The NIST CSF combines a competency model with global open standards to create a risk-based management framework for continuous assessment of and improvements to an organization’s information security.