PATCH//NOTES Open the interactive version
← All lessons
Foundations · Beginner · 5 min

Security frameworks & governance

The playbooks organisations use to decide what to protect and how.

What it is

A security framework is a structured set of good practices so organisations don't have to invent security from scratch. The NIST Cybersecurity Framework groups work into six functions: Govern, Identify, Protect, Detect, Respond and Recover. ISO 27001 is an international standard for running an information security management system. MITRE ATT&CK catalogues how real attackers behave, so defenders can check their coverage. Governance is the layer above the tools: policies, risk decisions and making sure rules are actually followed. Compliance (meeting rules like GDPR, HIPAA or PCI DSS) overlaps with security but isn't the same thing: you can be compliant and still insecure.

Real case · Everyday

The NIST CSF in practice

When a company says it is 'mapping to the NIST CSF', it means checking each function: do we know what we have (Identify)? Can we stop attacks (Protect) and spot them (Detect)? Do we have a plan to Respond and Recover? The newest version added Govern to put risk ownership at the centre.

Source: NIST Cybersecurity Framework

How defenders stop it

  • Pick a framework that fits your size and sector rather than starting from nothing
  • Use MITRE ATT&CK to find gaps in what you can detect
  • Treat compliance as a floor, not the goal: meeting rules is not the same as being secure
  • Write policies people can actually follow, and review them

Try it yourself

Read the NIST Cybersecurity Framework

Check yourself

1. What are the six functions of the NIST Cybersecurity Framework?

  1. Govern, Identify, Protect, Detect, Respond, Recover
  2. Plan, Do, Check, Act, Review, Repeat
  3. Scan, Patch, Monitor, Alert, Block, Report
  4. Confidentiality, Integrity, Availability, Audit, Comply, Insure
Show answer

Govern, Identify, Protect, Detect, Respond, Recover. The NIST CSF groups work into Govern, Identify, Protect, Detect, Respond and Recover.

2. Which statement about compliance is true?

  1. You can be compliant and still insecure
  2. Compliance guarantees security
  3. Compliance only applies to governments
  4. Compliance replaces the need for a framework
Show answer

You can be compliant and still insecure. Meeting rules like PCI DSS is a minimum bar; it doesn't guarantee you're actually secure.

3. What is MITRE ATT&CK mainly used for?

  1. Mapping real attacker tactics so defenders can find gaps
  2. Encrypting data at rest
  3. Assigning IP addresses
  4. Writing privacy policies
Show answer

Mapping real attacker tactics so defenders can find gaps. ATT&CK catalogues how attackers behave, so teams can check what they would and wouldn't detect.

Answer them in the app to earn XP.

Next: Phishing & social engineering →