Summit CPA Review
ISC NIST CSF · Updated November 2026

NIST CSF Functions: What Does Each One Actually Do?

Govern sets direction. Identify understands risk. Protect defends. Detect finds. Respond contains. Recover restores.

Govern

Establish and monitor cybersecurity risk-management strategy, expectations, and policy.

Identify

Understand assets, risks, vulnerabilities, and the environment.

Protect

Implement safeguards to manage cybersecurity risk.

Detect

Find and analyze potential cybersecurity events.

Respond

Take action regarding a detected incident.

Recover

Restore assets and operations affected by an incident.

The takeaway

Govern, Identify, Protect, Detect, Respond, Recover forms a logical cybersecurity lifecycle.

Related Summit guides

NIST vs COSO vs COBITContinue with a related Summit CPA Review guide.Incident responseContinue with a related Summit CPA Review guide.Control typesContinue with a related Summit CPA Review guide.

FAQ

Is Govern part of the current CSF structure?

Yes in NIST CSF 2.0.

Is Detect the same as Respond?

No.

Should I understand the logic rather than only memorize names?

Yes.