7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover
Key Takeaways
- SAL1 training content names five NIST Cybersecurity Framework stages: Identify, Protect, Detect, Respond, and Recover.
- NIST CSF 2.0 added Govern in February 2024; treat Govern as current context, not a replacement for the five-stage SAL1 list.
- Identify is knowing assets and risk; Protect is safeguards; Detect is finding attacks; Respond is incident action; Recover is restoring operations.
- A junior SOC analyst's shift work concentrates on Detect and Respond, but Identify, Protect, and Recover still appear in MCQ-style questions.
- A ransomware chain can be mapped onto all five functions and often exposes Identify and Protect failures before the first SOC alert.
What SAL1 expects you to name
The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) organizes how an organization manages cybersecurity risk. SAL1 training content names five stages: Identify, Protect, Detect, Respond, and Recover. You must know the high-level purpose of each and be able to map a real attack chain onto those stages.
In February 2024, NIST published CSF 2.0, which added a sixth function, Govern (cybersecurity strategy, roles, policies, and oversight). Remember Govern as current industry context so a news headline does not surprise you. Do not replace the five-stage list SAL1 training content uses. If an item asks for the CSF stages covered in that training, answer with Identify, Protect, Detect, Respond, and Recover.
The CSF is a defender program model. It is not an attacker lifecycle. Mixing it with the Cyber Kill Chain is a common trap: Kill Chain stages describe what the adversary does; CSF functions describe what the organization must be able to do before, during, and after incidents. Functions also run concurrently in a mature program—Protect does not wait for Identify to be perfect forever—but SAL1-style questions still want the five names and purposes.
This section is independent study material covering those SAL1 topics.
Identify
Purpose: Know what you have, why it matters, and what could go wrong. You cannot protect, detect, or recover assets you have not listed.
High-level work includes:
- Hardware, software, cloud, and data inventory
- Business context (electronic health record vs a marketing microsite)
- Vulnerability and risk assessment
- Understanding suppliers and other third parties who touch those systems
SOC-relevant traces of Identify failure: nobody owns a public Remote Desktop Protocol (RDP) jump box; the asset list still shows a retired file server as production; the risk register never mentioned that backups share a network with the workstations they are supposed to save.
MCQ flavor: missing inventory, unknown shadow IT, not knowing where crown-jewel data lives. Identify is often paperwork and architecture, not a SIEM rule, which is why junior analysts under-study it and then miss easy items.
Protect
Purpose: Apply safeguards that reduce the likelihood or impact of events. After you know the assets, you secure them.
High-level work includes identity and access control (including multi-factor authentication), awareness training, data security (encryption, least privilege on shares), hardening and patching, email and web controls, and backups that ransomware cannot immediately encrypt (offline, immutable, or otherwise isolated).
SOC analysts do not own every Protect control, but they inherit the consequences: macros allowed from the internet, no MFA on VPN, backups sitting on the same Server Message Block (SMB) share the encryptor will hit. When a question describes a missing safeguard rather than a missing alert, think Protect.
Detect
Purpose: Find and analyze anomalies, indicators of compromise, and other signs that an attack or disruption is underway—in time to do something.
High-level work includes continuous monitoring, log collection, detections in security information and event management (SIEM) and endpoint detection and response (EDR) tools, spotting deviations from baseline, and testing that detections still fire after a parser change.
This is the home turf of a junior SOC analyst: alert queues, hunt queries, true positive vs false positive. Detect is not install antivirus and forget it. It is the ability to notice this encryption storm, this impossible-travel login, this new service installing at 02:14.
Respond
Purpose: Take action on a detected incident: contain effects, investigate, coordinate, and mitigate.
High-level work includes incident management, analysis (what happened, what is in scope), mitigation (isolate a host, disable an account, block C2), reporting, and communications with internal teams and leadership (and, when policy requires it, customers or regulators).
Respond is not Recover. Turning off a network interface is Respond. Restoring the billing server from backup is Recover. Writing a case report that lists what you isolated and which indicators you blocked is Respond work, even when a later team handles restoration.
Recover
Purpose: Restore assets and operations that the incident affected, and communicate during restoration, so the organization returns to an acceptable state.
High-level work includes recovery planning, restoring systems and data, validating that restored systems are clean, lessons-learned that feed Identify, Protect, and Detect, and stakeholder communication (pharmacy systems are back as of 18:40).
If backups were never isolated, Recover fails even when Detect and Respond were heroic. That is why Identify and Protect still appear on entry-level items even though the analyst's shift is mostly tickets.
Where a SOC analyst actually lives
Day to day, a SOC spends most clock time in Detect (alerts, hunts, monitoring) and Respond (containment, escalation, case notes). That does not make the other functions exam-irrelevant. Items will ask which function is missing when:
- Nobody knows which servers store cardholder data (Identify).
- MFA was never enforced on the jump host (Protect).
- Backups restore failed because they were online and encrypted too (Recover).
Think of Detect and Respond as the analyst's desk, and Identify, Protect, and Recover as the program that determines whether that desk can succeed.
| Stage | High-level purpose | Example question stem | Typical SOC contact |
|---|---|---|---|
| Identify | Know assets, context, and risk | Which servers hold patient images? | Weak: you discover the gap during an incident |
| Protect | Apply safeguards | Why was RDP password-only? | You inherit the missing control |
| Detect | Find and analyze attacks | Which alert fired and was it true? | Alert queue, hunts |
| Respond | Act on a declared incident | Isolate, disable, escalate, document | Playbooks, tickets, case reports |
| Recover | Restore operations | When did billing return, and from what backup? | You may support; IT/business owns the restore |
Worked mapping: ransomware onto the five stages
Story. A clinic allows RDP to a jump box with a password-only local administrator account. An attacker password-sprays at 01:12, stops a leftover Microsoft Defender service, deploys encryptors across SMB shares, and drops HOW_TO_RECOVER.txt. Backups are a nightly copy to \\backup01\nightly, still mounted. EDR fires at 01:47 on mass file-renames. The analyst isolates two hosts at 01:58, but billing stays down until paper processes take over. Restoration from a month-old offline USB archive begins the next afternoon.
Identify. The clinic's asset list did not flag the jump box as internet-exposed, and the risk assessment never asked what happens if backup01 is reachable with the same admin hash. Identify failed before the first packet.
Protect. No MFA on RDP, a reused local admin, tamper protection off, backups not immutable or offline, limited training on unexpected remote access. Several Protect safeguards were absent. MFA on RDP, or offline backups, would have changed the night even if Detect was slow.
Detect. The useful detection was the EDR mass-rename alert at 01:47. A healthier Detect program would also have surfaced earlier signals: RDP from an unusual network at 01:12, Defender stopped, a new privileged logon. Detect succeeded late but not never.
Respond. Isolation of hosts, disabling the sprayed account, blocking the encryptor hash and any C2, preserving disk evidence, paging IT to take backup01 offline, and notifying leadership. That is Respond: managing the incident, not yet we are fine.
Recover. Restore from the offline USB archive, rebuild the jump box rather than treating ransom payment as the only path, verify integrity, bring billing back, communicate restoration times, and feed lessons (MFA, inventory, backup design) back into Identify and Protect.
Kill Chain overlay (do not confuse the models): password spray against RDP is Delivery and Exploitation of that service; encrypting shares is Actions on Objectives. CSF overlay: the organization's gaps sit in Identify and Protect; the SOC night shift is Detect and Respond; the business returning to care delivery is Recover.
CSF versus the attacker-side models
| Model | Whose actions? | Shape | What you use it for |
|---|---|---|---|
| Cyber Kill Chain | Adversary | Seven attack stages | Understand the attack lifecycle |
| MITRE ATT&CK | Adversary behaviors | Tactics and techniques | Map detections and procedures |
| NIST CSF (SAL1 five) | Defender organization | Identify, Protect, Detect, Respond, Recover | Map program functions and incident handling |
A single ransomware night can be narrated in all three: ATT&CK techniques for the encryptor, Kill Chain stages for the storyboard, CSF functions for which part of our program failed or worked.
Exam traps
- Listing Govern as one of SAL1's five training stages. Mention it as CSF 2.0 context from 2024; keep the five-stage list for SAL1-style answers.
- Calling restore from backup Respond. Restoration is Recover; isolating systems and declaring the incident is Respond.
- Calling the CSF a kill chain. It describes defender outcomes, not adversary stages.
- Assuming junior analysts never get Identify questions. They do: inventory, data classification, which function is asset management.
- Treating Detect as only a product name. Detect is the outcome: attacks are found and analyzed.
Memory hook: Identify what matters, Protect it, Detect when something goes wrong, Respond to the incident, Recover the business.
Which pair of NIST CSF stages occupies most of a junior SOC analyst's daily ticket work?
After ransomware, IT restores billing from an offline USB archive and brings production systems back. Which NIST CSF stage is that restoration?
SAL1 training content lists five NIST CSF stages. How should a candidate treat the Govern function?