What is NIST CSF 2.0?
The NIST Cybersecurity Framework is a voluntary framework that describes cybersecurity outcomes: what an organisation should achieve, not how to achieve it. It gives leaders, risk managers and practitioners a shared vocabulary for cybersecurity risk.
NIST first published the framework in 2014 and updated it in 2018. CSF 2.0, released in February 2024 as NIST Cybersecurity White Paper 29, broadened its audience to all organisations and added a sixth function, Govern.
Purpose and objectives
Organisations use the CSF to:
- understand and describe their current cybersecurity posture;
- set a target posture aligned to business priorities and risk appetite;
- identify and prioritise gaps;
- communicate cybersecurity risk to executives, boards, partners and regulators;
- map other frameworks and controls to a common set of outcomes.
Who does it apply to?
Any organisation, whether public or private, large or small, in any sector or country. It is popular as an “umbrella” for organisations that must satisfy several frameworks, because many standards are mapped to it.
Structure: the CSF Core
The Core is a hierarchy of functions, categories and subcategories (specific outcomes).
| Function | Outcome focus |
|---|---|
| Govern (GV) | The organisation’s cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. Includes organisational context, roles, oversight and supply chain risk management |
| Identify (ID) | Current cybersecurity risks are understood: asset management, risk assessment, improvement |
| Protect (PR) | Safeguards manage risk: identity and access, awareness and training, data security, platform security, infrastructure resilience |
| Detect (DE) | Possible attacks and compromises are found and analysed: continuous monitoring, adverse event analysis |
| Respond (RS) | Action is taken on detected incidents: management, analysis, reporting and communication, mitigation |
| Recover (RC) | Affected assets and operations are restored: recovery plan execution and communication |
Govern sits at the centre and informs the other five. Identify, Protect, Detect, Respond and Recover describe the cybersecurity life cycle.
Profiles and tiers
- Organisational profiles describe an organisation’s current or target posture in terms of Core outcomes. Comparing the two shows the gaps and drives an action plan.
- Community profiles are baselines produced for a sector, technology or threat, which organisations can adopt as targets.
- Tiers (1 Partial, 2 Risk Informed, 3 Repeatable, 4 Adaptive) characterise the rigour of governance and management practices overall.
Supporting resources
NIST publishes online informative references mapping CSF outcomes to standards such as SP 800-53, ISO/IEC 27001 and the CIS Controls. It also offers implementation examples for subcategories and quick-start guides for specific audiences such as small businesses, enterprise risk managers and supply chain teams. These are available through NIST’s Cybersecurity and Privacy Reference Tool.
Using the CSF: a practical lifecycle
- Scope. Choose the business units, systems or services the profile covers.
- Gather context. Mission, risk appetite, legal and contractual requirements, and threats.
- Create a current profile. Assess each relevant subcategory with evidence.
- Create a target profile. Decide desired outcomes, informed by risk and requirements, possibly starting from a community profile.
- Analyse gaps and prioritise by risk, cost and dependency.
- Implement an action plan using controls from your chosen catalogues, such as SP 800-53, ISO/IEC 27001 Annex A or the CIS Controls.
- Measure and communicate. Report progress to leadership, and repeat periodically.
Worked example: a small SaaS company’s first profile
Imagine a 60-person software company preparing for enterprise customers.
| Step | What they did |
|---|---|
| Scope | The production SaaS platform and the corporate IT supporting it |
| Context | Customer contracts require incident notification within 48 hours. The board’s risk appetite is low for customer-data exposure |
| Current profile | Strong Protect outcomes (MFA, encryption, managed endpoints). Weak Govern (no documented risk strategy or supplier risk process) and Recover (backups untested) |
| Target profile | Define a risk strategy and roles (GV), add supplier risk reviews (GV.SC), test restores quarterly (RC), and formalise incident communication (RS) |
| Action plan | Twelve prioritised actions over two quarters, each mapped to controls from ISO/IEC 27001 Annex A, because the company also plans certification |
| Reporting | A one-page profile summary for the board each quarter |
The example shows the CSF’s value as a planning and communication tool. It names gaps in plain outcome language, and then points to whichever control catalogue the organisation uses to close them.
Key terminology
- Outcome: a statement of a desired cybersecurity result, expressed as a CSF subcategory.
- Informative reference: a mapping from a CSF outcome to a specific standard, guideline or control.
- Implementation example: an illustrative, action-oriented example of achieving an outcome.
- Organisational profile: the current and/or target state of an organisation’s outcomes.
- Community profile: a shared target profile for a sector, technology or threat.
Evidence and documentation concepts
Because the CSF is outcome-based, evidence comes from the controls that deliver each outcome. Common artefacts include an asset inventory, risk register, policies and governance charters, supplier risk records, access reviews, training data, monitoring and detection coverage, incident response plans and exercise reports, and recovery test results. A well-documented profile links each subcategory to the evidence behind its rating.
Governance and accountability
The Govern function makes explicit what earlier versions implied: cybersecurity is an enterprise risk that senior leadership owns. It covers establishing the risk management strategy, assigning roles and resources, setting and enforcing policy, overseeing performance and managing cybersecurity risk in the supply chain.
Common misconceptions and pitfalls
- Treating subcategories as controls. They are outcomes. Controls come from catalogues mapped to them.
- Scoring everything to Tier 4. Tiers describe overall practice and should reflect what the organisation needs.
- Skipping the target profile. Without a target, gap analysis becomes a generic to-do list.
- One-off assessments. The CSF is designed for repeated use as risks change.
Relationship with other frameworks
| Framework | Relationship |
|---|---|
| ISO/IEC 27001 | Certifiable management system. CSF outcomes map to its clauses and Annex A controls |
| NIST SP 800-53 | Detailed control catalogue, often used to achieve CSF outcomes in US federal and other environments |
| CIS Controls | Prioritised safeguards that map to CSF subcategories |
| NIST AI RMF | Companion framework for AI risk, with a similar function and profile structure |
| NIST Privacy Framework | Privacy counterpart designed to be used alongside the CSF |
Frequently asked questions
Is NIST CSF only for US critical infrastructure?
No. Earlier versions were titled for improving critical infrastructure cybersecurity, but CSF 2.0 is explicitly intended for organisations of any size, sector or country. It is widely used internationally as a common language for cybersecurity outcomes.
What is new in CSF 2.0?
The biggest change is the new Govern function. It covers organisational context, risk management strategy, roles and responsibilities, policy, oversight and cybersecurity supply chain risk management. CSF 2.0 also reorganised categories, expanded supply-chain coverage and added online resources such as implementation examples and quick-start guides.
Can an organisation be 'CSF certified'?
No. NIST does not certify against the CSF, and there is no official CSF certification. Organisations self-assess or commission independent assessments that report against CSF outcomes, often using profiles and tiers to describe current and target states.
What are tiers?
Tiers describe how rigorous an organisation's cybersecurity risk governance and management practices are, from Tier 1 (Partial) through Tier 2 (Risk Informed) and Tier 3 (Repeatable) to Tier 4 (Adaptive). They are not maturity scores for each control, and NIST does not intend every organisation to aim for Tier 4.
Sources and official references
- Cybersecurity Framework (programme page) — National Institute of Standards and Technology (NIST) (official source)
- The NIST Cybersecurity Framework (CSF) 2.0 — NIST CSWP 29 — NIST (official source)
- Cybersecurity and Privacy Reference Tool (CSF 2.0 Core, informative references) — NIST Computer Security Resource Center (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with National Institute of Standards and Technology (NIST).
