NIST Cybersecurity Framework

NIST CSF: Framework for Improving Critical Infrastructure Cybersecurity

Overview

The NIST Cybersecurity Framework (CSF) is a voluntary framework developed by the National Institute of Standards and Technology (NIST) to help organizations manage and reduce cybersecurity risk. The framework is organized into five functions: Identify, Protect, Detect, Respond, and Recover.

Bindy’s NIST CSF Status: ⚠️ Partial Compliance (60% complete)

• ✅ Identify: 90% complete
• ✅ Protect: 80% complete
• ⚠️ Detect: 60% complete (needs network monitoring)
• ✅ Respond: 90% complete
• ⚠️ Recover: 50% complete (needs disaster recovery testing)

NIST CSF Core Functions

1. Identify (ID)

Objective: Develop organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities.

Evidence:

• Threat Model - STRIDE threat analysis
• Security Architecture - Asset inventory, trust boundaries
• Compliance Roadmap - Risk mitigation tracking
• Cargo.toml, Cargo.lock, SBOM - Dependency inventory

Identify Function: ✅ 90% Complete (Asset management, risk assessment done; needs supply chain deep dive)

2. Protect (PR)

Objective: Develop and implement appropriate safeguards to ensure delivery of critical services.

Evidence:

• RBAC policy: deploy/rbac/clusterrole.yaml
• Secret Access Audit Trail
• Vulnerability Management Policy
• Kubernetes Security Context: deploy/controller/deployment.yaml (non-root, read-only FS)

Protect Function: ✅ 80% Complete (Strong access controls, data protection; needs NetworkPolicies L-1)

3. Detect (DE)

Objective: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event.

Implemented Detection Controls:

Evidence:

• Prometheus alerting rules: deploy/monitoring/alerts/bindy-secret-access.yaml
• Secret Access Audit Trail - Alert definitions
• GitHub Actions workflows: Daily security scans

Detect Function: ⚠️ 60% Complete (Anomaly detection done; needs network monitoring L-1)

4. Respond (RE)

Objective: Develop and implement appropriate activities to take action regarding a detected cybersecurity incident.

Incident Response Playbooks (NIST Lifecycle):

NIST Incident Response Lifecycle:

1. Preparation ✅ - Playbooks documented, tools configured, team trained
2. Detection & Analysis ✅ - Prometheus alerts, audit log analysis
3. Containment, Eradication & Recovery ✅ - Isolation procedures, patching, service restoration
4. Post-Incident Activity ✅ - Post-mortem template, lessons learned, action items

Evidence:

• Incident Response Playbooks
• Post-incident review template (in playbooks)
• Semi-annual tabletop exercise reports

Respond Function: ✅ 90% Complete (Comprehensive playbooks; needs annual tabletop exercise)

5. Recover (RE)

Objective: Develop and implement appropriate activities to maintain plans for resilience and to restore capabilities or services impaired due to a cybersecurity incident.

Current Recovery Capabilities:

Planned Improvements:

• L-2: Implement multi-region deployment (RTO < 1 hour for region failure)
• Annual DR Drill: Test disaster recovery procedures (cluster failure, region failure)

Evidence:

• High availability architecture: 3+ pod replicas, multi-zone
• Zone backups: Git repository (all DNSZone CRDs)
• Incident playbooks: P3 (DNS Service Outage) includes recovery steps

Recover Function: ⚠️ 50% Complete (Pod/controller recovery done; needs multi-region and DR testing)

NIST CSF Implementation Tiers

NIST CSF defines 4 implementation tiers (Partial, Risk Informed, Repeatable, Adaptive). Bindy is at Tier 3: Repeatable.

Tier 3 Evidence:

• Formal security policies documented and published
• Incident response playbooks (repeatable processes)
• Quarterly compliance reviews
• Annual policy reviews (Next Review: 2026-03-18)

Tier 4 Roadmap:

• Implement continuous security metrics dashboard
• Quarterly threat intelligence updates to policies
• Annual penetration testing with policy updates
• Automated compliance reporting

NIST CSF Compliance Summary

Overall NIST CSF Maturity: ⚠️ 60% (Tier 3: Repeatable)

Target: 90% (Tier 4: Adaptive) by Q2 2026

NIST CSF Audit Evidence

For NIST CSF assessments, provide:

1. Identify Function:

   • Asset inventory (Kubernetes resources in Git)
   • Threat model (STRIDE analysis)
   • Compliance roadmap (risk mitigation tracking)
   • SBOM (dependency inventory)

2. Protect Function:

   • RBAC policy and verification output
   • Kubernetes Security Context (non-root, read-only FS)
   • Vulnerability management policy (SLAs, remediation tracking)
   • Secret access audit trail

3. Detect Function:

   • Prometheus alerting rules
   • Vulnerability scan results (daily cargo audit, Trivy)
   • Incident detection playbooks

4. Respond Function:

   • 7 incident response playbooks (P1-P7)
   • Post-incident review template
   • Tabletop exercise results (semi-annual)

5. Recover Function:

   • High availability architecture (3+ replicas, multi-zone)
   • Zone backup procedures (Git repository)
   • Disaster recovery plan (in progress)

See Also

• Threat Model - NIST CSF Identify function
• Security Architecture - NIST CSF Protect function
• Incident Response - NIST CSF Respond function
• Vulnerability Management - NIST CSF Detect function
• Audit Log Retention - NIST CSF Recover function
• NIST Cybersecurity Framework - Official NIST CSF documentation