1.6.17.5 Communications/security awareness programme 1.7.1 The NIST Framework Core A security awareness programme and the associated communications encourages awareness and the desired behaviour of all staff at all hierarchical levels of the business. The NIST Framework Core is risk-based. It consists of five functions: The aim is to achieve a corporate culture which encourages the desired secure conduct on the part of the individual. Each of these individuals should be enabled to take risk-based decisions within their particular sphere of influence. 1. Identify 2. Protect 3. Detect 4. Respond 5. Recover 1.7 The NIST Framework 1.7.2 Implementation tiers The objective of the NIST Framework and its recommendations is to provide operators of critical infrastructures and other organisations which are dependent on ICT with a tool enabling them independently and on their own responsibility to improve their resilience in the face of cybersecurity risks. The Framework is based on a selection of existing standards, guidelines, and best practice specifications, and is technology-neutral. The NIST Framework has four implementation tiers. These describe the practices that a business has instituted, in other words its level of protection. They range from partial (tier 1) to adaptive (tier 4). To determine its own tier level, an organisation should have a thorough knowledge of its risk management practices, the threat environment, legal and regulatory requirements, business objectives, and organisational requirements. Minimum ICT standard 2018 13