---
title: Identify the framework core
description: Within the NIST CSF application, the Framework Core section is used to identify categories and subcategories as cybersecurity policies and their statement policies.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/grc-common-functions/identify-framework-core.html
release: australia
product: GRC Common Functions
classification: grc-common-functions
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Process overview, NIST CSF Use Case Accelerator, GRC use case accelerators, Common GRC features, Governance, Risk, and Compliance]
---

# Identify the framework core

Within the NIST CSF application, the **Framework Core** section is used to identify categories and subcategories as cybersecurity policies and their statement policies.

The application uses categories to define cybersecurity activities for targets and uses subcategories to evaluate cybersecurity requirements to provide additional details on compliance.

With NIST CSF guidance, the application groups categories and subcategories into functions and represent them as activities. The NIST CSF uses the following five modules to designate individual functions:

-   Identify
-   Protect
-   Detect
-   Respond
-   Recover
-   Govern

Each module points to a grouping of policy and control objectives that relates to that function.

-   **[Review the framework core](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/grc-common-functions/review-framework-core.md)**  
Review the Framework Core that's activated with the NIST CSF application.

**Parent Topic:**[NIST CSF process overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/grc-common-functions/nist-csf-process.md)