Overview
The NIST Cybersecurity Framework (CSF) 1.1 organizes cybersecurity activities into a clear hierarchy: Functions > Categories > Subcategories. This article explains how these layers work together to guide maturity assessments in Hyver and improve your organization’s ability to identify, prevent, and respond to cyber threats.
Framework Structure
Functions
Functions are the highest-level groupings of cybersecurity outcomes. CSF 1.1 includes five core functions:
Identify
Protect
Detect
Respond
Recover
Each function provides a strategic lens for organizing and analyzing cybersecurity capabilities.
Categories
Within each function are several categories that define specific areas of focus.
Examples include:
Access Control (under Protect)
Anomalies and Events (under Detect)
Recovery Planning (under Recover)
Subcategories
Categories are broken into subcategories, which are detailed, measurable outcomes used in Hyver’s maturity assessments.
Example Subcategory:
PR.AT-1 – All users are informed and trained
This subcategory focuses on user awareness training for cybersecurity risks. Employees should be able to identify and report threats. If no formal training or reporting procedure exists, the organization lacks a critical layer of defense.
Why This Structure Matters
Each layer in the CSF 1.1 hierarchy supports a deeper level of insight:
Functions guide high-level risk management strategies
Categories help align security operations with specific outcomes
Subcategories offer detailed checkpoints for maturity scoring and improvement planning
Wrap-up / Next Steps
Understanding the layered structure of CSF 1.1 helps you assess and improve cybersecurity practices in a structured, measurable way. In Hyver, this hierarchy powers the maturity assessment model and helps link strategy to execution.