NIST CSF (Cybersecurity Framework)
NIST's framework organizing security activities into five functions: Identify, Protect, Detect, Respond, and Recover. A common reference for building and measuring IoT and OT security programs.
What is NIST CSF (Cybersecurity Framework)?
NIST's framework organizing security activities into five functions: Identify, Protect, Detect, Respond, and Recover. A common reference for building and measuring IoT and OT security programs.
The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into a set of functions, categories, and subcategories that provide a common language for security program design, assessment, and communication. Version 1.1 (2018) organized security around five functions: Identify, Protect, Detect, Respond, and Recover. Version 2.0 (2024) added a sixth function — Govern — and expanded applicability explicitly beyond critical infrastructure to all organizations.
The framework is intentionally outcome-focused rather than prescriptive: it defines what security programs should achieve (complete asset inventory, access control, anomaly detection, response plans) without mandating specific technologies or implementations. This flexibility makes the CSF applicable across diverse industries and organization sizes, but requires organizations to translate framework requirements into specific technical and operational controls for their environment.
Asset inventory — the foundation of the CSF's Identify function — is where many organizations have the largest IoT and OT gap. CSF ID.AM (Asset Management) requires organizations to know what physical devices and systems are on their network. Most IoT, OT, and IoMT devices are systematically excluded from existing asset management programs. Closing this gap is the most impactful single improvement organizations can make for CSF alignment in asset-rich environments.
Key Facts
- NIST CSF 2.0 was released in February 2024, adding the Govern function and broadening applicability
- CSF ID.AM (Asset Management) is the category most commonly cited as incomplete in assessments
- The CSF is used by 50%+ of US organizations and has been adopted as a reference framework in multiple countries
- NIST CSF profiles allow organizations to document their current state versus their target state for each function
How ORDR Addresses NIST CSF (Cybersecurity Framework)
ORDR directly addresses NIST CSF Identify function requirements by providing complete asset inventory across IT, IoT, OT, and IoMT devices. Protect function requirements (access control, information protection) are addressed through segmentation policy generation. Detect function requirements (anomalies, security events) are addressed through behavioral monitoring and threat detection.
See ORDR in actionFrequently Asked Questions
See NIST CSF (Cybersecurity Framework) in practice.
ORDR gives security teams complete visibility into every connected asset—and the intelligence to act on what matters most.