so let's go on so the
46:24next one is CSF organizational profiles
46:26right right so this this is our second
46:28component I know we're a little bit over
46:30time well no I said 60 to 90 minutes so
46:32we're still good okay so this is the CSF
46:35organizational profile okay so what's
46:38the CSF organizational profile and this
46:40is just simply the description of the
46:43current and Target cyber security
46:45posture based on the core outcomes that
46:48a company wants so let's just break that
46:50down a little bit simpler there are two
46:52key profiles that a company can choose
46:54to have one is their current profile
46:56that essentially says this is currently
46:58where we are with our cyber security
47:00posture and then a Target profile that
47:03says this is what we want this is where
47:05we want to be this is our desired
47:07outcome for our risk management
47:09objective okay just a very quick note
47:12before we go deeper into this very quick
47:15note there's a concept called Community
47:17profiles and this is where companies
47:20have come together to develop a baseline
47:23profile based on the industry so maybe
47:25retailers might say we're all in the
47:27same retail industry we have similar
47:30risks right so we're going to come up
47:32with a profile that's generic for this
47:34industry and anybody in the retail
47:36industry can use that as a baseline if
47:38they want and I'll show you what an
47:40example of a profile looks like in a bit
47:42but just wanted to mention this here as
47:44well and like I said I'll share links
47:46and the files that related to this
47:48training now how do you create an
47:51organizational profile right because you
47:53can just say current profile or Target
47:55profile but how do you really create
47:56create that profile there are five steps
47:59one you Scope it right so for scoping
48:01you get gather information you create
48:04the profile you analyze any gaps and
48:07then you implement the action plan so
48:09let's take a look at those five
48:12steps so I know there are a lot of words
48:15on the slide but I didn't want to
48:17shorten it too much for you guys but the
48:20first um piece is determining the scope
48:22of the organizational profile but before
48:24we actually talk about that and
48:26organization can have multiple profiles
48:29right depending on the scope they might
48:32want to have a profile for their cyber
48:33security area they might want to have a
48:35profile for the supply chain risks they
48:38can choose to have different profiles
48:40that focus on a different aspect of risk
48:42or a different aspect of the business
48:44but at the end of the day before you
48:46create an organizational profile you
48:48have to understand what's the scope
48:50right what is the scope based on the
48:52assumptions I want to make so if this is
48:54just for one particular part of of the
48:57let's say Asset Management Area your
49:00profile that you build will be all based
49:02on Asset Management now that you've kind
49:04of put your scope together then you'll
49:07say okay what information do I need
49:09right to I have my scope so if you think
49:11about this in audit terms this is also
49:13talking about where you actually start
49:15gathering information What policies are
49:17in place right and you can get
49:19information from lots of places the the
49:22risk profile already created for
49:23Enterprises the requirements the
49:26standards that need need to be followed
49:27so maybe this is based on having to meet
49:29PCI requirements so you'll need all
49:31information required for PCI DSS for
49:34example but the second thing is making
49:36sure you gather the information that you
49:38need the third one is actually then
49:41based on understanding the scope of the
49:43profile you want and the um um the
49:46information you've gathered you actually
49:48document okay these are the outcomes
49:50that I want all right and again if you
49:52are in a particular industry that
49:54already has a community profile you can
49:56leverage that as a starting point
49:58instead of starting from a blank sheet
50:00and then the fourth part is okay so if
50:03there's a gap between my current and
50:05Target profile so I've already
50:06documented what I'm currently doing and
50:08I've documented where I want to be from
50:10a cyber security risk posture
50:11perspective what's that Gap right and
50:14how do I address them so this is where
50:16you start documenting okay these are all
50:18the risks we've identified these are the
50:20issues what's our plan of action how do
50:23we address this the plan of action and
50:26milestone it's called poam is very much
50:29in the federal space so you might not
50:31see that in regular organizations they
50:33might just call it a remediation plan
50:35right but in the NIT CSF 2.0 they are
50:37using poam because that's a federal term
50:40but you might just see this like a
50:41mitigation or remediation plan or
50:43something like that but essentially here
50:45you're analyzing the gaps and then
50:47creating an action plan to fix mitigate
50:51or address those
50:52gaps and then the last one is actually
50:56implementing the plan so now that you
50:58have a plan in place you actually follow
51:00the plan to actually Implement controls
51:03that will address the Gap right and then
51:06all that is um targeted at meeting that
51:08Target profile so again similar to
51:11remediation plans this may have an
51:13overall
51:15deadline so let's look at an example
51:18here and I rush through those
51:19definitions because I know sometimes
51:20they are theoretical I wanted to kind of
51:22get to the actual um def U example here
51:25so on the screen right so this is a
51:27simplified example of this is the
51:29outcome that's desired right they want a
51:33configuration management practices that
51:35are established and applied very
51:38specific so it's about our configur uh
51:40configuration management
51:42practices so what the current profile
51:45says what are they currently doing right
51:47so the configuration of management
51:49policy is there so this document I
51:51believe was created in 2024 by n right
51:55that's when they issued it but you can
51:56see here so it was last updated in 2022
51:59that's well over a year there are
52:01informal processes so you can already
52:04see that this is not very very mature
52:07and so the status here is saying
52:08configuration management is partially
52:10implemented within the organization some
52:13systems don't follow Baseline so they've
52:15done an internal rating saying this is
52:17three out of five again because this is
52:20an outcome that the company is saying
52:22that it's important to them they've
52:23rated it as a priority and then this is
52:25what they're saying their target profile
52:28is right they want configuration
52:30management to be very specific to
52:32actually be used and enforced in the
52:35organization and that any control that
52:38the policy requires change control
52:39processes to be followed so you guys
52:41already know that if any changes need to
52:43be made to the configuration of a um
52:45company they need to follow change
52:46management controls or the change
52:48management process right so maybe in the
52:51current profile they're not doing that
52:52right because it says change control
52:54processes are not consistently followed
52:56so the target is saying this is what we
52:58want and then the procedures which are
53:00more detailed are saying that okay so
53:03each division will have a CH
53:05configuration management plan it's going
53:07to be maintained implemented enforced
53:10the settings will also well and the
53:12settings well let me read that
53:14differently um as well as it maintains
53:16implements and enforces configuration
53:18baselines and settings so it's saying
53:20all the configuration baselines let's
53:22think passwords to make it easy right so
53:24all the password configurations and
53:25settings need to be properly implemented
53:28to be enforced to be documented right
53:31and if there are any changes it needs to
53:33follow our change management process so
53:36you can see that they are at a certain
53:38place and they have a Target so they
53:40need to identify the gap for example
53:42change control processes is not being
53:44followed and here change control
53:45processes are being followed so they
53:47need to identify those gaps and say what
53:49do we actually need to do and Implement
53:52as an organization to make that a
53:55reality so so even though I went through
53:57those five steps I think this might have
53:59even made it clearer I went through
54:01those five steps because that's what we
54:02have in this CSF 2.0 but this is what
54:05the Practical implication is right it's
54:07not about stating the five steps to risk
54:10profile it's about actually being able
54:12to identify where the current what the
54:14current profile is where we're trying to
54:16go with our Target what the Gap is and
54:19how to address them okay so this is an
54:22example and on the screen here so in
54:25order to get to that summary that I just
54:27showed you right CSF has put together
54:30this document so it's all accessible on
54:33this CSF 2.0 site I'll share links to
54:35that but uh and I just copied a
54:37screenshot of just a part of it because
54:38it's a pretty long document but you can
54:41see right included in profile means is
54:43it part of the scope of this particular
54:45profile remember you can have different
54:47profiles depending on scope so you get
54:49to answer all those questions was the
54:51priority was the status and the policies
54:54and the internal practices roles
54:56responsibilities evidence so essentially
54:59all this information that you gather
55:02remember that second step was making
55:03sure you gathered information right for
55:05your current and also for your Target
55:08that's what will help you after you get
55:10and document all this information that's
55:12what's going to help you actually put
55:15together this summary that tells you
55:17what you need to do okay all right so
55:20let me pause there that's it for the CSF
55:23the organizational profile so I shared
55:26it template and an example all right so
55:28let's go through the third section and
55:31then so we've done our Q&A let's go
55:33through the third section and then we'll
55:34wrap up so thank you all for hanging out
55:36with me here today so the third one is
55:39CSF tiar right now CSF tiar like I was
55:42saying earlier is the characterization
55:44of the rigor like let me use simple
55:46terms this is essentially saying how
55:49serious do we want to be about our risk
55:51management practices like do we want to
55:53be tier one tier two tier three or here
55:56for partial risk informed repeatable or
55:59adaptive like organizations do get to
56:02say what level of risk they want to be
56:04in because again when you think about
56:06risk when we talk about risk response
56:08right some companies you can avoid you
56:10can transfer you can accept right you uh
56:14mitigate so there are different ways
56:17companies all are in business for
56:19different things and depending on the
56:21different area right so for different
56:24areas for one area they might say oh
56:26this area is serious enough we want to
56:28make sure that we're are tier three
56:29right or this area is not that critical
56:32but so we just want to be tier two in
56:34this area so the CSF tiers are
56:36essentially just saying what is the
56:38rigor that we want to say we have for
56:41our risk governance and then based on
56:44the tier they've selected that's what
56:46they then use to inform their
56:47organizational profile right so based on
56:49whether they want to be tier one two
56:51three or four when they put their
56:53organizational profile together it'll be
56:55based on that maybe everybody doesn't
56:58want to be adaptive at that very high
57:01level for configuration management maybe
57:04they just want to be risk informed
57:06that's their decision to make of course
57:08that would be based on a risk analysis
57:10of them determining that if any risk in
57:13that area was actualized they'll be fine
57:15with it right so they've already done
57:16that risk analysis but companies do get
57:19to choose that and then again those tiar
57:21can be used to set the tone for
57:23organizational risk management across
57:25all the different areas so again
57:28different parts or different aspects of
57:29an organization they might select
57:31different tier if they want so for
57:33example just a quick explanation partial
57:36is when it's kind of ad hoc maybe they
57:38don't really have a lot of policies or
57:39it's not really followed up on it's we
57:41kind of do it when we need to right U
57:44risk informed there's awareness right so
57:47we know there are risks but we may not
57:50fully have organization wide um risk
57:53management process so maybe within this
57:55department we do something but it might
57:57be different in another department and
57:59we may not all see what each other is
58:02seeing but we all know what the risks
58:03are um repeatable this is where you have
58:06formal processes right so they approved
58:09they reviewed periodically it's
58:11essentially a pretty good process where
58:13it's consistent to a certain level and
58:15you can repeat it and then tier four is
58:18adaptive so this is formal organization
58:20wide approach let's say there's a change
58:22management process a policy that
58:24everybody knows about so we choose that
58:27we want to be adaptive in all areas or
58:29certain areas and that just means we are
58:32very very mature in that specific area
58:36Okay so that's really it for tiers so
58:38the tiers really are how is a tier
58:41selected for the different area and
58:43based on that tier selection the
58:45organizational profile is created which
58:47would be the current and the Target that
58:49would then need to be analyzed for a gap
58:52for The Gap
58:54analysis okay
58:57all right so we're about to wrap up guys
58:59thank you we might be a few minutes over
59:01so please bear with me so again here are
59:04the three components that we discussed
59:05and I mentioned this was the core part
59:07of the training right so you have the
59:08CSF core CSF organizational profiles and
59:11CSF tiers CSF core is the main piece
59:14right so that's where you have those six
59:16functions that we mentioned categories
59:18and subcategories that detail the
59:20outcomes right then you have the actual
59:22profiles that describe the current and
59:24Target postures and then you have the
59:26tears that just say you know what level
59:28how serious do we want to be with our
59:30cyber security risk governance what are
59:32we comfortable with in actuality all
59:34right so that's the summary there so
59:36let's talk about the last section here
59:38and I think this is where you guys would
59:40hopefully get some additional value so
59:43what does this all mean I'm sure if you
59:45guys were on LinkedIn the last few weeks
59:47raise your hands if you're like me
59:50everybody wants to talk about n CSF 2.0
59:52and everybody's running what is it how
59:53does it affect me is that you let me
59:55check the chat chat like what does it
59:57mean hold on let me see the chat K said
1:00:01yes okay honestly at the end of the day
1:00:05that's why when I started and I talked
1:00:06about the
1:00:07description or the definition it's a
1:00:11framework okay let me come on camera
1:00:13here a little
1:00:14bit it's really a framework that
1:00:17organizations are using or that
1:00:20organizations can use to develop their
1:00:23cyber security risk uh management
1:00:26strategy and their profile the framework
1:00:28is intended to help with the design of
1:00:29the environment so let's talk about how
1:00:32this might be the imple Implement
1:00:34implication sorry the implication for
1:00:37audit and compliance all right so let's
1:00:40I actually put both on the same slide I
1:00:42should have separated them but that's
1:00:44okay if you're in the audit space you
1:00:47might get to work with companies to
1:00:49perform a gap assessment between okay
1:00:51here's your current profile and here's
1:00:53your target profile I can't remember who
1:00:55has someone asked the question about
1:00:56what do I do if I want to develop a
1:00:58profile for a customer because you're an
1:01:00auditor right when you've gone through
1:01:02this you've gone through my it
1:01:04fundamentals class we've talked a lot
1:01:05about controls you learned a lot about
1:01:07controls you learned about the control
1:01:09considerations why they're implemented
1:01:10and how they implemented and what that
1:01:13should have done for you is not just
1:01:14tell you how to test controls it tells
1:01:16you the importance of controls and with
1:01:19reverse engineering it tells you how to
1:01:21implement controls so let me see in the
1:01:23chat right can you guys if someone comes
1:01:26to you and says we're having some issues
1:01:28around logical security we have
1:01:31processes that are not really mature or
1:01:34our access management process is not
1:01:36really mature what are some of the
1:01:38things that we can do based on trying to
1:01:40get to a more mature level do you feel
1:01:43like you will be able to tell them at
1:01:45least five to six more really but let's
1:01:48just go low five to six controls that
1:01:50they should Implement to help fix that
1:01:52Gap let me see you in the chat or you
1:01:55can speak up
1:01:57do you all get that
1:01:59question yes and I see a lot of yeses in
1:02:02the chat and that's exactly what the
1:02:04implication is because you now know more
1:02:07what about what CSF is as a the
1:02:09framework you understand the concept
1:02:12that the core functions are giving that
1:02:14ideal right of this is where things
1:02:17should be but most companies are not
1:02:19ideal they will have gaps so your
1:02:21knowledge of an auditor as because I'm
1:02:24auditing and this is what I'm looking
1:02:25for it gives you that unique vantage
1:02:28point on this is what you need to have
1:02:31to fix the Gap and there are so many
1:02:33rules that are really around that
1:02:35remediation management Gap assessment
1:02:37and your it audit knowledge makes you
1:02:39the perfect person to be able to say
1:02:42this is wrong this is how you fix it
1:02:44right so that's one implication so it
1:02:47doesn't change much from what you're
1:02:49actually doing it maybe just changes the
1:02:51way you talk about it right you're still
1:02:53performing that same function of
1:02:54understanding the if you're right I'm
1:02:56talking from a perspective where you're
1:02:58being hired as internal audit not
1:03:00external right so you're being hired as
1:03:02internal audit to come help them put
1:03:04things in place so that's what I'm
1:03:06talking about from that perspective so
1:03:07your audit knowledge gives you that
1:03:08Advantage so that's one and then this is
1:03:11also linked to the other one so the
1:03:13first one was really more about Gap
1:03:14assessment and I think I kind of made it
1:03:16to the same thing but the second one
1:03:18again you're using that your sub subject
1:03:20matter knowledge on it controls it
1:03:23environment you're using that knowledge
1:03:25to suggest controls that they need to
1:03:27implement so I think the question I
1:03:29asked kind of addressed both but again
1:03:32you're testing against standards but
1:03:34your knowledge of the framework and how
1:03:36companies are trying to implement it
1:03:38gives you that edge on how to help them
1:03:40so they might even call you and say you
1:03:42know what I don't even know how to put
1:03:43my profiles together come do a gap
1:03:45assessment so they may not call it an
1:03:48organizational profile because again
1:03:50it's a framework so an organization
1:03:52might literally hire Auditors to come do
1:03:55a gap
1:03:56assessment what's a gap assessment where
1:03:59are we and where do we need to be and
1:04:01then based on the results of that Gap
1:04:02assessment identify and suggest controls
1:04:05that need to be implemented to address
1:04:07those gaps are you guys
1:04:09following are you guys following do so
1:04:11do you guys see how what you your role
1:04:14as an auditor or what you know as an
1:04:15auditor helps you based on what
1:04:17companies might be doing and another
1:04:19thing you need to remember some of the
1:04:21words we use that are use in CSF may not
1:04:24be what organizations use so like I said
1:04:26they may not call it an organizational
1:04:27profile they might say we just want to
1:04:29know where we stand we want to do a gap
1:04:31assessment and I've actually done some I
1:04:33when I I used to work in Consulting we
1:04:35did Gap assessments for companies so
1:04:38think of it as a test so the Gap
1:04:40assessment is done as a fullblown we
1:04:42still do the complete audit like we're
1:04:44doing SSA 18 the difference is that it's
1:04:47not going to be given to customers it's
1:04:49a test so that they know where all their
1:04:51issues are they address those issues
1:04:54before we then do the full-blown real
1:04:57audit does do you guys see that example
1:04:59so that might be even socks socks like a
1:05:02gap assessment where are we and a lot of
1:05:05companies uh because socks is for public
1:05:07publicly traded companies right so if a
1:05:09company was private and then they're
1:05:11public they have a period of time before
1:05:14they need to be compliant with socks so
1:05:16during that time a lot of them do Gap
1:05:18assessments right to know okay are we
1:05:20where we're supposed to be okay if we're
1:05:22not how do we address it before our real
1:05:24assessment starts okay so that's just an
1:05:27example of that implication for audit
1:05:29for compliance roles think of the three
1:05:31lines of Defense the compliance function
1:05:34is essentially working hand inand right
1:05:36with your first line of defense making
1:05:38sure you're implementing all those right
1:05:39controls so here they might be helping
1:05:42organizations I think this goes to the
1:05:44question that was asked earlier to
1:05:45actually develop their organizational
1:05:47profile they might call it something
1:05:49else but they are really just trying to
1:05:51say this the same thing that we were
1:05:53just talking about Gap assessment but
1:05:54being done in internally from a
1:05:56compliance function so remember the
1:05:58compliance function can or is
1:06:00responsible for the internal compliance
1:06:02compliance with different regulations
1:06:04right and part of what compliance can do
1:06:07is say let's give an example so maybe
1:06:09it's a company that's not really mature
1:06:11and the compliance function is a new one
1:06:13that's being implemented one of the
1:06:15things they would then do is use a
1:06:17framework such as nist to guide how they
1:06:20structure their compliance activities
1:06:23let me pause there do you guys
1:06:25understand what I just said do you guys
1:06:27get what I just said about compliance
1:06:28and how you could use a framework so
1:06:30let's say a framework for maybe a new
1:06:33company that's not mature or maybe some
1:06:35a company that wants to just revamp his
1:06:37compliance function one thing they could
1:06:39do is say okay we're going to use this
1:06:42this framework it doesn't mean they're
1:06:43going to copy it but they're going to
1:06:45use that framework and consider it as a
1:06:47way to develop whatever they want to do
1:06:50for their company they may not use all
1:06:52the parts but they will just use it to
1:06:53inform the structure the governance
1:06:55structure that they put in place let me
1:06:57see if you guys are listening can you
1:06:59guys hear me am I still
1:07:02live loud and clear okay so you guys see
1:07:06how that imp the implication is right
1:07:08and then of course they need to work
1:07:09with stakeholders to implement the
1:07:11controls to meet the target profiles and
1:07:14desired outcomes so it's not just about
1:07:16saying I know what the Gap is or I know
1:07:18what to implement actually compliance
1:07:20would work to follow up make sure people
1:07:23are doing what they're actually supposed
1:07:24to do to really really move things
1:07:26across the Finish Line okay so let's
1:07:29summarize here and then we'll do a final
1:07:32Q&A before we wrap
1:07:34up so again as a reminder the CSF is
1:07:37intended to provide guidance on
1:07:39practices and standards it's not
1:07:41prescribing specific outcomes but those
1:07:43the guide but the fact that it's not
1:07:45prescribing outcomes I don't want you to
1:07:47think it makes it less important it's
1:07:49still important because those guidelines
1:07:51are important right those guidelines are
1:07:52key and they can make a difference
1:07:54between a company knowing what to do and
1:07:56what not to do because if a company
1:08:00actually follows a framework such as the
1:08:02CSF right it can help improve their um
1:08:05control environment because and with
1:08:07that improved control environment it
1:08:09gives them a better chance of meeting
1:08:12stand um their compliance requirements
1:08:14with standards do you guys get that so
1:08:16do you understand that so even though
1:08:17it's not prescribing outcomes it's
1:08:19giving proper well I shouldn't use the
1:08:21word proper it's giving guidance right
1:08:24on the it environment the controls and
1:08:26if a control environment is based on the
1:08:28CSF they've really done their job it can
1:08:31improve their security posture which
1:08:33ultimately helps them meet compliance
1:08:34need so if they've done all they're
1:08:36supposed to do when they need to perform
1:08:38an IT audit for whatever systems it
1:08:40should technically be good and be
1:08:43effective if they followed the the
1:08:46standard requirements U well I don't
1:08:48want to call them requirements the
1:08:50standard the guidance that was provided
1:08:52by CSF do you guys understand that
1:08:56because I want you to understand the
1:08:58link between CSF the importance and why
1:09:02companies usually talk about Frameworks
1:09:04is because it tells them well it doesn't
1:09:06tell them what to do it tells them what
1:09:07to consider for implementation that
1:09:09would overall then give them a better
1:09:11outcome with their compliance
1:09:14needs are you guys still there with
1:09:17me yes okay great so I think that really
1:09:21is all I had for you today so let's do a
1:09:24quick review and then we'll do a Q&A at
1:09:25the end review today you guys learn
1:09:28about this CSF 2.0 I gave you the
1:09:30definition um the explanation we went
1:09:32really detailed into the 2.0 components
1:09:35which what are the components guys let
1:09:37me see the
1:09:42chat what are the three components we
1:09:44talked
1:09:46about we just talked about three key
1:09:48components for this CSF
1:09:522.0 core organizational profile and The
1:09:55Tear all right okay and with core we
1:09:59have those six functions with profiles
1:10:01you have the current and Target and then
1:10:02we have those four tiers great and then
1:10:05we talked about implications for your it
1:10:06audit and compliance career you having
1:10:09this knowledge that I've shared with you
1:10:10today honestly it just lets you
1:10:12understand what it's about and then
1:10:15depending on whether you go into audit
1:10:16and compliance what you're how you're
1:10:18working in that organization might be
1:10:20different what you might be called upon
1:10:21to do might be different but that's
1:10:24really it and I think the the question
1:10:26we got earlier about a practical example
1:10:29on how you would um respond to a hack or
1:10:31something based on a framework or
1:10:33guidelines that kind of gives you that
1:10:35explanation as well so thank you all for
1:10:38joining me I did want to make sure I
1:10:39give you guys this bonus so that you
1:10:42guys understand how to review and
1:10:44potentially what's the word I'm looking
1:10:47for interpret that's the word to review
1:10:50and interpret the information in the
1:10:52framework and then also align it with
1:10:54what you've already learned in the
1:10:55course so thank you all I see you all in
1:10:57the chat you guys have a great rest of
1:10:58the day so thank you everybody for
1:11:00joining me for the session today if you
1:11:02have any questions please let me know
1:11:04thanks guys

About this transcript

This page contains the full transcript of NIST CSF 2.0 Framework Training - IT/Cybersecurity Audit and Compliance Training by Your IT Career with Dr. Peju, generated from the public captions YouTube serves with the video. The transcript has 12,900 words across 1,874 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.