NIST Cybersecurity Framework Core applied to DNS

The National Institute of Standards and Technologies (NIST) Cybersecurity Framework (CSF) is a de facto security implementation standard not only for the U.S. government, but for organizations worldwide. This framework defines a common lexicon to facilitate documentation and communication of security requirements and level of implementation. In addition, the framework enables an organization to identify risks and to prioritize the mitigation of risks with respect to business priorities and available resources.

NIST’s CSF seeks to facilitate communications within an  organization as well as to external parties when conveying security goals, maturity status, improvement plans and risks. The framework is comprised of three major components:

• The framework core defines security activities and desired outcomes for the lifecycle of an organization’s management of cybersecurity risk. The core includes detailed references to existing standards to enable common cross-standard categorization of activities. The core defines these activities across five functions: 
• Identify – deals with what systems, assets, data and capabilities require protection
• Protect – implement safeguards to limit the impact of a security event
• Detect – identification of incidents
• Respond – deals with security event management, containing incident impacts
• Recover – resilience and restoration capabilities

• The framework profile defines the mechanism for assessing and communicating the current level of security implementation as well as the desired or planned level of implementation. The profile applies business constraints and priorities, as well as risk tolerance to the framework core functions to characterize a particular implementation scenario. 

• The framework implementation tiers define four gradations of maturity level of security implementations, ranging from informal and reactive to proactive, agile and communicative:
• Tier 1 – Partial – Informal, ad hoc, reactive risk management practices with limited organizational level risk awareness and little to no external participation with other entities.
• Tier 2 – Risk Informed – Management-approved with widely established organization-wide risk awareness but with informal and limited organization-wide risk management practices and informal external participation.
• Tier 3 – Repeatable – Risk management practices are formally approved as policy with defined processes and procedures which are regularly updated based on changes in business requirements as well as the threat and technology landscape. Personnel are trained and the organization collaborates with external partners in response to events.
• Tier 4 – Adaptive – Organization-wide approach to managing cybersecurity risk where practices are adapted to the changing cybersecurity landscape in a timely manner. The organization manages risk and shares information with partners.

The implementation tiers enable an organization to apply the rigor of their selected maturity level to their target profile definition to align risk management practices to the particular organization’s security practices, threat environment, regulatory requirements, business objectives and organizational constraints.

We defined a mapping of the NIST CSF version 1.0 to DNS-specific outcomes in our DNS Security Management book, which I co-authored with Michael Dooley, as published by Wiley IEEE Press in 2017. I've updated this mapping to apply to the latest version 1.1 of the CSF. This mapping is intended as input to your application and interpretation of the CSF for DNS and any feedback is welcomed. I hope this helps you assess your current standing and to prioritize actions towards securing your DNS with this de facto security standard as a guide.