SecurityUSA

NIST CSF 1.1

Keep your CSF 1.1 programme traceable during transition

Preserve existing cyber-risk work and organise the move towards a newer framework structure.

Version note. This page covers NIST CSF 1.1, an earlier edition. NIST CSF 2.0 is the current edition. See NIST CSF 2.0

Full title
Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1
Issued by
National Institute of Standards and Technology (NIST), US Department of Commerce
Published
16 April 2018. Superseded as the current edition by CSF 2.0 on 26 February 2024.
Applies to
Written for US critical infrastructure, and used voluntarily by organisations of every size and sector worldwide
Nature
Voluntary, outcome-based framework. NIST does not certify against it.
Structure
Framework Core of 5 Functions, 23 Categories and 108 Subcategories, plus Implementation Tiers and Profiles

Overview

What NIST CSF 1.1 is

The Framework for Improving Critical Infrastructure Cybersecurity, known as the NIST Cybersecurity Framework or CSF, gives organisations a common language for describing and managing cybersecurity risk. Version 1.1 was published by NIST on 16 April 2018, refining the original 2014 version. It does not prescribe specific technologies. It describes outcomes, and points to existing standards for how to achieve them.

The framework has three parts. The Core organises cybersecurity outcomes into five Functions: Identify, Protect, Detect, Respond and Recover, broken down into 23 Categories and 108 Subcategories, each linked to Informative References such as ISO/IEC 27001:2013, NIST SP 800-53 Rev. 4, COBIT 5, ISA 62443 and the CIS Controls. The Implementation Tiers describe how rigorous and integrated an organisation’s risk management is. Profiles describe a current state and a target state, so that the gap between them becomes a prioritised plan.

Version 1.1 added a section on self-assessing cybersecurity risk, expanded guidance on supply chain risk management with a new Supply Chain Risk Management Category, refined the language on authentication, authorisation and identity proofing, added a Subcategory on the vulnerability disclosure life cycle, and explained more clearly how Tiers relate to Profiles.

NIST published NIST CSF 2.0 on 26 February 2024, and that is now the current edition. NIST states that no content was removed in moving to 2.0, so the meaning of the 1.1 outcomes carries into the new structure, although identifiers and groupings changed. This page is for organisations whose contracts, assessments or existing profiles still refer to 1.1, and for planning the move to 2.0.

Who it applies to

CSF 1.1 was written for US critical infrastructure but was designed for any organisation. Organisations still working with it include:

  • Organisations with a Current and Target Profile built on 1.1 that are mid-way through an improvement programme
  • Suppliers whose customer contracts or questionnaires still reference CSF 1.1 outcomes
  • Teams holding historical assessments, board reports or maturity scores expressed in 1.1 terms
  • Sector programmes and regulators’ guidance that were mapped to 1.1 and have not yet been updated
  • Organisations planning a structured transition to CSF 2.0

CSF is voluntary. Under Executive Order 13800 of 2017, US federal agencies are required to use the Framework to manage cybersecurity risk. For a new programme, NIST’s current edition is NIST CSF 2.0.

Structure

How CSF 1.1 is organised

Five Functions and 23 Categories in the Core, with 108 Subcategories underneath them, followed by Implementation Tiers and Profiles.

ID

Identify (6 Categories)

Understanding the business context, the resources that support critical functions and the related cybersecurity risks.

ID.AM Asset Management
Data, personnel, devices, systems and facilities identified and managed according to their importance.
ID.BE Business Environment
The organisation’s mission, objectives, stakeholders and activities understood and prioritised.
ID.GV Governance
Policies, procedures and processes to manage and monitor regulatory, legal, risk and operational requirements.
ID.RA Risk Assessment
Cybersecurity risk to operations, assets and individuals understood.
ID.RM Risk Management Strategy
Priorities, constraints, risk tolerances and assumptions established and used for operational risk decisions.
ID.SC Supply Chain Risk Management
New in 1.1: processes to identify, assess and manage supply chain risk, including assessment of suppliers and third-party partners.
PR

Protect (6 Categories)

Safeguards that ensure delivery of critical services.

PR.AC Identity management and access control
Access to assets limited to authorised users, processes and devices. Refined in 1.1 to cover authentication and identity proofing.
PR.AT Awareness and Training
Personnel and partners given cybersecurity awareness education and trained for their duties.
PR.DS Data Security
Information and records managed to protect confidentiality, integrity and availability.
PR.IP Information Protection Processes and Procedures
Security policies, processes and procedures maintained, including baselines, backups, response and recovery plans.
PR.MA Maintenance
Maintenance and repairs of system components performed and controlled.
PR.PT Protective Technology
Technical security solutions managed in line with policies and procedures.
DE

Detect (3 Categories)

DE.AE Anomalies and Events
Anomalous activity detected and its potential impact understood.
DE.CM Security Continuous Monitoring
Systems and assets monitored to identify cybersecurity events and verify protective measures.
DE.DP Detection Processes
Detection processes and procedures maintained and tested.
RS

Respond (5 Categories)

RS.RP Response Planning
Response processes and procedures executed and maintained.
RS.CO Communications
Response activities coordinated with internal and external stakeholders, including law enforcement where appropriate.
RS.AN Analysis
Analysis to ensure effective response and support recovery, including the vulnerability disclosure Subcategory added in 1.1.
RS.MI Mitigation
Activities to prevent expansion of an event, mitigate its effects and resolve the incident.
RS.IM Improvements
Response activities improved by lessons learned.
RC

Recover (3 Categories)

RC.RP Recovery Planning
Recovery processes and procedures executed and maintained.
RC.IM Improvements
Recovery planning and processes improved by lessons learned.
RC.CO Communications
Restoration activities coordinated with internal and external parties.
Tiers

Implementation Tiers

Tiers describe how an organisation views and manages cybersecurity risk across three aspects: the risk management process, the integrated risk management programme, and external participation. They are not maturity levels to be reached for their own sake.

Tier 1: Partial
Risk management is ad hoc and reactive, with limited awareness at organisational level.
Tier 2: Risk Informed
Practices are approved by management but may not be established as organisation-wide policy.
Tier 3: Repeatable
Practices are formally approved as policy and regularly updated as requirements and threats change.
Tier 4: Adaptive
Practices adapt based on lessons learned and predictive indicators, as part of the organisational culture.
Profiles

Profiles and how to use the framework

Current and Target Profiles
A Current Profile records the outcomes being achieved now. A Target Profile records the outcomes needed. Comparing them reveals the gaps to address.
Seven-step programme (Section 3.2)
Prioritise and scope, orient, create a Current Profile, conduct a risk assessment, create a Target Profile, determine, analyse and prioritise gaps, and implement an action plan.
Buying decisions (Section 3.4)
New in 1.1: using the framework to express cybersecurity requirements to suppliers and in purchasing.
Self-assessment (Section 4)
New in 1.1: self-assessing cybersecurity risk with the framework and measuring its effectiveness.

Implementation roadmap

How to implement it, step by step

For an organisation already working with CSF 1.1, the priority is to keep the record traceable and move to CSF 2.0 in a controlled way.

  1. 1

    Confirm why 1.1 is still in use

    Check whether a contract, customer, sector programme or internal commitment specifically requires 1.1, or whether the organisation simply has not moved yet.

    OutputsRequirement source noteDecision on target edition
  2. 2

    Preserve the existing profiles

    Freeze a dated copy of the Current and Target Profiles, Tier assessments and the evidence behind them, so past board reports and assessments remain explainable.

    OutputsBaseline Current ProfileBaseline Target Profile
  3. 3

    Close or re-plan open actions

    Review the improvement plan. Finish actions near completion, and re-plan the rest against outcomes rather than 1.1 identifiers.

    OutputsUpdated action plan
  4. 4

    Map 1.1 outcomes to CSF 2.0

    Use NIST’s published material on the 2.0 Core, which shows where 1.1 elements moved, to map each Subcategory to its 2.0 equivalent. Review each mapping rather than assuming it transfers unchanged.

    Outputs1.1 to 2.0 mappingReview notes
  5. 5

    Address the Govern function

    CSF 2.0 brings governance, risk strategy, roles, policy, oversight and supply chain risk together under Govern. Identify what the 1.1 programme already covers and what is new.

    OutputsGovern gap list
  6. 6

    Build the 2.0 profiles

    Create Current and Target Organizational Profiles under 2.0, reusing evidence where the outcome is the same, and set priorities for the gaps.

    OutputsCSF 2.0 Current ProfileCSF 2.0 Target Profile
  7. 7

    Report the transition to leadership

    Explain to the board how the picture changes between editions, so that a change in structure is not mistaken for a change in posture.

    OutputsTransition briefing

Audit and evidence guide

What auditors look for, and the evidence to keep

NIST does not certify CSF implementations and has no conformity assessment programme. Reviews against CSF 1.1 are self-assessments, internal audits, customer reviews or third-party assessments using the framework as a reference.

What reviewers look for

  • A documented Current Profile with evidence for the outcomes claimed
  • A Target Profile linked to business priorities and risk tolerance
  • How the Implementation Tier was assessed, and on what basis
  • A prioritised action plan with owners and dates
  • Asset inventories and data flows supporting ID.AM
  • Supplier and third-party risk assessments under ID.SC
  • Response and recovery plans that have been tested
  • Lessons learned feeding back into improvements
  • Traceability from each Subcategory to the policies and controls behind it

Key dates and cycles

CSF 1.0 publishedFebruary 2014
CSF 1.1 published16 April 2018
CSF 2.0 published26 February 2024
Profile and Tier reviewAs the organisation decides
Response and recovery plan testingAs the organisation decides

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Profiles

  • Current Profile
  • Target Profile
  • Gap analysis
  • Tier assessment

Identify

  • Asset inventory
  • Business impact and priorities
  • Risk assessment
  • Supplier assessments

Protect

  • Access reviews
  • Training records
  • Configuration baselines
  • Backup records

Detect

  • Monitoring coverage
  • Alert and event records
  • Detection process tests

Respond and Recover

  • Incident response plan
  • Incident records
  • Recovery tests
  • Lessons learned

Governance

  • Policies
  • Roles and responsibilities
  • Improvement plan and progress

Areas that often need attention

  • Profiles written once and never updated
  • Tier ratings treated as maturity scores without supporting evidence
  • Subcategories marked as achieved with no traceable evidence
  • Supply chain outcomes under ID.SC left unaddressed
  • Response and recovery plans that have never been exercised
  • Old 1.1 status carried into a CSF 2.0 report without review

How Netra helps

Where each part of the work lives in Netra

Netra keeps CSF 1.1 outcomes, tasks and evidence on one record, so an existing programme stays traceable while it moves to CSF 2.0.

Outcomes owned and tracked

Task Engine

Subcategory outcomes arrive as tasks with owners and due dates, and recurring tasks keep evidence current.

Status for each Function and Category

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, and one task can count towards CSF 2.0 and other frameworks where the work is the same.

Governance and policies

Policy Hub

A policy library generated at onboarding, with a policy score that moves as the work behind each policy is done.

Risk assessment and priorities

Risk Manager

A risk register with inherent and residual heatmaps, with risks reduced as linked tasks complete.

Supply chain risk (ID.SC)

Third-Party Risk

Finds vendors from what Accounts and Purchase pay, assesses them through a vendor portal and records decisions with ratings.

Asset outcomes (ID.AM)

Asset Management

Assets linked to the tasks that protect them.

Leadership reporting

Dashboard & Reports

A live Posture Score and a one-click board report for the framework.

Netra organises the work and evidence. It does not by itself establish that any outcome is achieved, and it does not convert 1.1 status into 2.0 status automatically. Mappings between editions should be reviewed by your team.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

NIST CSF 2.0

Connect cyber governance with day-to-day action

Security

NIST SP 800-53

Organise a tailored security and privacy control programme

Security

CIS v8

Keep essential cyber hygiene owned and evidenced

See NIST CSF 1.1 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.