NIST Cybersecurity Framework (CSF)
In one sentence
A widely used, plain-language framework organizing security into six functions: Govern, Identify, Protect, Detect, Respond, Recover.
The NIST CSF (version 2.0, 2024) is a voluntary, free framework that structures cybersecurity into six functions. It's the common language many tools, consultants, and (in Surable's case) the readiness scorecard are built on.
Why it's on your cyber insurance application
Not something a carrier asks you to certify. It matters because the questions on their form map to it, which is why the same handful of controls appears no matter which carrier's application lands on your desk.
What this looks like in practice
You don't need to adopt the framework to benefit from it. Its six functions are a decent sanity check on where your effort is going: most small businesses have something under Protect and almost nothing under Detect or Recover, which is exactly the shape that makes a ransomware incident expensive.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
- Application-Mapping Guide: Which Document Answers Which Question (preview its opening sections)
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.