Solution Type* Tools: Individual software applications or plugins designed to perform specific security-related functions.
Example: Wireshark, a free and open-source packet analyzer.
Services: Ongoing offerings provided by specialized organizations to manage or support various aspects of an entity’s security needs.
Example: Shadowserver daily threat reports.
Platforms: Collaborative environments where organizations and individuals work together to enhance cybersecurity.
Example: Cyber Threat Alliance, a real-time cyber threat information sharing platform among companies and organizations.
  Tool Service Platform
Control Area: NIST CSF Framework* Govern: Solutions that help prioritize, communicate, and monitor cybersecurity risk management strategy, policies, and processes to strengthen strategic planning and secure data.
Identify: Solutions building a comprehension of current cybersecurity risks.
Protect: Solutions safeguarding assets from cyberattacks and managing cybersecurity risks effectively.
Detect: Solutions providing monitoring support and systems to identify and analyse possible cybersecurity attacks, vulnerabilities, and compromises.
Respond: Solutions involved in taking actionable steps to minimize and limit the impact of cybersecurity incidents.
Recover: Solutions to restore assets and normal operations affected by cybersecurity incidents to quickly get back to business.
    Govern Identify Protect Detect Respond Recover Other/Multiple – Specify
Cybersecurity Function* A. Foundational Internet Infrastructure
   Other/Multiple – Specify 0. Physical Transmission Media 0.01 Undersea Cable Systems 0.02 Terrestrial Fiber Optic Networks 0.03 Data Centers and Landing Stations 0.04 Satellite Communication Links
Cybersecurity Function* B. Operating
   Other/Multiple – Specify 1. Application Security 1.01 Application Programming Interface Security 1.02 Application Security Testing 1.03 Application Security Posture Management 1.04 Runtime Application Security 1.05 Software Bill of Materials/Software Composition Analysis SBOM/SCA 2. Attack Surface Management 2.01 Bug Bounty Services 2.02 External Attack Surface Management 2.03 Automated Pen Testing/Red Teams 2.04 Breach and Attack Simulation 2.05 Security Ratings Platforms 3. Authentication and Access Management 3.01 Biometrics 3.02 Multi-Factor Authentication (MFA) 3.03 Passwordless Authentication 3.04 Password Management 3.05 Single Sign-On (SSO) 3.06 Identity Governance and Administration (IGA) 3.07 Privileged Access Management (PAM) 4. Data Security 4.01 Cloud Data Security Posture Management 4.02 Data Access Governance 4.03 Data Discovery and Classification 4.04 Data Leakage Prevention (DLP) 4.05 Data Privacy Platforms 4.06 Secure Data Storage and Backup 4.07 Data Privacy Compliance 5. Email Security 5.01 Anti-Phishing Tools 5.02 Domain-Based Message Authentication, Reporting, and Conformance (DMARC) 5.03 Email Encryption 5.04 Phish Testing and Training 5.05 Secure Email Gate (SEG) 6. Encryption and PKI 6.01 Certification Authority 6.02 Data Encryption at Rest 6.03 Key and Secret Management 6.04 Key and Certificate Protection 6.05 Post-Quantum Cryptography 6.06 Public Key Infrastructure (PKI) 6.07 Secure Sockets Layer (SSL)/Transport Layer Security (TLS) 7. Endpoint Security 7.01 Antivirus Software 7.02 Browser Isolation 7.03 Content Disarm and Reconstruction (CDR) 7.04 Endpoint Detection and Response (EDR) 7.05 Security Enhanced Browser 8. Enterprise IT Infrastructure 8.01 Asset Inventory 8.02 Backup Platform 8.03 Infrastructure Resilience 8.04 Insider Threat Protection 8.05 Secure Sharing and Collaboration 9. Governance, Risk, and Compliance 9.01 Continuous Compliance Monitoring 9.02 Cyber Insurance 9.03 Incident Reporting 9.04 GRC Platform 9.05 Risk Management Platforms 9.06 Cybersecurity Policy Development 10. Security Operations and Incident Response 10.01 Security Operations Center (SOC) 10.02 Incident Response Teams (IRT) 10.03 Threat Hunting and Forensics 10.04 Managed Security Services Providers (MSSPs) 11. Advanced Threat Protection 11.01 Artificial Intelligence (AI) in Cybersecurity 11.02 Zero Trust Security Models 11.03 Extended Detection and Response (XDR) 11.04 Secure Access Service Edge (SASE) 12. IoT and Mobile Security 12.01 Internet of Things (IoT) Security 12.02 Mobile Device Management (MDM) 12.03 Mobile Threat Defense (MTD) 12.04 IoT Network Segmentation 12.05 IoT Security Platforms 12.06 Mobile App Security 14. Managed Security Services 14.01 DDOS Security 14.02 Managed Detection and Response 14.03 Managed Security Services Platform 14.04 Network Detection and Response 14.05 XDR Services 15. Network Security 15.01 Network Access Control (NAC) 15.02 Next-Generation Firewalls (NGFW) 15.03 Secure Access Service Edge (SASE) 15.04 Virtual Private Network (VPN) Services 15.05 Secure Routing Protocols 15.06 Intrusion Detection and Prevention Systems (IDPS) 16. Operational Technology Security 16.01 ICS/OT Device Security 16.02 ICS/OT Visibility 16.03 Unidirectional Gateways 16.04 Vehicle Security 16.05 Zero Trust OT 17. Security Professional Services 17.01 Penetration Testing 17.02 Security Assessment 17.03 Security Industry Research and Advisory 17.04 Security Training 17.05 Value Added Resellers 18. Software Lifecycle Security 18.01 AI/MLOps Security 18.02 Container/Kubernetes Security 18.03 Container Scanning 18.04 DevSecOps Platforms 18.05 Infrastructure as Code (IaC) Security 19. Threat and Vulnerability Management 19.01 Digital Risk Protection (DRP) 19.02 Security Scanning 19.03 Third-Party Risk Management 19.04 Threat Intelligence and Vulnerability Platforms 19.05 Security Information and Event Management (SIEM) 19.06 Vulnerability Assessment and Management 20. Web Security 20.01 Bot Management 20.02 Content Security 20.03 Secure Web Gateway (SWG) 20.04 Web Application Firewall (WAF) 20.05 Website Scanning 21. Physical Security and Resilience 21.01 Physical Security of Data Centers 21.02 Resilient Network Design 21.03 Disaster Recovery Planning 21.04 Environmental Monitoring and Controls 22. Security Standards and Protocols 22.01 Internet Engineering Task Force (IETF) Standards 22.02 ISO/IEC Security Standards 22.03 NIST Cybersecurity Framework 22.04 Compliance with GDPR and Other Regulations
Cybersecurity Function* C. Naming, Numbering and Routing
   Other/Multiple – Specify 23. Packet Routing and Forwarding 23.01 Internet Exchange Points (IXPs) 23.02 Core and Peering Routers 23.03 Border Gateway Protocol (BGP) Security 23.04 IP Transit and Backbone Services 24. Routing Security 24.01 BGPSEC 24.02 Domain Name System Security Extensions (DNSSEC) 24.03 Secure Routing Protocols 24.04 URL Whitelisting 24.05 Domain Name System (DNS) Root Servers 24.06 Top-Level Domain (TLD) Registries 24.07 Regional Internet Registries (RIRs)
Cybersecurity Function* E. Hosting
   Other/Multiple – Specify 26. Cloud Service Providers 26.01 Cloud Service Providers 27. Cloud Security 27.01 Cloud Data Fragmentation 27.02 Cloud Infrastructure Entitlement Management 27.03 Cloud Security Posture Management (CSPM) 27.04 Cloud Workload Protection Program 27.05 Microsegmentation 27.06 Infrastructure as Code (IaC) Security 27.07 Secure Content Delivery Networks (CDNs) 28. Content Distribution Networks 28.01 Content Distribution Networks