your one source for IT & AV

About Us | Careers | Contact Us | Locations  
Training Presentation Systems Services & Consulting Cloud Services Purchase Client Center Computer Museum
Arrow Course Schedule | Classroom Rentals | Student Information | Free Seminars | Client Feedback | Partners | Survey | Standby Discounts

NIST Cybersecurity Framework (NCSF) Boot Camp Training

SS Course: 2001602

Course Overview


The three-day NIST Cybersecurity Bootcamp course is a combination of the NIST Cybersecurity Framework (NCSF) Foundation and Practitioner Training courses. The bootcamp provides a deep dive into the components of the NIST CSF and NIST Risk Management Framework (RMF) and how they align to risk management. The course will follow the principles of the NIST Cybersecurity Framework to design and implement (or improve) a cybersecurity program to protect critical assets. The bootcamp details defense in depth, creation of a Written Information Security Program, and implementing ongoing assessments for a continuous improvement plan.


Scheduled Classes

10/17/22 - LRS - LRS - Virtual Instructor-Led
11/09/22 - LRS - LRS - Virtual Instructor-Led
12/12/22 - LRS - LRS - Virtual Instructor-Led

What You'll Learn


The course will help students to understand:

  • Key IT service management concepts
  • How ITIL guiding principles can help and organization to adopt and adapt service management
  • The 4 dimensions of service management
  • The purpose and components of the service value system
  • The activities of the service value chain and how the interconnect
  • Know the purpose of key ITIL practices
  • Preparation to sit the ITIL4 foundation examination


Viewing outline for:

Module 1) Course Introduction

Module 2) The Basics of Cybersecurity

What is cybersecurity?

Types of attackers






Risk-Based Cybersecurity

Module 3) A Holistic Study of the NIST Cybersecurity Framework


EO 13636

Cybersecurity Enhancement Act of 2014

EO 13800

Uses and Benefits of the Framework

Attributes of the Framework

Framework Component Introduction

Framework Core

Framework Profiles

Framework Implementation Tiers

Moduel 4) Cybersecurity Activities: The Framework Core

Purpose of the Core

Core Functions, Categories, and Subcategories

Informative References

Module 5) Risk Management Considerations: Framework Implementation Tiers

Purpose of the Tiers

The Four Tiers

Components of the Tiers

Compare and contrast the NIST Cybersecurity Framework with the NIST Risk Management Framework

Module 6) Current and Desired Outcomes: Framework Profiles

Purpose of the Profiles

The Two Profiles

Interrelationships between the Framework Components

Module 7) A Primer on the Seven Step Framework Implementation Process

Prioritize and Scope


Create a Current Profile

Conduct a Risk Assessment

Create a Target Profile

Determine, Analyze, and Prioritize Gaps

Implement Action Plan

Module 8) The Components of the NIST Cybersecurity Framework

Review of the NIST CSF Major Components

Tiers and Tier selection
Current and Target Profiles and the Framework Core
Informative References
i. Center for Internet Security Controls v8
ii. ISO/IEC 27001:2013
iii. ISO/IEC 27002:2013
iv. NIST SP 800-53 Rev. 5
Supply Chain Risk Management in the Enterprise

Module 9) Risk Management in the NIST CSF and NIST RMF

Risk Management in the NIST Cybersecurity Framework

Analyzing the NIST Risk Management Framework
i. Introduction and History
ii. Purpose and Use Cases
iii. Six Steps
1. Categorize System
2. Select Controls
3. Implement Controls
4. Assess Controls
5. Authorize System
6. Monitor Controls
Integrating the Frameworks

 Module 10) Real World Attacks

Major Cybersecurity Attacks and Breaches
Cyber Kill Chain

Module 11) Defense in Depth and the NIST Cybersecurity Framework

Defense in Depth and the NIST CSF

Zero Trust

Aligning Vendor Controls with Subcategories

Security Operations Center (SOC) activities and Security Information and Event Management solutions in relation to the Framework

Module 11) Defense in Depth and the NIST Cybersecurity Framework

Defense in Depth and the NIST CSF

Zero Trust

Aligning Vendor Controls with Subcategories

Security Operations Center (SOC) activities and Security Information and Event Management solutions in relation to the Framework

Module 12) Assessing Security in the Subcategories

Creating an Assessment Plan
Assigning Roles and Responsibilities
Tiers, Threats, Risks, Likelihoods, and Impact

Module 13) Creating a Written Information Security Programs (WISP)

The Intersection of Business and Technical Controls
What is a Written Information Security Program (WISP)?
Creating a WISP Template
Aligning Current Profile with a WISP

Module 14) A Practitioner’s Deep Dive into Creating or Improving a Cybersecurity Program

Step 1: Prioritize and Scope
a) Identifying organizational priorities
b) Aiding and influencing strategic cybersecurity implementation decisions
c) Determining scope of the implementation
d) Planning for internal adaptation based on business line/process need
e) Understanding risk tolerance
Step 2: Orient
a) Identifying systems and applications which support organizational priorities
b) Working with compliance to determine regulatory and other obligations
c) Planning for risk responsibility
Step 3: Create a Current Profile
a) Cybersecurity Assessment options
b) How to measure real world in relation to the Framework
c) Qualitative and quantitative metrics
d) Current Profile and Implementation Tiers
Step 4: Conduct a Risk Assessment
a) Risk assessment options (3rd party vs internal)
b) Organizational vs. system level risk assessment
c) Risk assessment and external stakeholders
Step 5: Create a Target Profile
a) Target Profile and Steps 1-4
b) External stakeholder considerations
c) Adding Target Profiles outside the Subcategories
Step 6: Determine, Analyze, and Prioritize Gaps
a) Defining and determining Gaps
b) Gap analysis and required resources
c) Organizational factors in creating a prioritized action plan
Step 7: Implement Action Plan
a) Implementation team design from Executives to Technical Practitioners
b) Assigning tasks when priorities conflict
c) Considering compliance and privacy obligations
d) Taking action
e) Reporting and reviewing

Module 15) Continuous Cybersecurity Improvement

Creating a continuous improvement plan
Implementing ongoing assessments



There are no prerequisites for this course. Basic computing skills and security knowledge will be helpful.

    Who Should Attend


    This course is suited for individuals working with and overseeing the cybersecurity of an organization, including:

    • CISOs
    • IT Security Workforce
    • IT Directors
    • IT Managers
    • IT Personnel
    • IT Architects

    Next Step Courses