Training an organization on possible phishing attacks would be included under which NIST Framework Core guidelines?

The Detect function covers discovering cybersecurity events after they occur, such as anomaly detection and continuous monitoring, not pre-event training.

The Identify function addresses asset management, governance, and risk assessment to understand organizational context, not workforce training.

The Respond function covers actions taken after a cybersecurity incident has been detected, such as incident response planning and communications.

The NIST CSF Protect function contains the PR.AT (Awareness and Training) category, which specifically covers ensuring personnel understand their cybersecurity responsibilities and are trained to recognize threats such as phishing. Training is a proactive, preventive control aligned with the Protect function's goal of limiting the impact of potential cybersecurity events. This is a foundational element of organizational security posture under the framework.