Cybersecurity is the work of protecting computers, networks, devices and the information in them from people who should not have access, and of keeping them working when something goes wrong. It covers a personal phone as much as a hospital network. This article explains what the word means, what is being protected, the threats you meet most often, and the six functions in the NIST Cybersecurity Framework that organizations use to organize the work.

What the word means

There is no single definition. NIST (the US standards institute) lists six in its glossary, taken from different documents. Two of them are easy to remember. One is the process of protecting information by preventing, detecting and responding to attacks, which comes from the NIST Cybersecurity Framework version 1.1. The other, from CNSSI 4009, is the protection of computers, communications systems and the information in them, including restoring them after damage, so that they stay available, intact, authenticated, confidential and non-repudiable (the sender cannot later deny having sent something).

Put simply, the goal is to keep information private, accurate and available when needed, which is how CISA (the US cybersecurity agency) describes it. These three goals are often called confidentiality, integrity and availability. NIST defines confidentiality as preserving authorized restrictions on access to and disclosure of information.

  • Confidentiality: only the right people can read the information. Example (ours): a customer list that leaks to a competitor breaks it
  • Integrity: the information is accurate and has not been changed by someone who should not change it. Example (ours): an attacker who edits the bank account in an invoice breaks it
  • Availability: the information and systems work when people need them. Example (ours): ransomware that locks every file breaks it
INFOGRAPHIC
The three goals of cybersecurity
The information to protect
losing any one counts as harm
Confidentiality
only the right people can read
Integrity
not changed by those without rights
Availability
works when people need it

What is being protected

CISA points out that much of modern life depends on technology: email and phones, entertainment apps, navigation, online shopping and payment cards, and medical devices and records. Personal data may sit on your own devices or on systems run by other organizations, so protecting it is a shared job. For an organization the same idea extends to servers, cloud services, business applications, and the people who use them.

Threats you meet most often

CISA lists these common threats:

  • Malware (harmful software): it can wipe out a whole system, and some kinds spread to other machines without anyone clicking
  • Intruders: people who break in can change files or use your computer to attack others
  • Financial theft: attackers steal card details and make purchases that are not yours
  • Exploited software flaws: a vulnerability, often a programming mistake, lets an attacker do something unauthorized
  • Phishing and deceptive files: users are tricked into opening an attachment or visiting a harmful page, or into running harmful code that looks useful

For everyday habits against these threats, see Easy Cybersecurity Tips for Everyone. For how an organization tracks and fixes software flaws, see Vulnerability Management: How to Build a Program That Works.

How organizations organize the work

NIST released version 2.0 of its Cybersecurity Framework (CSF) on 26 February 2024. It organizes cybersecurity into six functions and applies to organizations of any size and sector, not only critical infrastructure. The explanations below are our plain-words summary of each function, not NIST's wording:

  • Govern: leaders decide the strategy and treat cyber risk as a major business risk, alongside financial and reputational risk
  • Identify: know what you have and what could go wrong, such as systems, data and risks
  • Protect: put safeguards in place, such as access control, updates and training
  • Detect: notice quickly when something is happening
  • Respond: act on an incident, by containing it and communicating
  • Recover: restore normal operation and learn from what happened
INFOGRAPHIC
The six functions of NIST CSF 2.0
1
Govern
leaders set the strategy
2
Identify
know assets and risks
3
Protect
put safeguards in place
4
Detect
notice when something happens
5
Respond
contain it and communicate
6
Recover
restore and learn

For a closer look at the framework, see NIST AI RMF: A Practical Guide, which covers its sister framework for AI. For how detection and response work in a security operations center, see SIEM + SOAR vs XDR: Capabilities, Limits and Advice.

Cybersecurity is not only a technology job

In our view, good cybersecurity rests on three things working together: people who know what to do, processes that say who decides and who acts, and technology that supports both. The Govern function in CSF 2.0 reflects this: it treats cyber risk as something senior leaders weigh, not only the IT team (our reading of the function). In Thailand, the Cybersecurity Act B.E. 2562 (2019) is the main law, and it applies in particular to organizations that run critical information infrastructure. We summarize how it affects government agencies in SOC Architecture Blueprint for Thai Government Agencies. This article is not legal advice.

INFOGRAPHIC
Misunderstandings versus reality

Misunderstanding

  • Only big firms are at risksmall ones need it too
  • Buy tools and finishtools need people and process
  • It is an IT jobleaders must decide too

Reality

  • The framework fits any sizeas NIST states
  • More than preventiondetect, respond, recover too
  • Leaders weigh cyber riskour reading of the Govern function

Common mistakes

  • Thinking only large companies are targets: NIST built CSF 2.0 for organizations of every size, from small schools and nonprofits to large agencies
  • Buying tools and calling it done: tools need people and processes to run them (our view)
  • Leaving cybersecurity to the IT team alone: the Govern function treats cyber risk as a matter for senior leaders too (our reading)
  • Protecting systems but not the data in them: the goal covers the information, not only the machines
  • Planning only for prevention: the framework also has Detect, Respond and Recover, because some attacks get through
  • Treating it as a one-time project: threats and software change, so the work repeats (our view)

Start today

  • List what you have: devices, accounts, applications and the data they hold, starting with what the business cannot work without
  • Turn on a second login step for email and administrator accounts
  • Turn on automatic updates wherever you can
  • Check that you have a backup you can actually restore: and try restoring one file
  • Decide who to call first when something goes wrong: write down the name and number
  • Name one senior person who owns cyber risk: even in a small organization

To see where your organization stands today, try the self-assessment.

Thailand has a specific law for critical infrastructure; see Thailand Cybersecurity Act and CII: Who Is Covered.

For an international standard for organizing information security, see ISO/IEC 27001:2022 Explained for Beginners.

When a customer asks for evidence of security, see the comparison of ISO 27001 vs SOC 2.

To see how the six CSF 2.0 functions are used in practice, read NIST CSF 2.0: The Six Functions and How to Use Them.

References and further reading

The definitions and the framework description come from the NIST and CISA pages listed below, which were read on 27 October 2026. The sentences about servers, cloud services and applications in the protection section, the plain-words descriptions of the six functions, the examples for the three goals, and the points marked as our view are ours and do not come from those pages. The Thai law is mentioned only in general terms; read the Act itself for exact wording.