The Security Lifecycle: Identify, Protect, Detect, Respond, Recover

• Map every control and process to one of the five CSF functions
• Explain why you can't respond to what you can't detect
• Run a small lifecycle exercise end to end

• It's the universal vocabulary between engineers, executives and auditors — 'which CSF function is this?'
• Budget questions become function questions: underfunded Detect means slow Respond.
• IR plans, threat models, asset inventories and DR drills all slot into the loop, exposing gaps.
• Maturity models (CMMI-style) use CSF to score organizations; most interviews reference it.

Map the city (Identify: which blocks have sprinklers). Keep equipment ready (Protect). Watch the alarms (Detect). Roll trucks (Respond). Rebuild houses and review the plan (Recover). Close the loop: lessons change the map.

• Identify: asset inventories, classifications, risk assessments — 'what do we have, how important is it?'
• Protect: access control, patching, hardening, training — 'how do we keep it safe when nothing's wrong?'
• Detect: monitoring, SIEM, EDR, detection rules, anomaly programs — 'how do we find the wrong things?'
• Respond: IR plans, playbooks, containment, communications — 'what do we do when something breaks?'
• Recover: backups, restores, DR drills, post-incident review — 'how do we get back and learn?'

• Identify: a CMDB plus data classification feeds every other function — you can't protect unlisted assets.
• Protect: automated patching and MFA exist because the company decided the Detect/Respond cost is higher.
• Detect→Respond: an EDR alert (Detect) triggers the playbook (Respond) that isolates the host and pages on-call.
• Recover: monthly DR drill restores the app in 4h; the post-mortem updates the runbook and the asset list.

• Invest per function proportional to your risk, and link them: better Detect shortens Respond; better Protect reduces detection load.
• Keep asset data fresh — Identify is the foundation; stale inventories leak into all five.
• Practice the loop: tabletop IR, restore drills and detection tests keep each function honest.
• Feed Recover lessons back into Identify/Protect so the loop tightens.

• Building Detect with no Respond plan — alerts fire into a void.
• Protect without Identify — you harden the wrong things.
• Recover without testing — the backups are months of fiction.
• Treating the functions as departments instead of one loop; security-as-organizations silo the loop.

• An IR that stalls? Check which function the stall is in: no detector data (Detect), no playbook (Respond), no restore path (Recover).
• When coverage reviews flail, ask 'which CSF function does each tool feed?' — tools that feed none are shelfware.
• After an incident, force a lesson for Identify AND Protect too, not just Respond.

• Legal boundaries: Identify/Detect efforts (asset scans, monitoring) must stay within owned/authorized scope.
• Respond decisions (takedowns, discords, legal) are policy decisions — plan them before the incident.