NIST CSF 2.0: The Cybersecurity Framework Explained

The NIST Cybersecurity Framework (CSF) is a voluntary framework from the US National Institute of Standards and Technology that helps organisations understand and reduce cybersecurity risk. The current version, CSF 2.0, was released on 26 February 2024. It is free, technology-neutral and used by companies of every size in many countries. There is no NIST CSF certificate.

What is the NIST CSF?

The CSF describes cybersecurity outcomes, not specific controls. It tells you what good looks like (“users are authenticated”, “incidents are contained”) and leaves you to decide how to achieve it. It has three parts:

NIST also publishes informative references that map each subcategory to controls in other frameworks such as NIST SP 800-53, ISO 27001 and the CIS Controls, plus implementation examples and quick-start guides.

History and why it was introduced

CSF 2.0 was introduced to reflect that cybersecurity is a board-level business risk, that supply chains are a major source of risk, and that organisations of all sizes, not only critical infrastructure, were already using the framework.

Main objectives:

1. Give a common language for cybersecurity risk across technical and business teams.
2. Help organisations prioritise improvements based on risk and resources.
3. Align with existing standards instead of replacing them.
4. Make governance and supply chain risk explicit.

Who uses the NIST CSF?

Is the NIST CSF mandatory?

The CSF itself is voluntary. It becomes required when:

• a contract or customer security schedule requires alignment with it;
• a sector regulator or state law refers to it (several US state laws give a defence or safe harbour to companies that follow recognised frameworks such as NIST CSF);
• you are a US federal agency, where policy directs agencies to use it for risk management.

Key requirements: the CSF 2.0 Core

There are 22 categories and 106 subcategories. Govern sits at the centre: it informs how you prioritise and carry out the other five functions.

Profiles and tiers

• A current profile shows which outcomes you achieve today and how well.
• A target profile shows the outcomes you want to reach, based on risk, business needs and requirements.
• Community profiles are published for sectors or use cases and can be used as a starting point.
• Tiers describe how your organisation governs and manages risk: Partial (1), Risk Informed (2), Repeatable (3) and Adaptive (4). Higher isn’t always better; choose what fits your risk.

How to implement the NIST CSF

1. Set scope. The whole company or a product, business unit or system.
2. Gather information: business priorities, legal and contractual requirements, risk appetite, existing controls and recent incidents.
3. Create a current profile. For each relevant subcategory, record your current state. Many organisations use a maturity score per subcategory.
4. Create a target profile based on risk and requirements.
5. Analyse gaps between current and target and estimate the effort to close them.
6. Build an action plan with owners, budgets and dates. Prioritise high-risk gaps.
7. Implement, using informative references such as NIST SP 800-53 or CIS Controls to choose specific controls.
8. Measure and report progress to leadership regularly, and refresh profiles at least yearly.

NIST’s quick-start guides for small businesses, enterprise risk management and supply chain risk make useful starting points.

Documentation and policies

The CSF doesn’t prescribe documents. Organisations typically keep:

• Cybersecurity strategy and risk appetite statement
• Roles and responsibilities (RACI)
• Information security policy and supporting policies
• Asset inventory (hardware, software, data, services, suppliers)
• Risk register and risk assessments
• Current and target profiles, and the improvement plan
• Supplier risk management procedure
• Incident response and recovery plans
• Training records
• Metrics and board reports

Audits and assessments

There is no official NIST CSF certification or accredited audit scheme. Organisations demonstrate alignment through:

• Self-assessments against the profiles.
• Third-party assessments by consultants or auditors, producing a maturity report.
• Related certifications or reports, such as ISO 27001 or SOC 2, mapped to the CSF.
• SOC for Cybersecurity reports, an AICPA attestation that can use the CSF as its criteria.

Be cautious of any “NIST CSF certified” claim. It can only mean an assessment by a third party, not a NIST certification.

Cost

Benefits

• Free, flexible and widely recognised.
• Gives the board a clear picture through six functions.
• Helps prioritise spending by risk.
• Maps to most other frameworks, so work is reusable.
• Govern function makes accountability and supply chain risk explicit.

Risks of ignoring it

• Unstructured security programmes that overspend in some areas and leave gaps in others.
• Harder conversations with US customers, insurers and regulators who use CSF terms.
• Missed safe-harbour benefits under some US state laws.

Common mistakes

• Treating subcategories as controls. They are outcomes; you still need to choose controls.
• Aiming for Tier 4 everywhere, which is costly and rarely justified.
• Skipping Govern and jumping straight to technical controls.
• One-off assessments that are never refreshed.
• Claiming certification, which doesn’t exist.

Challenges for IT companies

• Translating outcome language into concrete engineering tasks.
• Measuring maturity consistently across teams.
• Including suppliers and open-source dependencies in supply chain risk.
• Mapping to customer frameworks such as ISO 27001 and SOC 2 at the same time.

Best practices

• Use the CSF as your top-level structure, and ISO 27002, NIST SP 800-53 or CIS Controls for control detail.
• Keep profiles short and focused on what matters to your business.
• Report to leadership using the six functions.
• Review profiles after major incidents, acquisitions or product launches.
• Use the NIST CSF 2.0 Reference Tool to browse and export mappings.

Tools that help

How the NIST CSF relates to other frameworks

Real-world examples

• US federal agencies use the CSF to structure their annual FISMA reporting.
• US state law safe harbours. Ohio’s Data Protection Act (2018), for example, gives an affirmative defence to businesses whose security programme reasonably conforms to an industry framework such as the NIST CSF.
• Illustrative scenario, not a real company: a 120-person SaaS company uses CSF 2.0 to brief its board. It scores current and target profiles, finds gaps in supply chain risk and recovery testing, and funds a six-month plan that also prepares it for ISO 27001.

Frequently asked questions

Is NIST CSF mandatory? No. It is voluntary, though contracts and some regulators require or reference it.

What is new in NIST CSF 2.0? The Govern function, broader scope for all organisations, more on supply chain risk, and new implementation examples and quick-start guides.

What are the six functions? Govern, Identify, Protect, Detect, Respond and Recover.

Can a company be NIST CSF certified? No. There is no official certification. Third parties can assess alignment.

Is NIST CSF only for US companies? No. It is used worldwide and translated into several languages.

How does NIST CSF compare with ISO 27001? The CSF is a flexible outcome framework with no certificate. ISO 27001 is a certifiable management system. Many companies use both.

Is NIST CSF free? Yes. NIST publishes it and its resources at no cost.

Next steps

• Choose the scope for your first profile.
• Score your current state against the 22 categories.
• Agree a target profile with leadership.
• Build a prioritised action plan and pick a control catalogue to implement it.