Cybersecurity Frameworks and Standards

The NIST Cybersecurity Framework, usually abbreviated CSF, is a voluntary framework published by the US National Institute of Standards and Technology that organizes cybersecurity outcomes into a common structure so organizations can assess and communicate their posture. It is descriptive rather than prescriptive, meaning it tells you what outcomes to achieve and not which products to buy.

The framework has three parts. The Core is the set of functions, categories, and subcategories describing security outcomes. The Tiers describe how rigorous and integrated an organization's risk management practices are, on a scale from partial to adaptive. The Profiles describe where an organization is today and where it wants to be, which is how the framework is used for gap analysis.

Its practical value in security operations is as a shared vocabulary between the SOC and the rest of the business, especially for mapping which outcomes the SOC actually owns, and most of a SOC's work sits inside the Detect and Respond functions, with a supporting role in Recover.

The most visible change in CSF 2.0, released in 2024, is the addition of a sixth function. The original framework had five functions: Identify, Protect, Detect, Respond, and Recover. CSF 2.0 adds Govern, which sits alongside the other five and covers how cybersecurity risk decisions get made, who is accountable, and how strategy, policy, and oversight are established.

Other changes worth knowing:

• Scope broadened beyond critical infrastructure: version 1.1 was framed around critical infrastructure. Version 2.0 is explicitly intended for organizations of any size and sector, though the public sector and utilities remain where CSF alignment is most often a requirement rather than a choice.
• Supply chain risk management is elevated: now handled within Govern rather than tucked inside Identify.
• Implementation guidance was expanded: including quick-start guides and community profiles for specific sectors and use cases.

One practical caution. Several widely-read vendor explainers still describe the five-function CSF 1.1 core without mentioning Govern, Cisco's among them. If a page you are reading lists five functions and doesn't mention Govern, it describes CSF 1.1 regardless of what its publication date says, and the NIST source material is the thing to check against.

MITRE ATT&CK is a publicly available knowledge base of adversary tactics and techniques based on real-world observations. It catalogs what attackers actually do, organized so that defenders can talk about behavior in a consistent way rather than describing the same activity in five different vocabularies.

The structure runs from broad to specific. Tactics are the adversary's objectives, such as initial access, persistence, or exfiltration. Techniques are the ways an objective is achieved, and sub-techniques are the specific variants. Alongside these, ATT&CK documents Groups (named threat actors), Software (the tooling they use), Campaigns, and Mitigations.

In security operations ATT&CK is used for three things mainly: describing what a detection actually catches, measuring coverage by mapping detections to techniques and finding the gaps, and giving investigators a structured way to ask what an adversary would likely do next. The attacker-side view of the same sequence, stage by stage, is covered in cybersecurity basics. The knowledge base is maintained by MITRE and is best consulted at attack.mitre.org directly, since it's updated regularly and any summary of it goes stale.

The cyber kill chain is a model developed by Lockheed Martin describing the sequence of stages an intrusion moves through, on the premise that breaking any single link disrupts the whole chain. The original model, published as part of Lockheed's Intelligence Driven Defense work, has seven stages:

• Reconnaissance: researching and selecting the target.
• Weaponization: pairing an exploit with a deliverable payload.
• Delivery: transmitting the payload, such as by email, web, or removable media.
• Exploitation: triggering the vulnerability or the user action that gives execution.
• Installation: establishing a persistent foothold.
• Command and control: opening a channel for remote operation.
• Actions on objectives: doing whatever the intrusion was for, such as data theft or encryption.

It remains useful as a teaching model and as a way to reason about where a defense sits, and its main limitation, widely noted, is that it describes a linear, perimeter-oriented intrusion and fits identity-driven and cloud-native attacks less well.

Seven in the original Lockheed Martin model, and eight in several widely-published vendor versions. Both numbers are in wide circulation, and neither is wrong so much as unattributed.

The original is seven, ending at actions on objectives. CrowdStrike and Microsoft both teach eight, and Microsoft's added stage is monetization, which reflects a real change in the threat landscape since the model was published, since a large share of modern intrusions end in extortion or resale rather than in espionage. Netskope's variant adds persist as a distinct stage instead. Splunk's explainer openly asks whether there is an eighth step at all.

The variation goes further than the count. Varonis publishes an eight-phase list that shares only two stage names with Lockheed's original, which means two pages can both claim to describe "the cyber kill chain" and be describing substantially different models.

If a stage count matters for your purposes, such as in a report, a control mapping, or an exam, cite which version you are using. If you need a stage model for actual detection engineering work, MITRE ATT&CK's tactics are a better fit than any kill chain variant, because they are maintained, granular, and mapped to observed behavior.

The kill chain is a linear narrative model with a fixed number of stages. ATT&CK is a knowledge base of observed behaviors organized under tactics, with no assumption that an adversary moves through them in order.

The two are complementary rather than competing. The kill chain is better for communication, particularly to executives and to people new to the field, because a story with a beginning and an end is easier to follow. ATT&CK is better for operational work, because "we have detection coverage for eleven of the sixteen credential access techniques relevant to our environment" is a statement you can act on, and "we cover the exploitation stage" is not.

Defense in depth is the principle of layering multiple independent controls so that the failure of any single one does not result in compromise, it is an old idea borrowed from physical and military security, and it applies across physical, technical, and administrative control types.

Zero trust is a different principle that is frequently confused with it. Zero trust removes implicit trust based on network location, and requires every access request to be authenticated, authorized, and continuously validated regardless of where it originates. The phrase usually associated with it's that there is no trusted internal network.

The difference in one line: defense in depth is about how many controls sit between an adversary and the objective. Zero trust is about what those controls are based on, specifically that they should be based on verified identity and device posture rather than on which network segment a request came from.

They are compatible and most modern programs use both. A zero trust architecture is generally implemented in layers, which is defense in depth. And a defense-in-depth program built entirely on network segmentation, with implicit trust once inside the perimeter, is exactly what zero trust was formulated to correct. The one genuinely settled point is that neither is a product, and any vendor page that describes either as something you can buy is describing their own product rather than the concept.