NIST Frameworks, Governance & Risk | SHIELD 2040

Rules of the road: NIST Frameworks, Governance & Risk

Every organization that holds data, runs software or uses AI has to answer the same questions: what are we protecting, what could go wrong, and what will we do about it? NIST, the U.S. National Institute of Standards and Technology, publishes free, public playbooks for exactly that. They are the common language behind most security jobs in 2026, and the direction they point toward (security that starts with governance, privacy and AI risk that are managed on purpose, and software that is built securely) is the one we expect to keep growing through 2040. That "2040" is our own forward-looking framing, not a NIST requirement. This page is the L in SHIELD: Laws, governance & risk. No coding is needed to start.

What you'll be able to do

Explain the six CSF 2.0 functions

Name Govern, Identify, Protect, Detect, Respond and Recover, and say in one sentence what each one is for.

Read a control catalog

Open NIST SP 800-53, find a control family, and explain how the Risk Management Framework (SP 800-37) uses it.

Know when CUI rules apply

Describe what Controlled Unclassified Information is, why SP 800-171 exists, and how CMMC fits in for defense contractors.

Think about privacy and AI risk

Use the Privacy Framework and the AI Risk Management Framework to ask better questions about data and models.

Connect security to software

Explain what the Secure Software Development Framework (SSDF) asks of teams that build software, including AI models.

Plan for a bad day

Sketch an incident response plan using SP 800-61 Rev. 3, and run a free tabletop exercise with friends or a class.

The frameworks, in plain English

Every link goes to the official NIST page. All of these documents are free to read, and none of them gives a certificate by itself. Dates below are the ones shown on NIST's own pages when we checked. Hours are our estimates for a first read.

NIST Cybersecurity Framework (CSF) 2.0

CSF 2.0 organizes cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond and Recover. GOVERN is the new one in 2.0. It covers strategy, roles, policy and risk decisions, and it sits in the middle of the other five. CSF 2.0 is written for organizations of every size and sector, not just critical infrastructure. Two ideas to learn first: Profiles (a Current Profile says where you are, a Target Profile says where you want to be, and Community Profiles are shared starting points for a sector or use case) and the Quick Start Guides (short guides for small businesses, enterprise risk managers and more). Provider: NIST. You earn: none, this is reading. Cost: Free resource · About 3 hours (estimate) · Level: Beginner.

CSF 2.0 home Quick Start Guides Profiles CSF 2.0 (PDF)

SP 800-53 Rev. 5 and the Risk Management Framework (SP 800-37)

SP 800-53 is NIST's big catalog of security and privacy controls, grouped into 20 families. Rev. 5 is the current revision, and NIST has issued minor releases of it since (Release 5.2.0 on August 27, 2025). The Risk Management Framework (SP 800-37 Rev. 2) is the process that uses the catalog: prepare, categorize the system, select controls, implement them, assess them, authorize the system to operate and keep monitoring. Federal systems follow it by law, and many companies borrow it. Start with the RMF overview, then browse the catalog with the free online CPRT tool instead of reading the whole PDF. Provider: NIST. You earn: none, this is reading. Cost: Free resource · About 4 hours (estimate) · Level: Intermediate.

SP 800-53 Rev. 5 RMF overview SP 800-37 Rev. 2 Browse controls (CPRT)

SP 800-171 (CUI) and the CMMC 2.0 context

SP 800-171 Rev. 3 (final, May 2024) lists security requirements for protecting Controlled Unclassified Information when it sits in the systems of companies that are not part of the government. The U.S. Department of Defense built CMMC 2.0 (Cybersecurity Maturity Model Certification) so that defense contractors prove they follow these practices. CMMC is a DoD program, not a NIST one, and its levels are tied to specific NIST documents: check the DoD guides to see which revision of SP 800-171 is assessed today. The DoD rule that adds CMMC to contracts took effect on November 10, 2025 and phases in over time, and the DoD CIO's own resources page announces a change to the Phase 2 date (July 13, 2026), so always read the current status there before you advise anyone. Provider: NIST and the U.S. Department of Defense CIO. You earn: none, this is reading. Cost: Free resource · About 3 hours (estimate) · Level: Intermediate.

SP 800-171 Rev. 3 SP 800-172 DoD CIO CMMC guides CMMC rule (32 CFR Part 170)

NIST Privacy Framework

A tool for managing privacy risk: how your products and data practices affect real people. Version 1.0 is the current final version. NIST has also published Version 1.1 as an Initial Public Draft (April 14, 2025; comments closed June 13, 2025), and its project page said the final was still “coming soon” when we checked, so treat 1.1 as a draft until NIST says otherwise. It lines up with CSF 2.0, which makes it easy to learn the two together. Provider: NIST. You earn: none, this is reading. Cost: Free resource · About 2 hours (estimate) · Level: Beginner.

Privacy Framework Version 1.1 project page Resource repository

AI Risk Management Framework 1.0 and the Generative AI Profile (NIST AI 600-1)

The AI RMF (NIST AI 100-1) helps teams build and use AI in ways people can trust. Its four functions are Govern, Map, Measure and Manage. The Generative AI Profile, NIST AI 600-1 (published July 26, 2024), applies the framework to chatbots and other generative AI, and lists risks such as made-up answers, data leaks and misuse. NIST's AI Resource Center also hosts a free Playbook of suggested actions. This pairs well with the AI Academy Atlas on this site. Provider: NIST. You earn: none, this is reading. Cost: Free resource · About 3 hours (estimate) · Level: Beginner to Intermediate.

AI RMF home AI RMF 1.0 (PDF) Generative AI Profile AI RMF Playbook

Secure Software Development Framework: SP 800-218 and SP 800-218A

The SSDF (SP 800-218, Version 1.1, February 2022) is a short list of practices for building software that has fewer vulnerabilities: prepare the organization, protect the code, produce well-secured software and respond to vulnerabilities. SP 800-218A (final, July 2024) is a Community Profile that adds practices for developing generative AI and dual-use foundation models, and is meant to be used together with 800-218. If you want to become a developer, this is the security checklist you will meet at work. Provider: NIST. You earn: none, this is reading. Cost: Free resource · About 3 hours (estimate) · Level: Intermediate.

SSDF project SP 800-218 SP 800-218A (AI)

SP 800-61 Rev. 3: incident response

Published April 3, 2025, Rev. 3 replaces the 2012 edition and is written as a CSF 2.0 Community Profile: incident response is no longer a separate checklist but something you plan for across all six CSF functions, especially Govern, Detect, Respond and Recover. Read the short sections on preparing, detecting, responding and learning from an incident. Provider: NIST. You earn: none, this is reading. Cost: Free resource · About 2 hours (estimate) · Level: Intermediate.

SP 800-61 Rev. 3

NIST Cybersecurity for Small Business

The friendliest door into NIST. It collects the CSF 2.0 Small Business Quick Start Guide, videos, and guidance by topic (for example phishing, ransomware, multi-factor authentication, cloud security and employee awareness). If you only have one afternoon, start here and then read the CSF page. Provider: NIST. You earn: none, this is reading and watching. Cost: Free resource · About 2 hours (estimate) · Level: Beginner.

Small Business Cybersecurity Cybersecurity basics Videos Guidance by topic

Framework map

One row per framework: who uses it, a free way to learn it, and the kinds of jobs where it shows up. Job titles are typical examples, not promises. To see NIST's official work roles and skills, use the NICE Framework Resource Center.

Framework	Who uses it	A free way to learn it	Career roles
CSF 2.0	Organizations of every size, in every sector, plus auditors and insurers who ask about it	Quick Start Guides and NIST videos	Security analyst, security manager, risk analyst, vCISO for small businesses
SP 800-53 and RMF (SP 800-37)	U.S. federal agencies and their contractors; many companies borrow the controls	RMF overview, then browse controls in CPRT	Security control assessor, systems authorization specialist, GRC analyst
SP 800-171 and CMMC 2.0	Companies that handle CUI, especially U.S. defense contractors and their suppliers	SP 800-171 Rev. 3 and the DoD CMMC guides	Compliance analyst, CMMC consultant, IT security lead at a supplier
Privacy Framework	Product, legal and data teams that handle personal information	Privacy Framework home and its resource repository	Privacy analyst, privacy engineer, data protection officer support
AI RMF and AI 600-1	Teams that build, buy or deploy AI; risk and policy staff	AI RMF Playbook	AI governance analyst, responsible-AI lead, AI risk or assurance analyst
SSDF (SP 800-218, 218A)	Software makers and the organizations that buy their software; AI model developers for 218A	SSDF project page	Secure software developer, DevSecOps engineer, product security engineer
SP 800-61 Rev. 3	Security operations and incident response teams, and the managers who support them	CISA tabletop exercise packages to practice what the guide describes	Incident responder, SOC analyst, security operations manager
Small Business Cybersecurity	Small and medium businesses, nonprofits, schools and the people who help them	NIST Small Business Cybersecurity	IT generalist, managed-service technician, community cyber volunteer

Your free training path

Every step below is free, so the recommended path costs $0. Be honest with learners about what they earn: most of these build knowledge and a portfolio, not a certificate. Where a certificate is not confirmed, we say so. Hours are our estimates.

Step 1 · NIST CSF 2.0 Quick Start Guides and videos

Provider: NIST. You earn: the shared vocabulary every other step relies on (no certificate). Cost: Free course · About 3 hours (estimate) · Level: Beginner. NIST's older online learning modules cover CSF 1.1, so use the 2.0 Quick Start Guides, Profiles and videos instead.

Quick Start Guides CSF 2.0 videos

Step 2 · NIST Small Business Cybersecurity basics

Provider: NIST. You earn: practical know-how for protecting a small organization (no certificate). Cost: Free course · About 2 hours (estimate) · Level: Beginner.

Open the basics

Step 3 · CISA Learning (the successor to FedVTE)

Provider: CISA. You earn: free online cybersecurity training; certificate of completion not confirmed. Cost: Free course · Pick your own: CISA lists about 850 hours in total (estimate for any one course: 2 to 10 hours) · Level: Beginner to Advanced. NICCS says the catalog is mapped to the NICE Framework and is open to government staff, veterans and the public. Sign in through Login.gov. Choose courses on risk management and governance, then a technical one that interests you.

About CISA Learning Sign in

Step 4 · CISA tabletop exercise packages

Provider: CISA. You earn: a ready-made scenario you can run with a group (no certificate). Cost: Free resource · About 2 to 3 hours per exercise (estimate) · Level: Beginner to Intermediate. Pair it with SP 800-61 Rev. 3 and have learners say who does what at each CSF function.

Exercise packages

Step 5 · FedRAMP: how the U.S. government approves cloud services

Provider: FedRAMP (U.S. General Services Administration). You earn: understanding of cloud authorization built on SP 800-53 (certificate not confirmed). Cost: Free resource · About 2 hours (estimate) · Level: Intermediate. FedRAMP's site links to its YouTube channel with recorded sessions. The old training page has moved while FedRAMP updates its program, so start from the home page and the channel, and check what is current.

FedRAMP home FedRAMP on YouTube

Step 6 · CMMC: the free DoD guides

Provider: U.S. Department of Defense CIO. You earn: knowledge of how Level 1 and Level 2 are scoped and assessed (no certificate). Cost: Free resource · About 3 hours (estimate) · Level: Intermediate. The DoD CIO site hosts the scoping guides, assessment guides and FAQs. The site sometimes blocks automated checkers, but it opens normally in a browser.

DoD CMMC resources

Step 7 · NICCS: find more courses and map them to roles

Provider: CISA NICCS. You earn: a personalized plan: browse the education and training catalog by NICE work role (certificate depends on the course). Cost: Free to browse; individual courses vary, so check the cost on each listing · Varies · Level: All levels.

NICCS catalog NICE Framework

Step 8 · University-style courses you can take free

Provider: The Open University (OpenLearn). You earn: a free digital badge and a free Statement of Participation; the badge is not accredited by the university. Cost: Free badge · About 24 hours (course estimate) · Level: Beginner. Introduction to cyber security: stay safe online covers malware, networks, cryptography, identity theft and risk management. Some pages are several years old, so treat it as a foundation. For a deeper, more technical challenge, MIT OpenCourseWare shares the full materials of 6.858 Computer Systems Security (2014) with no certificate.

OpenLearn course MIT OCW 6.858 (Advanced)

Hands-on practice

Governance is a team sport, so these are exercises you can do on paper, in a browser or with a group. Nothing here needs a lab account.

Explore CSF 2.0 and 800-53 online

Use the CSF 2.0 Reference Tool and the CPRT catalog to filter outcomes and controls. Pick one outcome and find the matching controls.

Run a self-assessment

CISA offers the free Cyber Security Evaluation Tool (CSET), which helps an organization review its practices against recognized standards. Try it on a pretend organization.

Run a tabletop

Use a CISA exercise package with a group. Afterwards, write down one lesson for each CSF function.

Play with the AI RMF Playbook

Choose an AI tool your school or club uses. Walk through the Playbook suggestions for Govern, Map, Measure and Manage and note what is missing.

Exercise: a Target Profile for a lemonade stand

Imagine a small shop with a laptop, a card reader and a customer email list. Write a one-page Current Profile (what is true today) and a Target Profile (what you would like in six months), using the six CSF functions as headings. Choose three actions, name who owns each one, and decide how you would know it worked. Never use a real organization's private information.

For Curiosity Coaches

These ideas fit a 45 to 60 minute session. The vocabulary is professional, so take it slowly and let learners connect it to things they already know.

Discussion prompts

Why did NIST add GOVERN in CSF 2.0? Who decides how much risk is acceptable in your school, club or family?
When is a rule (a framework) helpful, and when does it turn into paperwork that nobody reads?
What is personal data, and who should be asked before it is used to train an AI model?
If an AI assistant makes up a fact and a person acts on it, whose job was it to catch the mistake?

A 4-week plan

Week 1: NIST Small Business Cybersecurity basics and the CSF 2.0 Quick Start Guide. Learners name the six functions in their own words.
Week 2: Pick the Privacy Framework or the AI RMF and explore one function. Start the lemonade-stand Target Profile.
Week 3: Run a CISA tabletop exercise, then read the matching section of SP 800-61 Rev. 3.
Week 4: Present the Target Profile, then browse CISA Learning or NICCS and choose one next course by work role.

Age and level fit

Ages 12 to 15: use the small-business materials, videos and the tabletop exercise. Skip the long PDFs.
Ages 16 and up, and career-changers: add the CSF 2.0 document, the CPRT tool and one CISA Learning course.
Adults in compliance or IT roles: go straight to the map table, RMF, SP 800-171 and the DoD CMMC guides.