NIST Cybersecurity Framework

The NIST Cybersecurity Framework is a widely used, voluntary set of guidelines from the U.S. National Institute of Standards and Technology for organizing and improving cybersecurity risk management.

Version 2.0, released in 2024, organizes cybersecurity activities into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is not a checklist of specific products. Instead, it gives organizations of any size a common language to describe where they are today, where they want to be and what to prioritize.

Although it comes from the United States, the framework is used by many Canadian organizations, insurers and larger clients when they assess suppliers. Alberta businesses that serve government, energy or health sector customers may be asked how their security programme lines up with it. In Canada, the Canadian Centre for Cyber Security also publishes baseline controls aimed specifically at small and medium organizations.

Practical tip: use the six functions as a simple self-assessment. For each one, write down what you already do and the biggest gap. That short list becomes a practical roadmap you can work through with your IT provider.