Section 3.2 of the NIST preliminary cybersecurity framework provides a (recursive) list of steps that can be followed to apply the framework to an organisation. It would be useful if the example given followed this same structure and pointed out some of the decision points (and their inputs).