How to Use the NIST Cyber Security Framework for Effective Incident Response

The NIST Cybersecurity Framework provides organisations with a structured way to understand, manage and reduce cyber security risk. Rather than prescribing specific technologies, it provides a common framework that organisations can adapt to their own environment, risk profile and business priorities.

Incident response is an important part of that framework. By considering how an organisation governs cyber risk, identifies assets and exposures, protects critical systems, detects suspicious activity, responds to incidents and recovers afterwards, NIST CSF can help organisations build a more resilient approach to cyber security.

The NIST Cybersecurity Framework (NIST CSF) was developed by the US National Institute of Standards and Technology to help organisations manage cyber security risk.

NIST released CSF 2.0 in February 2024, expanding the framework so that it can be applied by organisations of any size, sector or maturity.

At its core are six functions:

These functions are designed to work together rather than as individual stages in a linear process.

For incident response in particular, that matters. An organisation's ability to respond effectively to an attack depends heavily on the work completed before the incident occurs: understanding its environment, protecting critical assets, establishing responsibilities and having the ability to detect suspicious activity.

Incident response does not begin when an attacker is discovered.

The NIST CSF encourages organisations to think about cyber incidents as part of a wider risk-management process covering preparation, detection, response and recovery.

The Govern function provides the organisational foundation for effective incident response.

Before an attack happens, organisations should understand who is responsible for making decisions, how cyber risk is communicated, which third parties need to be involved and how security incidents will be escalated.

This is particularly important during a serious incident, when technical, operational, legal and communications decisions may all need to be made quickly.

An incident response plan can help establish those responsibilities in advance.

Aruga's Incident Response services help organisations prepare for cyber incidents and provide access to specialist expertise when an attack occurs.

Effective incident response depends on understanding the organisation's environment.

The Identify function includes understanding assets, systems, data, dependencies and cyber security risks.

It also means understanding where the organisation may be exposed.

Aruga's Threat Exposure Management service helps organisations identify, assess and prioritise security exposures so teams can focus attention on the weaknesses that present the greatest risk.

This can strengthen incident preparedness because security teams have a clearer understanding of critical assets and potential routes an attacker could exploit.

The Protect function focuses on safeguards designed to reduce cyber security risk.

These can include identity and access controls, security awareness, data protection, platform security and technology infrastructure resilience.

No collection of preventative controls can guarantee that an organisation will never experience a cyber incident. The objective is to make compromise more difficult and reduce the potential impact when something does go wrong.

This is why protection should operate alongside effective detection and incident response rather than being treated as a substitute for them.

The Detect function focuses on identifying and analysing potential cyber security attacks and compromises.

Speed matters.

The longer malicious activity remains undetected, the more opportunity an attacker may have to move through systems, compromise accounts, access sensitive information or disrupt operations.

Continuous monitoring can help organisations identify suspicious activity as it happens.

Aruga's Enterprise Managed SOC provides 24/7 monitoring, investigation and response, combining security technology and automation with experienced security analysts to identify genuine threats and take appropriate action.

The objective is not simply to generate alerts. It is to understand what those alerts mean and respond when malicious activity is identified.

Once an incident has been identified, the Respond function focuses on taking action.

That can include investigating what has happened, containing affected systems or accounts, coordinating internal and external stakeholders, preserving evidence and communicating appropriately.

This is where preparation becomes particularly important.

Trying to establish responsibilities, locate specialist support and make critical decisions for the first time during an active attack can waste valuable time.

Organisations should therefore establish their incident response arrangements before they need them.

Aruga provides different levels of incident response support. Incident Response Assurance gives organisations access to specialist guidance and response support, while the Incident Response Retainer provides a more tailored response capability for larger organisations and those operating internationally, in regulated sectors or critical infrastructure.

Containment is not the end of an incident.

The Recover function focuses on restoring affected systems and operations and communicating recovery activities appropriately.

Recovery should also consider what the organisation has learned.

How did the attacker gain access? Which controls worked? Which failed? Were there delays in detection or decision-making? What should change before another incident occurs?

A post-incident review can turn the experience into practical improvements to security controls, processes and future incident response planning.

The objective is not simply to return to the position the organisation was in before the attack, but to emerge better prepared for the next one.

NIST CSF provides a useful structure, but organisations still need to translate the framework into practical actions.

For incident response, that should include understanding:

These decisions are far easier to make before an attack than during one.

Incident response plans should also be tested rather than simply documented.

Exercises and simulations can reveal unclear responsibilities, missing information and assumptions that may not survive contact with a real incident.

Aruga's current cyber security services support different parts of an organisation's wider security capability.

Enterprise Managed SOC supports continuous monitoring, investigation and response, helping organisations identify and contain genuine threats.

Threat Exposure Management helps organisations understand where they are exposed and prioritise weaknesses according to risk.

Incident Response provides access to specialist expertise when an incident occurs, as well as helping organisations establish response arrangements before they need them.

And Cyber Security Consultancy can help organisations assess security challenges and develop practical improvements appropriate to their environment.

These services do not make an organisation “NIST compliant”. NIST CSF is a framework for managing cyber security risk rather than a certification that can simply be achieved by deploying particular security services.

Instead, the framework can help organisations understand the capabilities they need and where improvements should be prioritised.

The NIST Cybersecurity Framework provides a useful structure for thinking about incident response because it recognises that responding effectively to an attack depends on far more than what happens after an alert appears.

Organisations need appropriate governance, an understanding of their assets and exposures, preventative controls, effective detection, a clear response capability and a plan for recovery.

Those capabilities should reinforce one another.

The organisation that already knows what matters, where it is exposed, who is responsible and who to call when something goes wrong is in a far stronger position than one trying to answer those questions during an active cyber attack.

If you are reviewing your organisation's readiness, Aruga's Incident Response services provide a useful starting point for understanding how to prepare for and respond to a serious cyber incident.