Why NIST Is Sleeping Through a Conceptual Revolution Beyond cybersecurity: six verbs for every risk

The Framework That Undersells Itself

NIST is not blind to the wider picture. CSF 2.0 says that “ideally, the CSF will be used to address cybersecurity risks alongside other risks of the enterprise, including those that are financial, privacy, supply chain, reputational, technological, or physical in nature.” It points to a whole series — IR 8286 and its four companions — on integrating cybersecurity with enterprise risk management (ERM). And it states its own role there: the CSF “helps organizations to translate their terminology for cybersecurity and cybersecurity risk management into general risk management language that executives will understand.”

Read that sentence again. The CSF is cast as a dialect to be translated into the general language of risk. Cyber risk is assessed in cyber terms, rolled up through risk registers, and arrives in the ERM portfolio as one line among others — “alongside” financial and operational risk. That is integration by aggregation.

The revolution NIST is sleeping through is the reverse direction. The six functions are not a dialect that needs translating. They already are the general language — more precise, more operational and more measurable than what ERM usually speaks. COSO’s twenty principles and ISO 31000’s process of identifying, analysing, evaluating and treating describe how an organisation manages risk. Neither is built as a grid of control objectives indexed by event. The CSF almost is — and then confines itself to one domain.

Strike One Word

The test is simple. Take the six function definitions from CSF 2.0 and delete the word cybersecurity.

Five definitions survive intact. A credit committee, a treasury desk and a compliance function can sign every one of them. Only DETECT breaks — and where it breaks is instructive. “Attacks and compromises” is the one place where the CSF names what a function acts on. Remove the cyber noun and a slot opens: detect what?

That slot is the whole story. The six functions are verbs. A verb needs an object. In the CSF the object is implicit — “cybersecurity risk” — and the CSF Core organises its outcomes by function, not by the event they act on. That is why, even inside cyber, two organisations’ control mappings are rarely comparable: each fills the missing noun with its own vocabulary. Outside cyber, the slot is simply empty.

Verbs Need Nouns

Fill the slot with an event and the functions acquire positions. An event has something before it that can bring it about, and something after it that it can bring about. Each function acts at a different place on that line — the logic of the bow-tie, applied to any event, not only to the one at the centre of a security diagram.

In cybersecurity I have built this out as TLCTC: ten cause clusters as the nouns, six functions as the verbs, sixty named control objectives. The general method behind it — Layered Event Modelling — draws the consequence: every event is the centre of its own bow-tie. A system compromise, the data event it leads to and the business event after that each carry their own six functions. Nothing in that method is specific to IT. It needs only that a risk domain names its events and declares how they are connected. In February I ran the same bow-tie on software failure, where no attacker exists at all; the functions did not change.

A Formal Core

Stated compactly, the grammar has two sorts and one function, and the measures fall out of the edge types.

Three features carry the weight. The template is the same sentence with a free variable; only the event changes. The placement makes DETECT and RESPOND a pair that is measured against time — the time the next event needs to happen. And the edge types decide where that time exists: only causal edges carry a Δt. A norm or a classification scheme does not bring about anything, so there is no window on those edges, and a control that pretends to act in one is acting on nothing.

Six Verbs Across the Risk Map

What follows are six risk categories and two amplifiers, each with a chain in this notation, one event put in focus, and its six control objectives. The cases are real where a source is cited; the Δt values in the strategic and reputational cases are illustrative.

1 · Strategic risk — the slow substitute

Velocity: months to years · illustrative

Strategic risk is the domain where “detect” sounds out of place — and is most neglected. Win rates are measured anyway; what is usually missing is the statement that they are the DETECT control for a named event, with a response that must land before the next quarter’s revenue does.

2 · Credit risk — the window before default

Velocity: quarters · classificatory end point (CRR Art. 178)

Two lessons from the notation. First, “default” is not a further event but a classification of one: missed payments count as default under a declared scheme, and changing the scheme changes what is counted, not what happened. Second, an early-warning system is the DETECT control of the first event, not of default — detecting default is trivial. Its value is exactly the Δt it buys for RESPOND, and that can be measured: DCS_d = lead time of the warning at P90 divided by the time from deterioration to breach.

3 · Liquidity risk — when Δt collapses

Velocity: hours · Silicon Valley Bank, March 2023

This is the case for measuring time. The liquidity coverage ratio is calibrated to a 30-day stress scenario — an assumed Δt. The Federal Reserve’s own review reports what was measured: about $42 billion out on 9 March, about $100 billion queued for the 10th. A response designed for weeks against an edge that completes in a day has DCS_c far above 1, whatever the ratio shows. The grammar does not prevent a run; it makes the mismatch a named number before the run, rather than a finding after it.

4 · Operational risk, process — the interest payment that moved the principal

Velocity: minutes to hours · Citibank / Revlon, August 2020

The chain starts with an error, not an attacker, and the grammar does not care. The transaction passed a multi-person approval; the approvers checked the fields they were shown, not the effect of the release. That is a PROTECT objective worded around the wrong noun. Worded around the event — “protect from releasing an unintended amount” — the control that would have caught it names itself: compare the amount with the amount due. And the Δt to crediting was hours, after which RESPOND became a two-year RECOVER.

5 · Operational risk, cyber — where the nouns already exist

Velocity: minutes to days · TLCTC notation

This is the domain where the grammar is already complete: ten cause clusters supply the nouns, and every step of an attack path is an event with its own six cells. The 15 minutes from #4 to #1 decide the shape of the RESPOND control — too fast for an analyst, so it must be automated. The data and business events at the end of the chain carry their own six functions; backups, for instance, belong to the [DRE: Ac] event, not to the cluster that caused it.

6 · Compliance risk — a window without a Δt

No causal velocity · DORA, Regulation (EU) 2022/2554

Compliance is where the edge types earn their keep. Nothing happens to an unchanged process when a regulation starts to apply — and yet on 17 January 2025 it changed from compliant to non-compliant. The edge to the violation is normative: it has no Δt, and no circuit breaker can act on it. There is still a window — twenty-four months between entry into force and application — but it is a bound the norm sets on the organisation’s change process, not a propagation delay. IDENTIFY (horizon scanning) and PROTECT (change before the date) are therefore the decisive columns; DETECT after the date finds a violation that has already occurred.

7 · Reputational risk — the slow amplifier

Velocity: weeks to months · accumulates over incidents · illustrative

Reputation is often filed as a vague consequence on top of everything else. It is better described as an amplifier risk event. It causes no loss on its own. What it does is change what other events bring about, and its strength depends on their history. Customers forgive one outage, one breach, one apology. The same incident a second or third time is a different event, even if nothing about the incident itself differs: trust is not dented but lost, and the loss is final. Only then does the causal edge to the end of the relationship fire.

That has two consequences for the grid. First, the decisive controls sit before the final event. RECOVER after the first incident — a visible, evidenced repair — and PROTECT against the repeat are what keep the counter from reaching the threshold. A firm that handles each incident well in isolation and lets it recur has managed the incident and lost the customer. Second, the measure changes. Next to the Δt between final loss of trust and cancelled contracts, which bounds crisis communication, the amplifier needs a count: how many incidents each segment has seen within its memory, against an appetite stated in repeats.

8 · Recurring software failure — the fastest amplifier

Velocity: milliseconds per repeat · Knight Capital, 1 August 2012

The software amplifier needs no new cause. A defect that writes an incorrect record once writes it on every execution, so each run is a further [DRE: Ii] from the same failure, with milliseconds between instances. Knight Capital’s router sent orders to fill 212 customer orders and, in 45 minutes, produced more than four million executions and a loss of more than $460 million. Before the market opened, the system had sent 97 automated emails that identified the error. They were not designed as alerts, and nobody acted. The observation existed; it reached no one who could act on it.

It amplifies twice. On the data layer, every repeat is another incorrect record. On the business layer, every incorrect record that reaches a process becomes a business event of its own — a position, a payment, an invoice — so the loss grows with every repeat until the repetition stops. The size of the loss is roughly the repeat rate times the loss per instance times the time to containment, so containment time decides it. Then the slow amplifier takes over. The next day, brokers including TD Ameritrade and E*Trade stopped routing their customers’ orders to the firm. Four million repeats in 45 minutes were, in their customers’ eyes, not one incident.

For the grid, this means that against milliseconds DETECT and RESPOND by people have a DCS far above 1 by construction. Only controls that are already in place can act: hard limits that cap what the event can bring about, and a kill switch that stops the repetition without waiting for a decision. The rule the regulator cited afterwards — the SEC’s market access rule — requires exactly such pre-trade controls.

Measurability Across Silos

Today, the credit officer, the treasurer, the head of payments, the CISO and the compliance officer each report in a vocabulary of their own. Their reports cannot be added up, compared or audited against one another, because they do not share a structure. With the six verbs, they do:

Three measures come out of one structure, whatever the domain:

• Coverage. Every event in a chain has six cells. A gap is not an abstract worry but a named, empty cell — and an empty RESPOND cell for deposit outflows means the same thing as an empty RESPOND cell for identity theft.
• Control indicators per cell. PROTECT and IDENTIFY are measured by state and coverage; DETECT, RESPOND and RECOVER by performance. GOVERN sets the targets from appetite and tolerance — that is where key risk indicators belong, at the strategy layer, not in the cells.
• Time against time. On every causal edge, the defender’s slow tail is set against the event’s speed: DCS = TTD_P90 or TTC_P90 divided by Δt. Below 1, the response typically wins; above 1, the next event typically happens first. The ratio means the same in a credit book as in a SOC.

This is what reduces complexity. Not one more framework, but one structure under all the existing ones: n events times six verbs, with typed edges between the events. The risk categories keep their expertise — nobody suggests a CISO should write covenants — but they stop needing their own grammar.

What NIST Would Have to Change

Remarkably little, and nothing in the cyber content. Four moves:

1. Parametrise the functions. Write the six definitions with the event as a variable, and say that the CSF instantiates them for cybersecurity — not that they belong to it.
2. Require nouns. State that each domain must supply a set of events that do not overlap, named by cause, not by outcome. Without them, “protect” protects nothing in particular, inside cyber as much as outside.
3. Position the verbs. Define each function by where it acts relative to the event — before it, on the edge after it, on the observation of it, on the state it changed — rather than by lists of activities.
4. Measure time on causal edges only. A Δt belongs to an edge along which one event brings about another. Norms and classification schemes have deadlines and thresholds, not velocities.

Risk management does not need a new framework. It needs to notice that the most widely adopted one already contains its grammar — and that the grammar is larger than the domain it was written for. It is time to free risk management from its niche and to treat it as the universal instrument it can be. NIST has the text for it. It has only to strike one word.

References

1. Basel Committee on Banking Supervision (2013). Basel III: The Liquidity Coverage Ratio and liquidity risk monitoring tools. BIS.
2. Board of Governors of the Federal Reserve System (2023). Review of the Federal Reserve’s Supervision and Regulation of Silicon Valley Bank. 28 April 2023.
3. COSO (2017). Enterprise Risk Management — Integrating with Strategy and Performance.
4. In re Citibank August 11, 2020 Wire Transfers, U.S. Court of Appeals for the Second Circuit, decided 8 September 2022.
5. In the Matter of Knight Capital Americas LLC, U.S. Securities and Exchange Commission, Administrative Proceeding File No. 3-15570, Order of 16 October 2013.
6. ISO (2018). ISO 31000:2018 Risk management — Guidelines.
7. Kreinz, B. (2026). Top Level Cyber Threat Clusters (TLCTC), Version 2.7 — Core. Zenodo. doi:10.5281/zenodo.23437984
8. Kreinz, B. (2026). TLCTC Version 2.7 — Application. Zenodo. doi:10.5281/zenodo.23438220
9. Kreinz, B. (2026). Layered Event Modelling: Semantic Separation as a Precondition for Explicit Causal Analysis, v1.0. Zenodo. doi:10.5281/zenodo.23438101
10. Kreinz, B. (2026). Compliance-Ontologie. Barnes Projects. barnes.ch
11. Kreinz, B. (2026). Software Failure through the Bow-Tie Lens. Barnes Projects. barnes.ch
12. National Institute of Standards and Technology (2024). The NIST Cybersecurity Framework (CSF) 2.0. NIST CSWP 29. doi:10.6028/NIST.CSWP.29
13. National Institute of Standards and Technology (2020). Integrating Cybersecurity and Enterprise Risk Management (ERM). NIST IR 8286. doi:10.6028/NIST.IR.8286
14. Regulation (EU) No 575/2013 (Capital Requirements Regulation), Art. 178 — Default of an obligor.
15. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Art. 28(3).