SecurityUSA

NIST CSF 2.0

Connect cyber governance with day-to-day action

Use Netra to turn cybersecurity outcomes into owned tasks, evidence and a clearer view of progress.

Full title
The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29
Issued by
National Institute of Standards and Technology (NIST), US Department of Commerce
Published
26 February 2024. The current edition, replacing CSF 1.1 of 2018.
Applies to
Any organisation, of any size or sector, in any country. No longer framed only for critical infrastructure.
Nature
Voluntary, outcome-based framework. NIST does not certify against it. US federal agencies are required to use it.
Structure
CSF Core of 6 Functions, 22 Categories and 106 Subcategories, plus Organizational Profiles and Tiers

Overview

What NIST CSF 2.0 is

The NIST Cybersecurity Framework 2.0 is a taxonomy of high-level cybersecurity outcomes that any organisation can use to understand, assess, prioritise and communicate its cybersecurity risk. It does not say how to achieve each outcome. Instead, it links to standards, guidelines and practices that do, and leaves the choice of controls to the organisation.

The CSF Core has six Functions. Govern sits at the centre and covers context, risk management strategy, roles, policy, oversight and cybersecurity supply chain risk management. Identify, Protect, Detect, Respond and Recover describe the outcomes for understanding risk, safeguarding assets, finding attacks, acting on incidents and restoring operations. Together they contain 22 Categories and 106 Subcategories.

Compared with version 1.1, CSF 2.0 adds the Govern Function, broadens its scope from critical infrastructure to every organisation, gives supply chain risk a much larger place, and reorganises Protect, Detect and Respond around platform security, infrastructure resilience and incident management. NIST states that no 1.1 content was removed, but many outcomes were reworded, merged or moved.

CSF 2.0 is supported by online resources that NIST updates separately from the framework itself: Informative References that map the Core to other standards such as SP 800-53, Implementation Examples for each Subcategory, Quick-Start Guides for particular audiences and tasks, and Community Profiles for sectors and use cases.

Who it applies to

CSF 2.0 is designed for organisations of every size, sector and maturity. It is commonly used by:

  • Boards and executives who want a common language for cybersecurity risk
  • CISOs building or reporting on a security programme across several standards
  • Banks, insurers, healthcare and energy providers aligning with sector expectations
  • Technology and service providers answering customer questionnaires based on CSF
  • Small and medium organisations using NIST’s Quick-Start Guides
  • US federal agencies, which are required to use the Framework under Executive Order 13800

For most organisations, CSF is voluntary. Customers, sector bodies or contracts may ask for it. If your programme was built on the earlier edition, see NIST CSF 1.1.

Structure

How CSF 2.0 is organised

Six Functions and 22 Categories. The number of Subcategories in each Category is shown in brackets, 106 in total.

GV

Govern (6 Categories, 31 Subcategories)

New in 2.0. The organisation’s cybersecurity risk management strategy, expectations and policy are established, communicated and monitored.

GV.OC Organizational Context (5)
Mission, stakeholder expectations, dependencies and legal, regulatory and contractual requirements understood.
GV.RM Risk Management Strategy (7)
Priorities, constraints, risk tolerance and appetite statements, and assumptions established and used.
GV.RR Roles, Responsibilities, and Authorities (4)
Roles and accountability for cybersecurity established, with leadership responsible and adequate resources allocated.
GV.PO Policy (2)
Cybersecurity policy established, communicated, enforced, reviewed and updated.
GV.OV Oversight (3)
Results of risk management activities used to inform, improve and adjust the strategy.
GV.SC Cybersecurity Supply Chain Risk Management (10)
Supply chain risk processes identified, established, managed, monitored and improved, covering suppliers through the whole relationship.
ID

Identify (3 Categories, 21 Subcategories)

ID.AM Asset Management (7)
Hardware, software, services, systems, data and facilities identified and managed according to their importance.
ID.RA Risk Assessment (10)
Cybersecurity risk to the organisation, assets and individuals understood, including vulnerabilities, threat intelligence and likelihood and impact.
ID.IM Improvement (4)
Improvements identified from evaluations, tests, exercises and day-to-day operations across all Functions.
PR

Protect (5 Categories, 22 Subcategories)

PR.AA Identity Management, Authentication, and Access Control (6)
Access to physical and logical assets limited to authorised users, services and hardware.
PR.AT Awareness and Training (2)
Personnel given awareness and training so they can perform cybersecurity-related tasks.
PR.DS Data Security (4)
Data managed to protect confidentiality, integrity and availability, at rest, in transit and in use, with backups.
PR.PS Platform Security (6)
Hardware, software and services of physical and virtual platforms managed securely, including configuration, maintenance, logging and secure development.
PR.IR Technology Infrastructure Resilience (4)
Security architectures managed to protect assets and support resilience, including capacity and network protection.
DE

Detect (2 Categories, 11 Subcategories)

DE.CM Continuous Monitoring (5)
Networks, physical environment, personnel activity, external services and computing assets monitored for adverse events.
DE.AE Adverse Event Analysis (6)
Anomalies, indicators of compromise and other events analysed to characterise them and detect incidents.
RS

Respond (4 Categories, 13 Subcategories)

RS.MA Incident Management (5)
Responses to detected incidents managed, including triage, categorisation, prioritisation and escalation.
RS.AN Incident Analysis (4)
Investigations conducted to understand the incident and support response and recovery.
RS.CO Incident Response Reporting and Communication (2)
Response activities coordinated with internal and external stakeholders as required by laws, regulations or policies.
RS.MI Incident Mitigation (2)
Activities performed to prevent expansion of an event and mitigate its effects.
RC

Recover (2 Categories, 8 Subcategories)

RC.RP Incident Recovery Plan Execution (6)
Restoration activities performed so that affected systems and services are operational, including checking backup integrity.
RC.CO Incident Recovery Communication (2)
Restoration activities coordinated with internal and external parties.
Profiles

Organizational Profiles and Community Profiles

Current Profile
The outcomes the organisation is achieving or attempting to achieve, and how well each is being achieved.
Target Profile
The outcomes the organisation has selected and prioritised, taking account of expected changes such as new requirements or technology.
Community Profiles
Published baselines of outcomes for a sector, subsector, technology or threat, which an organisation can use as the basis for its Target Profile.
Tiers

CSF Tiers

Tiers characterise the rigour of cybersecurity risk governance practices (Govern) and risk management practices (the other five Functions). They can be applied to Organizational Profiles.

Tier 1: Partial
Strategy is ad hoc, with limited awareness of cybersecurity risk at organisational level.
Tier 2: Risk Informed
Risk management is approved by management but may not be established as organisation-wide policy.
Tier 3: Repeatable
Risk management practices are formally approved, expressed as policy and regularly updated.
Tier 4: Adaptive
Practices adapt to changing threats, and cybersecurity risk is part of organisational culture.
Resources

Online resources

Informative References
Mappings between the Core and other standards, guidelines and regulations, including NIST SP 800-53.
Implementation Examples
Notional, action-oriented examples of ways to achieve each Subcategory. They are neither required nor complete.
Quick-Start Guides
Short guides for particular audiences and tasks, such as small businesses, creating profiles, using Tiers and supply chain risk.

Implementation roadmap

How to implement it, step by step

NIST describes CSF as a continuous cycle rather than a one-time project. A practical sequence for adopting it:

  1. 1

    Scope the Organizational Profile

    Decide whether the profile covers the whole organisation or a business unit, system or service. Record the facts and assumptions that shape it.

    OutputsProfile scopeSponsor and owners
  2. 2

    Gather inputs

    Collect risk management strategy, policies, risk appetite, legal and contractual requirements, threat information and any Community Profile that fits the sector.

    OutputsInputs registerApplicable requirements
  3. 3

    Create the Current Profile

    For each relevant Subcategory, record what is being achieved and how well, with evidence. Govern outcomes are often the least documented and need attention first.

    OutputsCurrent Profile
  4. 4

    Create the Target Profile

    Select and prioritise the outcomes the organisation needs, guided by risk tolerance and expected change. Choose target Tiers for governance and management practices.

    OutputsTarget ProfileTarget Tiers
  5. 5

    Analyse gaps and plan

    Compare the profiles, assess the risk of each gap, and turn the priorities into an action plan with owners, resources and dates.

    OutputsGap analysisPrioritised action plan
  6. 6

    Implement and connect to controls

    Use Informative References to select controls from SP 800-53, ISO/IEC 27001 or other standards to achieve the target outcomes.

    OutputsControl mappingImplementation records
  7. 7

    Report and oversee

    Report progress to leadership using CSF language, so that oversight under GV.OV feeds back into strategy.

    OutputsBoard reportOversight decisions
  8. 8

    Repeat the cycle

    Update the profiles when risk, requirements or technology change, and feed lessons from incidents and exercises into Improvement (ID.IM).

    OutputsUpdated profilesImprovement log

Audit and evidence guide

What auditors look for, and the evidence to keep

NIST does not certify CSF implementations and has no conformity assessment programme. Organisations assess themselves, or ask internal audit or a third party to assess them using CSF as the reference. Reviewers look for evidence that the outcomes claimed are actually achieved.

What reviewers look for

  • Govern outcomes: risk appetite, roles, policy and oversight approved by leadership
  • A Current Profile backed by evidence, not self-scoring alone
  • A Target Profile tied to business priorities and requirements
  • Supply chain risk management across the supplier life cycle (GV.SC)
  • Asset inventories that cover hardware, software, services and data
  • Risk assessments that use vulnerability and threat information
  • Incident management, analysis, reporting and recovery in practice
  • Improvement actions arising from tests, exercises and incidents
  • How Tiers were assessed and what would move them

Key dates and cycles

CSF 2.0 published26 February 2024
CSF 1.1, previous edition16 April 2018
Organizational Profile reviewAs the organisation decides
Policy review (GV.PO)As the organisation decides
Leadership oversight (GV.OV)As governance sets

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Govern

  • Risk management strategy and appetite
  • Roles and responsibilities
  • Approved policies
  • Oversight minutes
  • Supplier risk records

Identify

  • Asset and data inventories
  • Risk assessments
  • Vulnerability records
  • Improvement log

Protect

  • Access and authentication records
  • Training completion
  • Configuration baselines
  • Backup records

Detect

  • Monitoring coverage
  • Event analysis records
  • Indicators of compromise handled

Respond

  • Incident response plan
  • Incident tickets and triage
  • Notifications made

Recover

  • Recovery plan
  • Restoration records
  • Backup integrity checks

Profiles

  • Current Profile
  • Target Profile
  • Gap analysis
  • Action plan

Areas that often need attention

  • No documented risk appetite or tolerance under Govern
  • Supply chain risk handled only at contract signature
  • Profiles scored by opinion without linked evidence
  • Asset inventories that miss cloud services and data
  • Incident plans that have not been exercised
  • Leadership reports that do not drive decisions
  • Status from a 1.1 assessment carried into 2.0 without review

How Netra helps

Where each part of the work lives in Netra

Netra loads CSF 2.0 outcomes as requirements, tasks and policies. Work done for them also counts towards other frameworks wherever the same control applies.

Outcomes owned and tracked

Task Engine

Subcategory outcomes arrive as tasks with owners and due dates, and recurring tasks keep evidence current.

Current and target position for each Function

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, so every figure traces back to the work.

Govern: policy (GV.PO)

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

Govern and Identify: risk

Risk Manager

A risk register with inherent and residual heatmaps, with risks reduced as linked tasks complete.

Supply chain risk (GV.SC)

Third-Party Risk

Finds vendors from what Accounts and Purchase pay, assesses them through a vendor portal and records decisions with ratings.

Asset management (ID.AM)

Asset Management

Assets linked to tasks, so teams know which outcomes and evidence apply to which systems.

Oversight and board reporting (GV.OV)

Dashboard & Reports

A live Posture Score and a one-click board report for the framework.

Independent assessment

Audit Centre

Run internal or external assessments end to end, with findings and corrective actions, using evidence held in a tamper-evident vault.

Netra organises work and evidence against CSF outcomes. It does not by itself establish that an outcome is achieved, and it is not a SIEM or an incident response service. There is no NIST certification for CSF.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

NIST CSF 1.1

Keep your CSF 1.1 programme traceable during transition

Security

NIST SP 800-53

Organise a tailored security and privacy control programme

Security

CIS v8.1

Give your security safeguards a clear operational home

See NIST CSF 2.0 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.