Standards, Training, and Insider Risk

The NIST Cybersecurity Framework, first issued in 2014 in response to a 2013 U.S. presidential executive order aimed at protecting critical infrastructure, gave organizations a common, voluntary vocabulary for managing cyber risk. Its original five core functions — Identify, Protect, Detect, Respond, and Recover — describe a continuous lifecycle rather than a one-time checklist; a sixth function, Govern, was added in the 2024 update (version 2.0) to place oversight and accountability at the center of the model. Because it is flexible and outcome-based rather than prescriptive, the framework has been adopted well beyond the critical-infrastructure sectors it was originally designed for.