The NIST CSF offers a simple, yet effective, construct whose core represents a set of cybersecurity practices and outcomes, as well as technical, operational and managerial security controls that support the five risk management functions: identify, protect, detect, respond and recover.