Transforming Cyber Frameworks to Take Control of Cyber-Risk

CIOs, CTOs and CISOs today must continually adapt security protocols and tooling to keep pace with a shifting technology landscape, a challenge that is especially acute for public sector cyber leaders working with limited budgets and lean IT teams.

The piece argues that while frameworks can feel daunting, beginning implementation is better than delaying, and highlights several well-established options such as NIST CSF, MITRE ATT&CK and the Cybersecurity Maturity Model Certification (CMMC) as ways to build a proactive first line of defence.

It notes that NIST CSF provides a broad structure with five core functions—identify, protect, detect, respond and recover—and that publications like NIST 800-61 and 800-207 map to specific challenges such as incident response and zero-trust architecture. The article also stresses that public agencies can combine CMMC with ATT&CK threat mapping to help prevent breaches and maintain regulatory compliance, with the University of Chicago cited as an example of NIST CSF being used across more than 20 departments.

It cites real-world pressures, including a June 6 executive order signed by the Trump administration prioritising cybersecurity to protect America, and the need to address agentic AI and evolving government mandates. Written by Mick Baccio, Global Security Adviser at Cisco Foundation AI, the piece concludes by urging a step-by-step approach and collaboration with the public sector community to realise the benefits of a complete cybersecurity function.