NIST CSF 2.0,
explained plainly

The NIST Cybersecurity Framework (CSF) is a voluntary framework for organizing, understanding and improving your cybersecurity. It was created by the US National Institute of Standards and Technology, and version 2.0 was published in February 2024. It is not a regulation, and crucially it is not a standard you certify against: there is no NIST CSF audit, no exam, and no certificate to hang on the wall.

Because of that, the language around CSF is different from a certifiable standard. You do not "pass" NIST CSF, and nobody "fails" it. You adopt it, you align to it, and you build a profile against it. Its job is to give you a shared structure and vocabulary for cybersecurity, a way to describe what good looks like, see where you stand, and decide what to improve next, rather than a fixed bar an auditor checks you over.

The original 2014 framework was aimed at operators of US critical infrastructure. Version 2.0 deliberately broadened that audience: it is now written for organizations of all sizes and every sector, anywhere in the world. A small European software company can use CSF just as readily as a large US utility, and increasingly does, because the structure travels well even though the framework itself is American in origin.

The heart of CSF is the Core, and the top level of the Core is six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Read together they describe the full lifecycle of managing cybersecurity risk — from setting strategy, through understanding and protecting what matters, to spotting, responding to and recovering from incidents.

The headline change in 2.0 is Govern. Earlier versions had five Functions; 2.0 adds Govern as a sixth, and places it at the centre rather than the end. Govern covers the cybersecurity strategy, the roles and responsibilities, the policies and the oversight that hold the whole program together — the decisions leadership owns. By naming it explicitly, CSF 2.0 makes the point that cybersecurity is a governance and risk-management problem, not just a technical one.

The other five Functions each address a distinct part of the lifecycle. Identify is about understanding your assets, your risks and your context. Protect covers the safeguards that reduce the likelihood or impact of an incident. Detect is about noticing that something has happened. Respond is what you do when it does, and Recover is how you restore normal operations and learn from it afterwards. None stands alone; a healthy program touches all six.

Each Function is broken down into Categories, and each Category into Subcategories. This is where the framework gets specific — but specific about results, not methods. A Subcategory states an outcome to achieve, written as something that should be true: an asset inventory is maintained, access is managed, events are analyzed. It does not tell you which tool to buy or exactly how to do it.

That outcome-based design is deliberate, and it is the most important thing to understand about the Core. Because Subcategories describe what good looks like rather than prescribing how, the same framework fits a two-person startup and a multinational. You decide which controls and practices satisfy each outcome in your context; CSF just tells you which outcomes matter and how they fit together.

Alongside the Core, CSF offers Implementation Tiers as a way to describe how mature and risk-informed your cybersecurity practices are. There are four: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive. They run from ad hoc and reactive at Tier 1 to consistent, well-governed and continuously improving at Tier 4.

It is important not to read Tiers as a score or a target to max out. A higher Tier is not automatically "better" for every organization — the right Tier is the one that matches your risk, your resources and what your context demands. A small low-risk team operating well at Tier 2 may be exactly where it should be. Tiers are a gauge to inform a conversation about how rigorously you want to manage cyber risk, not a grade you are chasing.

Profiles are how CSF turns the Core into a plan. A Profile is your selection of the Functions, Categories and Subcategories that matter for your organization, together with where you stand on each. You build two: a Current Profile that honestly captures your security outcomes as they are today, and a Target Profile that describes where you want or need to be.

The gap between the two is the whole point. Lay the Current Profile next to the Target Profile and the differences become a prioritized list of improvements — a roadmap grounded in your own risk and resources rather than someone else's checklist. As you close gaps, you update the Current Profile, and the framework becomes a living record of progress rather than a one-off assessment.

This is also where CSF earns its keep across stakeholders. A Profile is concrete enough to brief a board, scope a budget, or align a security team and leadership on the same priorities — without anyone needing to read the full framework first.

If you have used the older framework, three changes in 2.0 matter most. The first is the new Govern Function, which we have already covered — it elevates strategy, roles, policy and oversight into a Function of their own and puts governance at the centre of the model.

The second is scope. The 2014 framework was framed around US critical infrastructure; 2.0 explicitly widens the audience to organizations of every size and sector, anywhere. The framework text reads as something a small company or a non-US organization can adopt without translation, which it largely was not before.

The third is the supporting material. NIST paired 2.0 with more practical resources — quick-start guides, implementation examples and reference tools, all designed to make the framework easier to actually use rather than just read. The Core became more usable, and the surrounding scaffolding grew up around it.

Because CSF is outcome-based and maps to other standards through its informative references, many teams use it as the organizing backbone of their security program rather than as a destination. CSF gives you the structure, the Functions and outcomes, and you certify against ISO 27001 or attest to SOC 2 underneath it, where a customer or tender specifically needs that proof.

This works well because the frameworks are complementary, not competing. CSF answers "how is our whole program organized and where are the gaps?" in language a board understands. ISO 27001 and SOC 2 answer "can we prove to a third party that specific controls operate?" Run CSF on top, map its outcomes down to your ISO or SOC controls, and one body of evidence serves both the internal roadmap and the external attestation.

In practice the order varies. Some teams adopt CSF first to get their bearings, then pursue a certificate once they know what their program looks like. Others already hold ISO 27001 or a SOC 2 report and overlay CSF to give leadership a clearer, risk-based view across the whole estate. Either way, doing the mapping once is what keeps the second framework from being a second full project.

The flip side of "no certificate" is a fair question: if nobody hands you a pass, how do you show anyone you are taking cybersecurity seriously? The answer is your Profiles and your Tier. A Current Profile that shows which outcomes you have achieved, a Target Profile that shows where you are heading, and the trend between them over time is a credible, honest picture of a managed program — often more informative than a binary certificate.

This is what you put in front of a customer, a partner or your own board. It demonstrates that you have assessed your risks, chosen outcomes deliberately, and are improving against a plan. Many organizations also use a CSF Profile as the internal map and then layer a certificate like ISO 27001 on top when a specific deal requires third-party assurance — the Profile shows the program, the certificate proves a slice of it.

The lightest way to begin is to build a rough Current Profile. Walk the six Functions and, for the Categories that matter to you, note honestly where you stand. You do not need to address every Subcategory on day one — the value is in getting an organized, end-to-end picture instead of a scattered list of security tasks.

From there, define a Target Profile that reflects your risk and resources — and pick a realistic Tier to aim for, not the highest one available. The gap between Current and Target becomes your prioritized roadmap, and the work shifts to closing it and keeping the Current Profile honest as you go. Because CSF is voluntary and outcome-based, you can move at your own pace and shape it to your context; the framework rewards a living program far more than a one-time assessment filed away.