NIST Cybersecurity Framework 2.0 Explained

NIST Cybersecurity Framework

The NIST Cybersecurity Framework (CSF) is a widely used way to describe, assess, and improve how an organization manages cybersecurity risk. Rather than prescribing specific controls, it lists outcomes — "identities and credentials are managed", "the incident response plan is executed" — organized into a hierarchy that executives, security teams, and engineers can share. Organizations use it to understand where they stand, decide where they want to be, and plan the work in between.

Version 2.0, published in February 2024, broadened the framework from critical infrastructure to organizations of every size and sector and added a sixth Function, Govern, placing cybersecurity strategy, roles, policy, and supply chain risk at the center. CSF is voluntary and not a certification, but it is often the backbone that connects regulatory requirements, audits, and technical security work.

TL;DR

CSF 2.0 has six Functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Functions contain Categories and Subcategories — specific, technology-neutral outcomes.
Profiles describe current and target states; the difference drives a prioritized roadmap.
Tiers (Partial, Risk Informed, Repeatable, Adaptive) characterize the rigor of risk governance and management.
Informative references map outcomes to detailed control sets such as NIST SP 800-53, CIS Controls, and ISO/IEC 27001.
The value comes from mapping outcomes to owners, controls, and evidence, not from the framework document itself.

Quick Example

A slice of an organizational profile, kept in version control so owners can update it:

Each row turns an abstract outcome into an owner, a measurable target, and evidence that can be checked.

Core Concepts

The Six Functions

Govern sits at the center: it informs how the other five Functions are prioritized and resourced.

Categories and Subcategories

Each Category breaks into Subcategories — around a hundred in CSF 2.0 — identified by codes such as PR.AA-01 or RS.MA-01. Subcategories describe what should be achieved, not how. NIST publishes implementation examples with concrete illustrations for each.

Profiles

A Current Profile records which outcomes the organization achieves today; a Target Profile records the outcomes it intends to achieve, given its risks, obligations, and resources. Community Profiles published for sectors or technologies provide starting targets. The gap between current and target is the improvement plan.

Tiers

Tiers describe rigor and integration, not a score to maximize everywhere; choose target Tiers that fit the organization's risk.

Informative References

Outcomes map to detailed controls in other frameworks — NIST SP 800-53, the CIS Critical Security Controls, ISO/IEC 27001 — through NIST's online reference tool. This lets one control implementation satisfy several frameworks and makes CSF a translation layer between them.

Using CSF in Practice

Scope: decide whether the profile covers the whole organization, a business unit, or a product.
Assess current state with interviews, documentation, and technical evidence — not self-assessment alone.
Set the target profile based on risk assessments, regulations, customer requirements, and threat models. See Threat Modeling.
Prioritize gaps by risk reduction and cost; turn them into funded projects with owners and dates.
Map to controls and evidence: for each outcome, which technical controls achieve it and what proves they work.
Report and iterate: share progress with leadership in Function-level terms and reassess regularly.

Connecting Outcomes to Engineering

Automated evidence collection keeps profiles current and audits cheap. See Vulnerability Management and Security Incident Response.

CSF, ISO 27001, and SOC 2

Many organizations use CSF to organize their program and map it to ISO 27001 or SOC 2 controls for certification and customer assurance. See SOC 2 Compliance.

Best Practices

Start With Govern

Clarify risk appetite, roles, policies, and supply chain expectations first; without them, improvements in other Functions lack direction and funding.

Assign an Owner to Every Outcome

Outcomes without owners do not improve. Name a team for each subcategory in scope.

Measure With Evidence

Base current-state ratings on evidence — reports, logs, test results — rather than opinions, and automate collection where possible.

Keep the Profile Living

Store profiles where owners can update them, review them on a cadence, and tie them to the security roadmap and budget.

Common Mistakes

Treating CSF as a Checklist

Aiming for Tier 4 Everywhere

Profiles Without Evidence

FAQ

What is the NIST Cybersecurity Framework?

A voluntary framework from the U.S. National Institute of Standards and Technology that organizes cybersecurity risk management into outcomes under six Functions — Govern, Identify, Protect, Detect, Respond, and Recover — used to assess current posture and plan improvements.

What changed in CSF 2.0?

Version 2.0, released in 2024, added the Govern Function, broadened the framework's scope to all organizations, restructured categories, strengthened supply chain risk management, and added implementation examples, quick-start guides, and online reference mappings.

Is NIST CSF a certification?

No. There is no CSF certification. Organizations use it for self-assessment, planning, and communication, and often pair it with certifiable or attestable standards such as ISO/IEC 27001 or SOC 2.

What is a CSF Profile?

A description of an organization's cybersecurity outcomes — a Current Profile for what is achieved today and a Target Profile for what it intends to achieve — used to identify and prioritize gaps.

How does CSF relate to NIST SP 800-53?

CSF describes high-level outcomes; SP 800-53 is a detailed catalog of security and privacy controls. CSF's informative references map its outcomes to SP 800-53 controls, among other frameworks.