NIST Cybersecurity Framework (CSF) 2.0 to SFIA v9 Skills Mapping

Information assurance INAS

Data management DATM

Information management IRMG

Policy for managing cyber security risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organisational mission

GV.PO-02

Ex1: Update policy based on periodic reviews of cyber security risk management results to ensure that policy and supporting processes and procedures adequately maintain risk at an acceptable level
Ex2: Provide a timeline for reviewing changes to the organisation's risk environment (e.g., changes in risk or in the organisation's mission objectives), and communicate recommended policy updates
Ex3: Update policy to reflect changes in legal and regulatory requirements
Ex4: Update policy to reflect changes in technology (e.g., adoption of artificial intelligence) and changes to the business (e.g., acquisition of a new business, new contract requirements)

Learning and development management ETMG

Information assurance INAS

Information management IRMG

NIST CSF Outcome: Results of organisation-wide cyber security risk management activities and performance are used to inform, improve, and adjust the risk management strategy

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 6-7

Who: Senior management reviews cybersecurity risk management performance and adjusts strategy

Why this level: Requires authority to evaluate organization-wide performance, make strategic adjustments, and hold functions accountable

Key activities:
- Reviewing cybersecurity risk management strategy outcomes (L6-7)
- Adjusting strategy to ensure coverage of requirements and risks (L6)
- Evaluating organizational cybersecurity performance (L6)

Levels 4-7

L6-7: Review and adjust strategy, evaluate organizational performance

L4-5: Provide performance data and analysis, support strategy reviews, recommend adjustments

Rationale: Strategic oversight and performance evaluation are senior management responsibilities requiring organizational authority and accountability.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Cyber security risk management strategy outcomes are reviewed to inform and adjust strategy and direction	GV.OV-01	Ex1: Measure how well the risk management strategy and risk results have helped leaders make decisions and achieve organisational objectives Ex2: Examine whether cyber security risk strategies that impede operations or innovation should be adjusted	Risk management BURM Information security SCTY Measurement MEAS Enterprise and business architecture STPL Innovation management INOV Business situation analysis BUSA
The cyber security risk management strategy is reviewed and adjusted to ensure coverage of organisational requirements and risks	GV.OV-02	Ex1: Review audit findings to confirm whether the existing cyber security strategy has ensured compliance with internal and external requirements Ex2: Review the performance oversight of those in cyber security-related roles to determine whether policy changes are necessary Ex3: Review strategy in light of cyber security incidents	Risk management BURM Organisational change enablement OCEN Information security SCTY Enterprise and business architecture STPL
Organisational cyber security risk management performance is evaluated and reviewed for adjustments needed	GV.OV-03	Ex1: Review key performance indicators (KPIs) to ensure that organisation-wide policies and procedures achieve objectives Ex2: Review key risk indicators (KRIs) to identify risks the organisation faces, including likelihood and potential impact Ex3: Collect and communicate metrics on cyber security risk management with senior leadership	Risk management BURM Performance management PEMT

NIST CSF Outcome: Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organisational stakeholders

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 5-6

Who: Senior management establishes programs and ensures supplier relationships are managed according to risk

Why this level: Requires organizational influence to coordinate across procurement, legal, and technology functions; significant accountability but typically delegated from executive level

Key activities:
- Establishing supply chain risk management program (L6)
- Integrating into enterprise risk management (L5-6)
- Ensuring supplier criticality assessment and monitoring (L5)

Levels 3-6

L6: Establish program, shape policies, ensure integration

L4-5: Manage supplier relationships, conduct due diligence, provide authoritative guidance on supplier risks

L3: Perform supplier assessments, document risks, support contract reviews

Rationale: Supply chain risk management is operationally complex and requires senior management oversight, but doesn't always require C-suite involvement unless strategic suppliers are involved.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
A cyber security supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organisational stakeholders	GV.SC-01	Ex1: Establish a strategy that expresses the objectives of the cyber security supply chain risk management program Ex2: Develop the cyber security supply chain risk management program, including a plan (with milestones), policies, and procedures that guide implementation and improvement of the program, and share the policies and procedures with the organisational stakeholders Ex3: Develop and implement program processes based on the strategy, objectives, policies, and procedures that are agreed upon and performed by the organisational stakeholders Ex4: Establish a cross-organisational mechanism that ensures alignment between functions that contribute to cyber security supply chain risk management, such as cyber security, IT, operations, legal, human resources, and engineering	Information security SCTY Risk management BURM Enterprise and business architecture STPL Governance GOVN Supplier management SUPP
Cyber security roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally	GV.SC-02	Ex1: Identify one or more specific roles or positions that will be responsible and accountable for planning, resourcing, and executing cyber security supply chain risk management activities Ex2: Document cyber security supply chain risk management roles and responsibilities in policy Ex3: Create responsibility matrixes to document who will be responsible and accountable for cyber security supply chain risk management activities and how those teams and individuals will be consulted and informed Ex4: Include cyber security supply chain risk management responsibilities and performance requirements in personnel descriptions to ensure clarity and improve accountability Ex5: Document performance goals for personnel with cyber security risk management-specific responsibilities, and periodically measure them to demonstrate and improve performance Ex6: Develop roles and responsibilities for suppliers, customers, and business partners to address shared responsibilities for applicable cyber security risks, and integrate them into organisational policies and applicable third-party agreements Ex7: Internally communicate cyber security supply chain risk management roles and responsibilities for third parties Ex8: Establish rules and protocols for information sharing and reporting processes between the organisation and its suppliers	Governance GOVN Risk management BURM Sourcing SORC Supplier management SUPP Stakeholder relationship management RLMT
Cyber security supply chain risk management is integrated into cyber security and enterprise risk management, risk assessment, and improvement processes	GV.SC-03	Ex1: Identify areas of alignment and overlap with cyber security and enterprise risk management Ex2: Establish integrated control sets for cyber security risk management and cyber security supply chain risk management Ex3: Integrate cyber security supply chain risk management into improvement processes Ex4: Escalate material cyber security risks in supply chains to senior management, and address them at the enterprise risk management level	Risk management BURM Information security SCTY Governance GOVN Supplier management SUPP Quality assurance QUAS Technology service management ITMG
Suppliers are known and prioritised by criticality	GV.SC-04	Ex1: Develop criteria for supplier criticality based on, for example, the sensitivity of data processed or possessed by suppliers, the degree of access to the organisation's systems, and the importance of the products or services to the organisation's mission Ex2: Keep a record of all suppliers, and prioritise suppliers based on the criticality criteria	Information security SCTY Risk management BURM Supplier management SUPP
Requirements to address cyber security risks in supply chains are established, prioritised, and integrated into contracts and other types of agreements with suppliers and other relevant third parties	GV.SC-05	Ex1: Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised Ex2: Include all cyber security and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language Ex3: Define the rules and protocols for information sharing between the organisation and its suppliers and sub-tier suppliers in agreements Ex4: Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised Ex5: Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle Ex6: Contractually require suppliers to disclose cyber security features, functions, and vulnerabilities of their products and services for the life of the product or the term of service Ex7: Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products Ex8: Contractually require suppliers to vet their employees and guard against insider threats Ex9: Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections Ex10: Specify in contracts and other agreements the rights and responsibilities of the organisation, its suppliers, and their supply chains, with respect to potential cyber security risks	Supplier management SUPP Information security SCTY Risk management BURM Governance GOVN Contract management ITCM Continuity management COPL
Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships	GV.SC-06	Ex1: Perform thorough due diligence on prospective suppliers that is consistent with procurement planning and commensurate with the level of risk, criticality, and complexity of each supplier relationship Ex2: Assess the suitability of the technology and cyber security capabilities and the risk management practices of prospective suppliers Ex3: Conduct supplier risk assessments against business and applicable cyber security requirements Ex4: Assess the authenticity, integrity, and security of critical products prior to acquisition and use	Sourcing SORC Risk management BURM Continuity management COPL Contract management ITCM
The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritised, assessed, responded to, and monitored over the course of the relationship	GV.SC-07	Ex1: Adjust assessment formats and frequencies based on the third party's reputation and the criticality of the products or services they provide Ex2: Evaluate third parties' evidence of compliance with contractual cyber security requirements, such as self-attestations, warranties, certifications, and other artifacts Ex3: Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation Ex4: Monitor critical suppliers, services, and products for changes to their risk profiles, and reevaluate supplier criticality and risk impact accordingly Ex5: Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity	Supplier management SUPP Risk management BURM Audit AUDT Service level management SLMO Contract management ITCM Quality assurance QUAS
Relevant suppliers and other third parties are included in incident planning, response, and recovery activities	GV.SC-08	Ex1: Define and use rules and protocols for reporting incident response and recovery activities and the status between the organisation and its suppliers Ex2: Identify and document the roles and responsibilities of the organisation and its suppliers for incident response Ex3: Include critical suppliers in incident response exercises and simulations Ex4: Define and coordinate crisis communication methods and protocols between the organisation and its critical suppliers Ex5: Conduct collaborative lessons learned sessions with critical suppliers	Supplier management SUPP Information security SCTY Information assurance INAS Continuity management COPL Governance GOVN Incident management USUP
Supply chain security practices are integrated into cyber security and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle	GV.SC-09	Ex1: Policies and procedures require provenance records for all acquired technology products and services Ex2: Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic Ex3: Communicate regularly among cyber security risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers Ex4: Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products Ex5: Policies and procedure require checking upgrades to critical hardware for unauthorised changes	Risk management BURM Supplier management SUPP Contract management ITCM Technology service management ITMG Audit AUDT Change control CHMG
Cyber security supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement	GV.SC-10	Ex1: Establish processes for terminating critical relationships under both normal and adverse circumstances Ex2: Define and implement plans for component end-of-life maintenance support and obsolescence Ex3: Verify that supplier access to organisation resources is deactivated promptly when it is no longer needed Ex4: Verify that assets containing the organisation's data are returned or properly disposed of in a timely, controlled, and safe manner Ex5: Develop and execute a plan for terminating or transitioning supplier relationships that takes supply chain security risk and resiliency into account Ex6: Mitigate risks to data and systems created by supplier termination Ex7: Manage data leakage risks associated with supplier termination	Supplier management SUPP Risk management BURM Information security SCTY Governance GOVN Contract management ITCM

Identify (ID): The organization's current cybersecurity risks are understood.

NIST CSF Outcome: Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organisation to achieve business purposes are identified and managed consistent with their relative importance to organisational objectives and the organisation's risk strategy

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Team leads and managers ensure asset inventories are maintained and assets are prioritized appropriately

Why this level: Operational management responsibility requiring technical expertise and coordination across teams, but typically not requiring executive-level decisions

Key activities:
- Ensuring completeness and accuracy of asset inventories (L5)
- Establishing asset classification and prioritization approaches (L5)
- Managing asset lifecycle processes (L4-5)

Levels 2-5

L4-5: Accountable for inventory completeness, classification schemes, lifecycle management

L3: Maintain asset inventories, document data flows, classify assets

L2: Assist with asset discovery, update inventory records

Rationale: Asset management is a technical/operational discipline requiring expert oversight but rarely requiring strategic executive involvement.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Inventories of hardware managed by the organisation are maintained	ID.AM-01	Ex1: Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices Ex2: Constantly monitor networks to detect new hardware and automatically update inventories	Technology service management ITMG Asset management ASMG Configuration management CFMG Network support NTAS
Inventories of software, services, and systems managed by the organisation are maintained	ID.AM-02	Ex1: Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services Ex2: Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes Ex3: Maintain an inventory of the organisation's systems	Asset management ASMG Configuration management CFMG Software design SWDN Software configuration PORT Technology service management ITMG
Representations of the organisation's authorised network communication ands internal and external network data flows are maintained	ID.AM-03	Ex1: Maintain baselines of communication and data flows within the organisation's wired and wireless networks Ex2: Maintain baselines of communication and data flows between the organisation and third parties Ex3: Maintain baselines of communication and data flows for the organisation's infrastructure-as-a-service (IaaS) usage Ex4: Maintain documentation of expected network ports, protocols, and services that are typically used among authorised systems	Network support NTAS Network design NTDS Configuration management CFMG Security operations SCAD Data management DATM Information assurance INAS
Inventories of services provided by suppliers are maintained	ID.AM-04	Ex1: Inventory all external services used by the organisation, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services Ex2: Update the inventory when a new external service is going to be utilised to ensure adequate cyber security risk management monitoring of the organisation's use of that service	Supplier management SUPP Asset management ASMG Configuration management CFMG Information assurance INAS Information management IRMG
Assets are prioritised based on classification, criticality, resources, and impact on the mission	ID.AM-05	Ex1: Define criteria for prioritising each class of assets Ex2: Apply the prioritisation criteria to assets Ex3: Track the asset priorities and update them periodically or when significant changes to the organisation occur	Asset management ASMG Risk management BURM Configuration management CFMG Availability management AVMT Service level management SLMO
Inventories of data and corresponding metadata for designated data types are maintained	ID.AM-07	Ex1: Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organisation intellectual property, operational technology data) Ex2: Continuously discover and analyse ad hoc data to identify new instances of designated data types Ex3: Assign data classifications to designated data types through tags or labels Ex4: Track the provenance, data owner, and geolocation of each instance of designated data types	Data management DATM Records management RMGT Information security SCTY Information and data compliance PEDP
Systems, hardware, software, services, and data are managed throughout their life cycles	ID.AM-08	Ex1: Integrate cyber security considerations throughout the life cycles of systems, hardware, software, and services Ex2: Integrate cyber security considerations into product life cycles Ex3: Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT) Ex4: Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organisation's attack surface Ex5: Properly configure and secure systems, hardware, software, and services prior to their deployment in production Ex6: Update inventories when systems, hardware, software, and services are moved or transferred within the organisation Ex7: Securely destroy stored data based on the organisation's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions Ex8: Securely sanitise data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement Ex9: Offer methods for destroying paper, storage media, and other physical forms of data storage	Asset management ASMG Systems installation and removal HSIN Infrastructure operations ITOP Systems development management DLMG Systems and software lifecycle engineering SLEN Data management DATM

NIST CSF Outcome: The cyber security risk to the organisation, assets, and individuals is understood by the organisation

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Security professionals and risk managers conduct assessments, prioritize responses, and provide authoritative guidance

Why this level: Requires deep technical expertise and judgment to assess threats/vulnerabilities, accountable for risk analysis quality

Key activities:
- Ensuring vulnerability assessments are performed effectively (L5)
- Providing authoritative guidance on threat intelligence and risk prioritization (L5)
- Managing vulnerability disclosure processes (L4-5)

Levels 2-6

L6: Reviews risk assessment outcomes, makes decisions on significant risks

L4-5: Lead risk assessments, interpret threat intelligence, determine risk priorities, advise on responses

L2-3: Conduct vulnerability scans, document findings, support threat analysis

Rationale: Risk assessment is a technical discipline requiring L4-5 expertise, with L6 involvement for strategic risk decisions.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Vulnerabilities in assets are identified, validated, and recorded	ID.RA-01	Ex1: Use vulnerability management technologies to identify unpatched and misconfigured software Ex2: Assess network and system architectures for design and implementation weaknesses that affect cyber security Ex3: Review, analyse, or test organisation-developed software to identify design, coding, and default configuration vulnerabilities Ex4: Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues Ex5: Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services Ex6: Review processes and procedures for weaknesses that could be exploited to affect cyber security	Vulnerability assessment VUAS Penetration testing PENT Information security SCTY Asset management ASMG Security operations SCAD Risk management BURM
Cyber threat intelligence is received from information sharing forums and sources	ID.RA-02	Ex1: Configure cyber security tools and technologies with detection or response capabilities to securely ingest cyber threat intelligence feeds Ex2: Receive and review advisories from reputable third parties on current threat actors and their tactics, techniques, and procedures (TTPs) Ex3: Monitor sources of cyber threat intelligence for information on the types of vulnerabilities that emerging technologies may have	Threat intelligence THIN Information security SCTY Information assurance INAS Formal research RSCH Programming/software development PROG Knowledge management KNOW
Internal and external threats to the organisation are identified and recorded	ID.RA-03	Ex1: Use cyber threat intelligence to maintain awareness of the types of threat actors likely to target the organisation and the TTPs they are likely to use Ex2: Perform threat hunting to look for signs of threat actors within the environment Ex3: Implement processes for identifying internal threat actors	Security operations SCAD Vulnerability assessment VUAS Information assurance INAS Information security SCTY Penetration testing PENT Threat intelligence THIN
Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded	ID.RA-04	Ex1: Business leaders and cyber security risk management practitioners work together to estimate the likelihood and impact of risk scenarios and record them in risk registers Ex2: Enumerate the potential business impacts of unauthorised access to the organisation's communications, systems, and data processed in or by those systems Ex3: Account for the potential impacts of cascading failures for systems of systems	Risk management BURM Information assurance INAS Continuity management COPL Enterprise and business architecture STPL Vulnerability assessment VUAS
Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritisation	ID.RA-05	Ex1: Develop threat models to better understand risks to the data and identify appropriate risk responses Ex2: prioritise cyber security resource allocations and investments based on estimated likelihoods and impacts	Risk management BURM Threat intelligence THIN Information security SCTY Vulnerability assessment VUAS
Risk responses are chosen, prioritised, planned, tracked, and communicated	ID.RA-06	Ex1: Apply the vulnerability management plan's criteria for deciding whether to accept, transfer, mitigate, or avoid risk Ex2: Apply the vulnerability management plan's criteria for selecting compensating controls to mitigate risk Ex3: Track the progress of risk response implementation (e.g., plan of action and milestones [POA&M], risk register, risk detail report) Ex4: Use risk assessment findings to inform risk response decisions and actions Ex5: Communicate planned risk responses to affected stakeholders in priority order	Risk management BURM Information assurance INAS Change control CHMG Vulnerability assessment VUAS Information security SCTY
Changes and exceptions are managed, assessed for risk impact, recorded, and tracked	ID.RA-07	Ex1: Implement and follow procedures for the formal documentation, review, testing, and approval of proposed changes and requested exceptions Ex2: Document the possible risks of making or not making each proposed change, and provide guidance on rolling back changes Ex3: Document the risks related to each requested exception and the plan for responding to those risks Ex4: Periodically review risks that were accepted based upon planned future actions or milestones	Change control CHMG Configuration management CFMG Risk management BURM Information security SCTY
Processes for receiving, analysing, and responding to vulnerability disclosures are established	ID.RA-08	Ex1: Conduct vulnerability information sharing between the organisation and its suppliers following the rules and protocols defined in contracts Ex2: Assign responsibilities and verify the execution of procedures for processing, analysing the impact of, and responding to cyber security threat, vulnerability, or incident disclosures by suppliers, customers, partners, and government cyber security organisations	Threat intelligence THIN Incident management USUP Information assurance INAS Vulnerability assessment VUAS Vulnerability research VURE Penetration testing PENT
The authenticity and integrity of hardware and software are assessed prior to acquisition and use	ID.RA-09	Ex1: Assess the authenticity and cyber security of critical technology products and services prior to acquisition and use	Sourcing SORC Information assurance INAS Enterprise and business architecture STPL Configuration management CFMG Systems design DESN Hardware design HWDE
Critical suppliers are assessed prior to acquisition	ID.RA-10	Ex1: Conduct supplier risk assessments against business and applicable cyber security requirements, including the supply chain	Risk management BURM Sourcing SORC Data analytics DAAN Quality assurance QUAS Information assurance INAS Continuity management COPL

NIST CSF Outcome: Improvements to organisational cyber security risk management processes, procedures and activities are identified across all CSF Functions

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Security managers and senior practitioners identify and implement improvements across cybersecurity processes

Why this level: Requires expertise to evaluate effectiveness, identify improvement opportunities, and ensure implementation across the organization

Key activities:
- Identifying improvements from evaluations and security tests (L4-5)
- Ensuring improvements are implemented across processes (L5)
- Coordinating improvements with suppliers and third parties (L4-5)

Levels 2-6

L6: Approves significant improvement initiatives, allocates resources

L4-5: Lead improvement identification, coordinate implementation, measure effectiveness

L2-3: Execute improvements, document outcomes, support testing and evaluation

Rationale: Continuous improvement requires operational management capability to identify, coordinate, and implement changes effectively.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Improvements are identified from evaluations	ID.IM-01	Ex1: Perform self-assessments of critical services that take current threats and TTPs into consideration Ex2: Invest in third-party assessments or independent audits of the effectiveness of the organisation's cyber security program to identify areas that need improvement Ex3: Constantly evaluate compliance with selected cyber security requirements through automated means	Threat intelligence THIN Audit AUDT Penetration testing PENT Process testing PRTS Business situation analysis BUSA Emerging technology monitoring EMRG
Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties	ID.IM-02	Ex1: Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits) Ex2: Identify improvements for future business continuity, disaster recovery, and incident response activities based on exercises performed in coordination with critical service providers and product suppliers Ex3: Involve internal stakeholders (e.g., senior executives, legal department, HR) in security tests and exercises as appropriate Ex4: Perform penetration testing to identify opportunities to improve the security posture of selected high-risk systems as approved by leadership Ex5: Exercise contingency plans for responding to and recovering from the discovery that products or services did not originate with the contracted supplier or partner or were altered before receipt Ex6: Collect and analyse performance metrics using security tools and services to inform improvements to the cyber security program	Process testing PRTS Continuity management COPL Incident management USUP Business process improvement BPRE Stakeholder relationship management RLMT Audit AUDT
Improvements are identified from execution of operational processes, procedures, and activities	ID.IM-03	Ex1: Conduct collaborative lessons learned sessions with suppliers Ex2: Annually review cyber security policies, processes, and procedures to take lessons learned into account Ex3: Use metrics to assess operational cyber security performance over time	Business situation analysis BUSA Stakeholder relationship management RLMT Business process improvement BPRE Knowledge management KNOW Measurement MEAS Methods and tools METL
Incident response plans and other cyber security plans that affect operations are established, communicated, maintained, and improved	ID.IM-04	Ex1: Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organisation's mission and viability Ex2: Include contact and communication information, processes for handling common scenarios, and criteria for prioritisation, escalation, and elevation in all contingency plans Ex3: Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritise, test, and implement risk responses Ex4: Communicate cyber security plans (including updates) to those responsible for carrying them out and to affected parties Ex5: Review and update all cyber security plans annually or when a need for significant improvements is identified	Incident management USUP Stakeholder relationship management RLMT Information security SCTY Continuity management COPL Organisational capability development OCDV Business process improvement BPRE

Protect (PR): Safeguards to manage the organization's cybersecurity risks are used.

NIST CSF Outcome: Access to physical and logical assets is limited to authorised users, services, and hardware and managed commensurate with the assessed risk of unauthorised access

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Identity and access management specialists and security architects ensure appropriate controls are implemented

Why this level: Requires technical expertise in identity systems and access controls, accountable for control effectiveness and security

Key activities:
- Ensuring identity and credential management systems are effective (L5)
- Establishing authentication and authorization policies (L4-5)
- Managing access control implementation and reviews (L4-5)

Levels 2-6

L6: Approves access control policies and standards

L4-5: Design and ensure implementation of identity/access controls, provide technical leadership

L2-3: Implement controls, manage user accounts, review access permissions

Rationale: Identity and access management requires strong technical capability at L4-5, with L6 accountability for policy and risk acceptance decisions.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Identities and credentials for authorised users, services, and hardware are managed by the organisation	PR.AA-01	Ex1: Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed Ex2: Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials Ex3: Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device Ex4: Physically label authorised hardware with an identifier for inventory and servicing purposes	Identity and access management IAMT Stakeholder relationship management RLMT Information assurance INAS Asset management ASMG Information and data compliance PEDP Audit AUDT
Identities are proofed and bound to credentials based on the context of interactions	PR.AA-02	Ex1: Verify a person's claimed identity at enrolment time using government-issued identity credentials (e.g., passport, visa, driver's license) Ex2: Issue a different credential for each person (i.e., no credential sharing)	Identity and access management IAMT Information assurance INAS Information security SCTY
Users, services, and hardware are authenticated	PR.AA-03	Ex1: Require multifactor authentication Ex2: Enforce policies for the minimum strength of passwords, PINs, and similar authenticators Ex3: Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures) Ex4: Ensure that authorised personnel can access accounts essential for protecting safety under emergency conditions	Identity and access management IAMT Stakeholder relationship management RLMT Information security SCTY Incident management USUP Security operations SCAD Information assurance INAS
Identity assertions are protected, conveyed, and verified	PR.AA-04	Ex1: Protect identity assertions that are used to convey authentication and user information through single sign-on systems Ex2: Protect identity assertions that are used to convey authentication and user information between federated systems Ex3: Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions	Identity and access management IAMT Information security SCTY Solution architecture ARCH Information assurance INAS
Access permissions, entitlements, and authorisations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	PR.AA-05	Ex1: Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organisation, and promptly rescind privileges that are no longer needed Ex2: Take attributes of the requester and the requested resource into account for authorisation decisions (e.g., geolocation, day/time, requester endpoint's cyber health) Ex3: Restrict access and privileges to the minimum necessary (e.g., zero trust architecture) Ex4: Periodically review the privileges associated with critical business functions to confirm proper separation of duties	Identity and access management IAMT Information assurance INAS Security operations SCAD Asset management ASMG Stakeholder relationship management RLMT Audit AUDT
Physical access to assets is managed, monitored, and enforced commensurate with risk	PR.AA-06	Ex1: Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access Ex2: Employ additional physical security controls for areas that contain high-risk assets Ex3: Escort guests, vendors, and other third parties within areas that contain business-critical assets	Facilities management DCMA Measurement MEAS Asset management ASMG

NIST CSF Outcome: The organisation's personnel are provided with cyber security awareness and training so that they can perform their cyber security-related tasks

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Learning and development managers and senior security practitioners design and ensure delivery of training programs

Why this level: Requires expertise in both cybersecurity and learning design, accountable for program effectiveness

Key activities:
- Designing awareness and training programs (L4-5)
- Ensuring training meets cybersecurity needs (L5)
- Evaluating training effectiveness (L4-5)

Levels 2-6

L6: Approves training strategy, allocates budget

L4-5: Design curricula, ensure delivery quality, measure effectiveness

L3: Deliver training, develop content

L2: Assist with training logistics, support content development

Rationale: Training program management is an L4-5 accountability, though executive sponsorship (L6) is important for establishing a security-aware culture.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory

NIST CSF Implementation examples

SFIA skills

Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cyber security risks in mind

PR.AT-01

Ex1: Provide basic cyber security awareness and training to employees, contractors, partners, suppliers, and all other users of the organisation's non-public resources
Ex2: Train personnel to recognise social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)
Ex3: Explain the consequences of cyber security policy violations, both to individual users and the organisation as a whole
Ex4: Periodically assess or test users on their understanding of basic cyber security practices
Ex5: Require annual refreshers to reinforce existing practices and introduce new practices

Learning and development management ETMG

Learning design and development TMCR

Learning delivery ETDL

Competency assessment LEDA

Contract management ITCM

Learning and development management ETMG

Individuals in specialised roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cyber security risks in mind

PR.AT-02

Ex1: Identify the specialised roles within the organisation that require additional cyber security training, such as physical and cyber security personnel, finance personnel, senior leadership, and anyone with access to business-critical data
Ex2: Provide role-based cyber security awareness and training to all those in specialised roles, including contractors, partners, suppliers, and other third parties
Ex3: Periodically assess or test users on their understanding of cyber security practices for their specialised roles
Ex4: Require annual refreshers to reinforce existing practices and introduce new practices

Job analysis and design JADN

Learning design and development TMCR

Learning delivery ETDL

Competency assessment LEDA

NIST CSF Outcome: Data are managed consistent with the organisation's risk strategy to protect the confidentiality, integrity, and availability of information

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Data protection specialists and security architects ensure appropriate controls are implemented

Why this level: Requires technical expertise in encryption, access controls, and data protection; accountable for control effectiveness

Key activities:
- Ensuring data protection controls are appropriately designed and implemented (L5)
- Providing authoritative guidance on data security requirements (L5)
- Verifying backup and recovery capabilities (L4-5)

Levels 2-6

L6: Approves data security policies, accountable for data protection strategy

L4-5: Design and ensure implementation of controls, provide technical leadership

L2-3: Implement controls, monitor data protection, perform backups

Rationale: Data security requires strong technical capability at L4-5, with L6 accountability for policy and strategy.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
The confidentiality, integrity, and availability of data-at-rest are protected	PR.DS-01	Ex1: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources Ex2: Use full disk encryption to protect data stored on user endpoints Ex3: Confirm the integrity of software by validating signatures Ex4: Restrict the use of removable media to prevent data exfiltration Ex5: Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets	Information security SCTY Information and data compliance PEDP System software administration SYSP Information assurance INAS Storage management STMG Facilities management DCMA
The confidentiality, integrity, and availability of data-in-transit are protected	PR.DS-02	Ex1: Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications Ex2: Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification Ex3: Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organisational systems and networks Ex4: Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments	Information security SCTY Data management DATM Network design NTDS Security operations SCAD Information assurance INAS Information management IRMG
The confidentiality, integrity, and availability of data-in-use are protected	PR.DS-10	Ex1: Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed Ex2: Protect data in use from access by other users and processes of the same platform	Information security SCTY Information assurance INAS Data management DATM Information management IRMG
Backups of data are created, protected, maintained, and tested	PR.DS-11	Ex1: Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules Ex2: Test backups and restores for all types of data sources at least annually Ex3: Securely store some backups offline and offsite so that an incident or disaster will not damage them Ex4: Enforce geographic separation and geolocation restrictions for data backup storage	Database administration DBAD Storage management STMG Infrastructure operations ITOP Continuity management COPL Application support ASUP Non-functional testing NFTS

NIST CSF Outcome: The hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organisation's risk strategy to protect their confidentiality, integrity, and availability

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: System administrators and security engineers ensure platforms are securely configured and maintained

Why this level: Requires technical expertise in platform hardening and configuration management, accountable for platform security posture

Key activities:
- Establishing and applying configuration management practices (L4-5)
- Ensuring software and hardware are maintained commensurate with risk (L5)
- Managing secure software development practices (L5)

Levels 2-5

L4-5: Establish configuration standards, ensure compliance, manage platform security

L2-3: Apply configurations, maintain systems, monitor platform security

Rationale: Platform security is a technical discipline requiring L4-5 management to establish standards and ensure consistent application.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Configuration management practices are established and applied	PR.PS-01	Ex1: Establish, test, deploy, and maintain hardened baselines that enforce the organisation's cyber security policies and provide only essential capabilities (i.e., principle of least functionality) Ex2: Review all default configuration settings that may potentially impact cyber security when installing or upgrading software Ex3: Monitor implemented software for deviations from approved baselines	Configuration management CFMG Information security SCTY Systems integration and build SINT Security operations SCAD Software configuration PORT Change control CHMG
Software is maintained, replaced, and removed commensurate with risk	PR.PS-02	Ex1: Perform routine and emergency patching within the timeframes specified in the vulnerability management plan Ex2: Update container images, and deploy new container instances to replace rather than update existing instances Ex3: Replace end-of-life software and service versions with supported, maintained versions Ex4: Uninstall and remove unauthorised software and services that pose undue risks Ex5: Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse Ex6: Define and implement plans for software and service end-of-life maintenance support and obsolescence	Vulnerability assessment VUAS Configuration management CFMG Change control CHMG Release management RELM Systems installation and removal HSIN Systems integration and build SINT
Hardware is maintained, replaced, and removed commensurate with risk	PR.PS-03	Ex1: Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities Ex2: Define and implement plans for hardware end-of-life maintenance support and obsolescence Ex3: Perform hardware disposal in a secure, responsible, and auditable manner	Hardware design HWDE Configuration management CFMG Change control CHMG Information assurance INAS Asset management ASMG Systems installation and removal HSIN
Log records are generated and made available for continuous monitoring	PR.PS-04	Ex1: Configure all operating systems, applications, and services (including cloud-based services) to generate log records Ex2: Configure log generators to securely share their logs with the organisation's logging infrastructure systems and services Ex3: Configure log generators to record the data needed by zero-trust architectures	Security operations SCAD Information security SCTY Systems integration and build SINT Infrastructure operations ITOP
Installation and execution of unauthorised software are prevented	PR.PS-05	Ex1: When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorised software Ex2: Verify the source of new software and the software's integrity before installing it Ex3: Configure platforms to use only approved DNS services that block access to known malicious domains Ex4: Configure platforms to allow the installation of organisation-approved software only	Configuration management CFMG System software administration SYSP Change control CHMG Security operations SCAD
Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	PR.PS-06	Ex1: Protect all components of organisation-developed software from tampering and unauthorised access Ex2: Secure all software produced by the organisation, with minimal vulnerabilities in their releases Ex3: Maintain the software used in production environments, and securely dispose of software once it is no longer needed	Programming/software development PROG Systems integration and build SINT Systems and software lifecycle engineering SLEN Quality assurance QUAS Configuration management CFMG Systems development management DLMG

NIST CSF Outcome: Security architectures are managed with the organisation's risk strategy to protect asset confidentiality, integrity, and availability, and organisational resilience

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-6

Who: Infrastructure architects and managers (L4-5) ensure resilience; senior management (L6) for strategic resilience decisions

Why this level: Technical resilience requires architectural expertise (L4-5); strategic resilience investments require senior management authority (L6)

Key activities:
- Designing and implementing resilience mechanisms (L4-5)
- Ensuring adequate resource capacity (L5)
- Protecting infrastructure from environmental threats (L4-5)
- Making strategic resilience investment decisions (L6)

Levels 2-6

L6: Approves resilience strategy and investments

L4-5: Design resilience architectures, ensure implementation, manage capacity

L2-3: Implement resilience controls, monitor infrastructure, respond to threats

Rationale: Infrastructure resilience requires technical leadership at L4-5, with L6 involvement for significant investment decisions and strategic resilience planning.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Networks and environments are protected from unauthorised logical access and usage	PR.IR-01	Ex1: Logically segment organisation networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments Ex2: Logically segment organisation networks from external networks, and permit only necessary communications to enter the organisation's networks from the external networks Ex3: Implement zero trust architectures to restrict network access to each resource to the minimum necessary Ex4: Check the cyber health of endpoints before allowing them to access and use production resources	Network design NTDS Security operations SCAD Network support NTAS Infrastructure operations ITOP Configuration management CFMG Functional testing TEST
The organisation's technology assets are protected from environmental threats	PR.IR-02	Ex1: Protect organisational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity Ex2: Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organisation's behalf	Facilities management DCMA Infrastructure operations ITOP Information security SCTY Risk management BURM Sourcing SORC Technology service management ITMG
Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	PR.IR-03	Ex1: Avoid single points of failure in systems and infrastructure Ex2: Use load balancing to increase capacity and improve reliability Ex3: Use high-availability components like redundant storage and power supplies to improve system reliability	Infrastructure operations ITOP Systems design DESN Availability management AVMT Information security SCTY Risk management BURM
Adequate resource capacity to ensure availability is maintained	PR.IR-04	Ex1: Monitor usage of storage, power, compute, network bandwidth, and other resources Ex2: Forecast future needs, and scale resources accordingly	Capacity management CPMG Availability management AVMT Infrastructure operations ITOP Risk management BURM Demand management DEMM

Detect (DE): Possible cybersecurity attacks and compromises are found and analyzed.

NIST CSF Outcome: Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Security operations managers and senior analysts ensure monitoring systems are effective

Why this level: Requires technical expertise in monitoring tools and threat detection, accountable for detection capability

Key activities:
- Ensuring monitoring coverage is comprehensive (L5)
- Establishing alert thresholds and response procedures (L4-5)
- Managing monitoring infrastructure (L4-5)

Levels 2-5

L4-5: Design monitoring approach, ensure effectiveness, manage SOC operations

L2-3: Monitor alerts, investigate anomalies, document events

L2: Assist with alert triage, maintain monitoring tools

Rationale: Monitoring requires continuous technical operations with L4-5 oversight but doesn't typically require executive involvement.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Networks and network services are monitored to find potentially adverse events	DE.CM-01	Ex1: Monitor DNS, BGP, and other network services for adverse events Ex2: Monitor wired and wireless networks for connections from unauthorised endpoints Ex3: Monitor facilities for unauthorised or rogue wireless networks Ex4: Compare actual network flows against baselines to detect deviations Ex5: Monitor network communications to identify changes in security postures for zero trust purposes	Infrastructure operations ITOP Security operations SCAD Network support NTAS Incident management USUP Data modelling and design DTAN Configuration management CFMG
The physical environment is monitored to find potentially adverse events	DE.CM-02	Ex1: Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts Ex2: Review and monitor physical access records (e.g., from visitor registration, sign-in sheets) Ex3: Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering Ex4: Monitor the physical environment using alarm systems, cameras, and security guards	Security operations SCAD Facilities management DCMA Infrastructure operations ITOP Information security SCTY Risk management BURM Incident management USUP
Personnel activity and technology usage are monitored to find potentially adverse events	DE.CM-03	Ex1: Use behaviour analytics software to detect anomalous user activity to mitigate insider threats Ex2: Monitor logs from logical access control systems to find unusual access patterns and failed access attempts Ex3: Continuously monitor deception technology, including user accounts, for any usage	Security operations SCAD Information security SCTY Data modelling and design DTAN Supplier management SUPP
External service provider activities and services are monitored to find potentially adverse events	DE.CM-06	Ex1: Monitor remote and onsite administration and maintenance activities that external providers perform on organisational systems Ex2: Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behaviour	Infrastructure operations ITOP Security operations SCAD Information security SCTY Supplier management SUPP Data modelling and design DTAN
Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events	DE.CM-09	Ex1: Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events Ex2: Monitor authentication attempts to identify attacks against credentials and unauthorised credential reuse Ex3: Monitor software configurations for deviations from security baselines Ex4: Monitor hardware and software for signs of tampering Ex5: Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorised software), and redirect the endpoints to a remediation environment before access is authorised	Infrastructure operations ITOP Security operations SCAD Information security SCTY Data modelling and design DTAN Vulnerability assessment VUAS

NIST CSF Outcome: Anomalies, indicators of compromise, and other potentially adverse events are analysed to characterise the events and detect cyber security incidents

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Senior security analysts and incident response leads analyze events and declare incidents

Why this level: Requires deep technical expertise and judgment to distinguish true incidents from noise, accountable for analysis quality

Key activities:
- Analyzing complex events to identify incidents (L4-5)
- Integrating threat intelligence into analysis (L5)
- Making incident declaration decisions (L5)

Levels 2-6

L6: Informed of significant incidents, makes strategic response decisions

L4-5: Lead analysis, interpret intelligence, declare incidents

L2-3: Perform initial analysis, correlate data, escalate findings

Rationale: Event analysis is highly technical (L4-5), with L6 involvement for major incidents requiring strategic decisions.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Potentially adverse events are analysed to better understand associated activities	DE.AE-02	Ex1: Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity Ex2: utilise up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterise threat actors, their methods, and indicators of compromise Ex3: Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation Ex4: Use log analysis tools to generate reports on their findings	Security operations SCAD Infrastructure operations ITOP Threat intelligence THIN Data modelling and design DTAN Information security SCTY Network support NTAS
Information is correlated from multiple sources	DE.AE-03	Ex1: Constantly transfer log data generated by other sources to a relatively small number of log servers Ex2: Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources Ex3: utilise cyber threat intelligence to help correlate events among log sources	Security operations SCAD Infrastructure operations ITOP Threat intelligence THIN Data management DATM Infrastructure operations ITOP
The estimated impact and scope of adverse events are understood	DE.AE-04	Ex1: Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates Ex2: A person creates their own estimates of impact and scope	Security operations SCAD Incident management USUP Data modelling and design DTAN Network support NTAS Infrastructure operations ITOP
Information on adverse events is provided to authorised staff and tools	DE.AE-06	Ex1: Use cyber security software to generate alerts and provide them to the security operations centre (SOC), incident responders, and incident response tools Ex2: Incident responders and other authorised personnel can access log analysis findings at all times Ex3: Automatically create and assign tickets in the organisation's ticketing system when certain types of alerts occur Ex4: Manually create and assign tickets in the organisation's ticketing system when technical staff discover indicators of compromise	Security operations SCAD Incident management USUP Infrastructure operations ITOP Information security SCTY Network support NTAS
Cyber threat intelligence and other contextual information are integrated into the analysis	DE.AE-07	Ex1: Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel Ex2: Securely provide information from asset inventories to detection technologies, processes, and personnel Ex3: Rapidly acquire and analyse vulnerability disclosures for the organisation's technologies from suppliers, vendors, and third-party security advisories	Threat intelligence THIN Information security SCTY Infrastructure operations ITOP Supplier management SUPP Security operations SCAD
Incidents are declared when adverse events meet the defined incident criteria	DE.AE-08	Ex1: Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared Ex2: Take known false positives into account when applying incident criteria	Incident management USUP Security operations SCAD Information security SCTY Risk management BURM Data modelling and design DTAN Infrastructure operations ITOP

Respond(RS): Actions regarding a detected cybersecurity incident are taken.

NIST CSF Outcome: Responses to detected cyber security incidents are managed

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-6 (varies by incident severity)

Who: Incident response managers (L4-5) for routine incidents; senior management (L6) for major incidents

Why this level: Routine incidents are managed by technical experts; major incidents require organizational coordination and executive decisions

Key activities:
- Managing incident response execution (L4-5 for routine, L6 for major)
- Coordinating with third parties (L4-5, escalating to L6 as needed)
- Making containment/recovery decisions (L5 for routine, L6+ for major)

Levels 2-6

L6: Manages major incidents, makes strategic decisions, coordinates with executives

L4-5: Lead incident response, coordinate teams, make tactical decisions

L2-3: Execute response actions, document activities, support investigation

Rationale: This is one area where level requirements vary significantly by incident severity - needs flexibility in description.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
The incident response plan is executed in coordination with relevant third parties once an incident is declared	RS.MA-01	Ex1: Detection technologies automatically report confirmed incidents Ex2: Request incident response assistance from the organisation's incident response outsourcer Ex3: Designate an incident lead for each incident Ex4: Initiate execution of additional cyber security plans as needed to support incident response (for example, business continuity and disaster recovery)	Incident management USUP Security operations SCAD Information security SCTY Continuity management COPL Supplier management SUPP Stakeholder relationship management RLMT
Incident reports are triaged and validated	RS.MA-02	Ex1: Preliminarily review incident reports to confirm that they are cyber security-related and necessitate incident response activities Ex2: Apply criteria to estimate the severity of an incident	Incident management USUP Security operations SCAD Information security SCTY Risk management BURM Digital forensics DGFS Problem management PBMG
Incidents are categorised and prioritised	RS.MA-03	Ex1: Further review and categorise incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise) Ex2: prioritise incidents based on their scope, likely impact, and time-critical nature Ex3: Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation	Incident management USUP Security operations SCAD Risk management BURM Information security SCTY
Incidents are escalated or elevated as needed	RS.MA-04	Ex1: Track and validate the status of all ongoing incidents Ex2: Coordinate incident escalation or elevation with designated internal and external stakeholders	Incident management USUP Security operations SCAD Information security SCTY Risk management BURM Supplier management SUPP Stakeholder relationship management RLMT
The criteria for initiating incident recovery are applied	RS.MA-05	Ex1: Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated Ex2: Take the possible operational disruption of incident recovery activities into account	Incident management USUP Continuity management COPL Risk management BURM Information security SCTY Change control CHMG

NIST CSF Outcome: Investigations are conducted to ensure effective response and support forensics and recovery activities

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Digital forensics experts and senior security analysts conduct investigations and establish root causes

Why this level: Requires specialized technical expertise in forensics and investigation techniques, accountable for analysis quality

Key activities:
- Performing analysis to establish what occurred and root causes (L4-5)
- Preserving evidence integrity and provenance (L4-5)
- Estimating and validating incident magnitude (L5)

Levels 2-6

L6: Informed of significant findings, makes decisions based on analysis

L4-5: Lead investigations, perform root cause analysis, provide authoritative findings

L2-3: Collect evidence, document actions, support forensic activities

Rationale: Incident analysis requires specialized technical expertise at L4-5, with findings reported to L6 for major incidents.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
Analysis is performed to establish what has taken place during an incident and the root cause of the incident	RS.AN-03	Ex1: Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event Ex2: Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident Ex3: Analyse the incident to find the underlying, systemic root causes Ex4: Check any cyber deception technology for additional information on attacker behaviour	Digital forensics DGFS Incident management USUP Security operations SCAD Threat intelligence THIN
Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved	RS.AN-06	Ex1: Require each incident responder and others (e.g., system administrators, cyber security engineers) who perform incident response tasks to record their actions and make the record immutable Ex2: Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported	Digital forensics DGFS Incident management USUP Information security SCTY Data management DATM Audit AUDT
Incident data and metadata are collected, and their integrity and provenance are preserved	RS.AN-07	Ex1: Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures	Digital forensics DGFS Incident management USUP Information security SCTY Data management DATM Audit AUDT
An incident's magnitude is estimated and validated	RS.AN-08	Ex1: Review other potential targets of the incident to search for indicators of compromise and evidence of persistence Ex2: Automatically run tools on targets to look for indicators of compromise and evidence of persistence	Incident management USUP Security operations SCAD Digital forensics DGFS Information security SCTY

NIST CSF Outcome: Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 5-6

Who: Senior security managers (L5) coordinate routine reporting; senior management (L6) for significant incidents

Why this level: Requires judgment on stakeholder communication and understanding of regulatory requirements, with senior authority for significant incidents

Key activities:
- Coordinating internal and external stakeholder notifications (L5)
- Ensuring information sharing meets regulatory requirements (L5-6)
- Managing communication for significant incidents (L6)

Levels 3-6

L6: Manages communication for major incidents, interfaces with executives and regulators

L5: Coordinates routine incident reporting, ensures compliance

L3-4: Document incidents, prepare reports, support stakeholder communication

Rationale: Incident communication requires senior capability due to regulatory implications and stakeholder sensitivity, with L6 involvement for significant incidents.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory

NIST CSF Implementation examples

SFIA skills

Internal and external stakeholders are notified of incidents

RS.CO-02

Ex1: Follow the organisation's breach notification procedures after discovering a data breach incident, including notifying affected customers
Ex2: Notify business partners and customers of incidents in accordance with contractual requirements
Ex3: Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval

Security operations SCAD

Information and data compliance PEDP

Information is shared with designated internal and external stakeholders

RS.CO-03

Ex1: Securely share information consistent with response plans and information sharing agreements
Ex2: Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Centre (ISAC)
Ex3: Notify HR when malicious insider activity occurs
Ex4: Regularly update senior leadership on the status of major incidents
Ex5: Follow the rules and protocols defined in contracts for incident information sharing between the organisation and its suppliers
Ex6: Coordinate crisis communication methods between the organisation and its critical suppliers

Security operations SCAD

NIST CSF Outcome: Activities are performed to prevent expansion of an event and mitigate its effects

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-5

Who: Incident response leads and security engineers contain and eradicate incidents

Why this level: Requires technical expertise to execute containment and eradication effectively, accountable for mitigation actions

Key activities:
- Containing incidents to prevent expansion (L4-5)
- Eradicating threats from the environment (L4-5)
- Coordinating mitigation activities across teams (L5)

Levels 2-6

L6: Informed of significant mitigation decisions, approves actions with business impact

L4-5: Lead mitigation efforts, make tactical decisions, coordinate teams

L2-3: Execute containment actions, implement eradication procedures, document activities

Rationale: Incident mitigation is highly technical, requiring L4-5 leadership to coordinate and execute effectively.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory

NIST CSF Implementation examples

SFIA skills

Incidents are contained

RS.MI-01

Ex1: cyber security technologies (e.g., antivirus software) and cyber security features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions
Ex2: Allow incident responders to manually select and perform containment actions
Ex3: Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organisation
Ex4: Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)

Change control CHMG

Problem management PBMG

Incidents are eradicated

RS.MI-02

Ex1: cyber security technologies and cyber security features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions
Ex2: Allow incident responders to manually select and perform eradication actions
Ex3: Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organisation

Change control CHMG

Problem management PBMG

Recover (RC): Assets and operations affected by a cybersecurity incident are restored.

NIST CSF Outcome: Restoration activities are performed to ensure operational availability of systems and services affected by cyber security incidents

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 4-6 (varies by incident severity)

Who: Recovery managers (L4-5) for routine incidents; senior management (L6) for major incidents

Why this level: Routine recovery is technical execution; major incident recovery requires organizational coordination and business decisions

Key activities:
- Executing recovery plans and selecting recovery actions (L4-5 for routine, L6 for major)
- Verifying backup and asset integrity (L4-5)
- Establishing post-incident operational norms (L5 for routine, L6 for major)

Levels 2-6

L6: Manages major incident recovery, makes business continuity decisions, coordinates organizational response

L4-5: Lead recovery execution, verify restoration, coordinate technical activities

L2-3: Perform restoration actions, verify systems, document recovery

Rationale: Recovery requirements vary by incident severity, with routine incidents managed at L4-5 and major incidents requiring L6 authority for business decisions.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory	ID	NIST CSF Implementation examples	SFIA skills
The recovery portion of the incident response plan is executed once initiated from the incident response process	RC.RP-01	Ex1: Begin recovery procedures during or after incident response processes Ex2: Make all individuals with recovery responsibilities aware of the plans for recovery and the authorisations required to implement each aspect of the plans	Incident management USUP Information security SCTY Continuity management COPL Change control CHMG Infrastructure operations ITOP Configuration management CFMG
Recovery actions are selected, scoped, prioritised, and performed	RC.RP-02	Ex1: Select recovery actions based on the criteria defined in the incident response plan and available resources Ex2: Change planned recovery actions based on a reassessment of organisational needs and resources	Incident management USUP Information security SCTY Continuity management COPL Change control CHMG Strategic planning ITSP Risk management BURM
The integrity of backups and other restoration assets is verified before using them for restoration	RC.RP-03	Ex1: Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use	Information security SCTY Data management DATM Storage management STMG Functional testing TEST Configuration management CFMG Risk management BURM
Critical mission functions and cyber security risk management are considered to establish post-incident operational norms	RC.RP-04	Ex1: Use business impact and system categorisation records (including service delivery objectives) to validate that essential services are restored in the appropriate order Ex2: Work with system owners to confirm the successful restoration of systems and the return to normal operations Ex3: Monitor the performance of restored systems to verify the adequacy of the restoration	Continuity management COPL Risk management BURM Service level management SLMO Availability management AVMT Capacity management CPMG Stakeholder relationship management RLMT
The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed	RC.RP-05	Ex1: Check restored assets for indicators of compromise and remediation of root causes of the incident before production use Ex2: Verify the correctness and adequacy of the restoration actions taken before putting a restored system online	Information security SCTY Functional testing TEST Continuity management COPL Risk management BURM Configuration management CFMG Availability management AVMT
The end of incident recovery is declared based on criteria, and incident-related documentation is completed	RC.RP-06	Ex1: Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned Ex2: Declare the end of incident recovery once the criteria are met	Incident management USUP Information security SCTY Problem management PBMG Change control CHMG Knowledge management KNOW

NIST CSF Outcome: Restoration activities are coordinated with internal and external parties

Illustrative SFIA levels of responsibility for the NIST CSF outcome

Primary Accountability

Typical Participation

Level 5-6

Who: Senior security managers (L5) coordinate routine recovery communication; senior management (L6) for major incidents

Why this level: Requires judgment on stakeholder communication and business context, with senior authority for significant incidents

Key activities:
- Communicating recovery progress to stakeholders (L5)
- Coordinating public updates on incident recovery (L6)
- Ensuring recovery communication meets organizational standards (L5)

Levels 3-6

L6: Manages public communication for major incidents, interfaces with executives and external parties

L5: Coordinates recovery communication, manages internal stakeholder updates

L3-4: Document recovery progress, prepare status reports, support communication activities

Rationale: Recovery communication requires senior capability for stakeholder management, with L6 involvement for public-facing communication on significant incidents.

Illustrative SFIA skills mapping to the NIST CSF subcategories

NIST CSF Subcategory

NIST CSF Implementation examples

SFIA skills

Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

RC.CO-03

Ex1: Securely share recovery information, including restoration progress, consistent with response plans and information sharing agreements
Ex2: Regularly update senior leadership on recovery status and restoration progress for major incidents
Ex3: Follow the rules and protocols defined in contracts for incident information sharing between the organisation and its suppliers
Ex4: Coordinate crisis communication between the organisation and its critical suppliers

Continuity management COPL

Public updates on incident recovery are shared using approved methods and messaging

RC.CO-04

Ex1: Follow the organisation's breach notification procedures for recovering from a data breach incident
Ex2: Explain the steps being taken to recover from the incident and to prevent a recurrence

Specialist advice TECH