The six functions and the junction point

The six functions

The NIST CSF 2.0 framework organises cybersecurity into six functions:

Adding the Govern function in 2024 was not cosmetic: it acknowledges that most observed failures are not technical but decisional.

Three arrangements, one chain

A mature organisation has three arrangements handling the same event from three angles:

• The CSIRT analyses, contains, eradicates — it works on the threat;
• The crisis team decides, arbitrates, communicates — it works on the consequences;
• Business continuity maintains service — it works on what must continue.

These three must share one alert chain and one incident log. The most frequent defect is the opposite: the CSIRT has been working on an incident for four hours that management discovers when a journalist calls.

The decisions to prepare beforehand

Five decisions must be settled in calm conditions, because they are impossible to take soundly under pressure:

1. Mass disconnection. At what signal do you cut internet access, inter-site links, remote access? Who decides, and without whom?
2. Service shutdown. Is an unavailable service better than a potentially compromised one that keeps processing data?
3. Payment. The organisation's position on a ransom demand is settled in advance, at board level, not overnight.
4. Communication. Who speaks, from when, and what is said before you understand?
5. Restoration. From which backup point do you restore, knowing that the further back you go, the more data you lose but the further you get from the compromise?

The junction point: trust in the directory

In almost every large-scale attack, the attacker seeks domain administration rights. Once they hold them, they can reach production, replication, monitoring and — the decisive point — the backups.

That is why rebuilding after a major attack takes weeks: it is not about restoring data, but about rebuilding a foundation of trust that can be demonstrated to be no longer compromised.

The organisations that recover fastest are those that prepared three things in advance: an isolated recovery directory, backups outside the administration domain, and a documented, tested rebuild procedure.