The NIST Cybersecurity Framework works best as an ongoing journey, not a fixed checklist. The Protect function builds safeguards to keep services running, while Respond and Recover phases demand heavy human effort and strong governance to avoid scattered, one-off security decisions.
How am I supposed to secure what I do not know about? The CSF itself is a blueprint. It's difficult to just walk in and prove how you're different, especially when you're more expensive. So we can actually use the NIST Cybersecurity Framework as a security journey. The purpose of protection: developing and implementing the appropriate safeguards to ensure delivery of services. The other thing that sometimes I'll show them too, and this comes from this book right here, The Cyber Defense Matrix. It's a really excellent book, and we even have a course on this inside of Empath. Tools are less effective in response and recovery. It takes people hours. We just can't have mavericks in security. We can't have one-offs. So you still have the 5 functions: identify, protect, detect, respond, recover. But inside now we have governance. But we also have to recognize that at the end of the day, we're going to have to understand it's not the end of the story.
