NIST Cybersecurity Framework 2.0: Functions, Profiles and How to Use It

The NIST Cybersecurity Framework (CSF) is the most widely used voluntary framework for organising a cybersecurity programme. It does not tell you which products to buy or which settings to apply. It describes the outcomes a well-run programme achieves, grouped into six functions, and gives you a way to describe where you are today, where you want to be, and what to do next.

Version 2.0, published by the US National Institute of Standards and Technology in February 2024, made two big changes: it added a sixth function, Govern, which puts cybersecurity strategy, roles, policy and supply chain risk at the top, and it was rewritten for every kind of organisation, not just critical infrastructure. This guide explains the structure, how to build profiles and use tiers, how IT companies can adopt it without a large team, and how it maps to ISO/IEC 27001, SOC 2 and the NIST control catalogues.

What is the NIST Cybersecurity Framework?

The CSF is published by NIST, an agency of the US Department of Commerce, as NIST Cybersecurity White Paper 29. It has three parts:

• The CSF Core: a taxonomy of cybersecurity outcomes organised as functions, categories and subcategories.
• CSF Organizational Profiles: descriptions of an organisation's current or target cybersecurity posture in terms of Core outcomes.
• CSF Tiers: a way to characterise how rigorous an organisation's cybersecurity risk governance and management practices are.

Around the core document, NIST publishes online companion resources: implementation examples for each subcategory, informative references that map subcategories to other standards (such as NIST SP 800-53, ISO/IEC 27001 and the CIS Controls), quick-start guides for small businesses and other audiences, and community profiles for sectors. These live in NIST's Cybersecurity and Privacy Reference Tool so they can be updated without changing the framework itself.

History and why it was introduced

In February 2013, US Executive Order 13636 directed NIST to work with industry to develop a voluntary framework to reduce cybersecurity risk to critical infrastructure. NIST ran public workshops and published version 1.0 in February 2014. The Cybersecurity Enhancement Act of 2014 gave NIST an ongoing role in facilitating and supporting it. Version 1.1 followed in April 2018, adding supply chain risk management and clarifying self-assessment. Version 2.0 was published on 26 February 2024 after a multi-year public process.

The reason for a framework rather than a regulation was practical. Critical infrastructure owners range from tiny water utilities to global banks, and prescriptive rules would not fit them all. A common, outcome-based language lets organisations decide what they need, lets executives and engineers talk about the same thing, and lets regulators and customers ask about security without inventing new checklists. Its adoption spread far beyond critical infrastructure, which version 2.0 formally recognised.

Who uses the NIST CSF?

The CSF is voluntary for private organisations everywhere. It is used by:

• US companies of all sizes as the backbone of their security programme and board reporting.
• IT service providers, MSPs and SaaS companies that need a structured answer to customers' security questions.
• Suppliers to US federal agencies, where federal policy and some contracts reference the CSF.
• Organisations outside the US: the CSF has been translated into several languages and adopted by organisations and some governments as a reference.

Mandatory status. No general law requires private companies to adopt the CSF. US federal agencies are directed by policy to manage cybersecurity risk using it, and some sector regulators and state laws refer to it or recognise it. Where a contract requires it, it becomes a contractual obligation. If your contract requires specific controls, that usually means NIST SP 800-53 or NIST SP 800-171 rather than the CSF itself.

The six functions and 22 categories

CSF 2.0 has 6 functions, 22 categories and 106 subcategories. Each subcategory is a specific outcome, for example "Inventories of hardware managed by the organization are maintained" (ID.AM-01).

Function	Purpose	Categories
Govern (GV)	Establish, communicate and monitor cybersecurity risk management strategy, expectations and policy	Organizational Context, Risk Management Strategy, Roles Responsibilities and Authorities, Policy, Oversight, Cybersecurity Supply Chain Risk Management
Identify (ID)	Understand current cybersecurity risks	Asset Management, Risk Assessment, Improvement
Protect (PR)	Use safeguards to manage risks	Identity Management Authentication and Access Control, Awareness and Training, Data Security, Platform Security, Technology Infrastructure Resilience
Detect (DE)	Find and analyse possible attacks and compromises	Continuous Monitoring, Adverse Event Analysis
Respond (RS)	Take action on a detected incident	Incident Management, Incident Analysis, Incident Response Reporting and Communication, Incident Mitigation
Recover (RC)	Restore assets and operations affected by an incident	Incident Recovery Plan Execution, Incident Recovery Communication

NIST describes Govern as at the centre of the other five: it informs how the organisation prioritises and carries out the rest. The functions are not a sequence; they run concurrently.

What changed from version 1.1

• A new Govern function, pulling governance and supply chain outcomes together and adding strategy, risk appetite and oversight.
• A broader scope: all organisations, not only critical infrastructure, and an updated title to match.
• Restructured categories in Protect (for example Platform Security and Technology Infrastructure Resilience) and a new Improvement category in Identify.
• More emphasis on supply chain risk, and online implementation examples and quick-start guides.

Profiles and tiers

Organizational Profiles

A Current Profile describes the outcomes you achieve today and how well. A Target Profile describes the outcomes you want to achieve, chosen and prioritised according to your mission, risks, legal and contractual requirements. The gaps between them become your action plan. A Community Profile is a baseline published for a sector or use case that organisations can start from. NIST's quick-start guide on profiles suggests five steps: scope the profile, gather information, create the profile, analyse gaps and create an action plan, then implement and update.

Tiers

Tiers describe the rigour of risk governance and management, from Tier 1 Partial, through Tier 2 Risk Informed and Tier 3 Repeatable, to Tier 4 Adaptive. They are not maturity levels to be maximised. NIST suggests choosing tiers that fit your risk and resources; a small company might reasonably target Tier 2 or 3 for most areas.

How to implement the NIST CSF step by step

1. Decide the scope. Whole company, one business unit, or one product and its supporting systems.
2. Start with Govern. Record your mission and stakeholders' expectations, legal and contractual requirements, risk appetite, roles and responsibilities, and how leadership will oversee cybersecurity.
3. Build the Current Profile. For each relevant subcategory, describe what you do today and how consistently. Use the implementation examples to make this concrete.
4. Assess risk. Identify assets, threats, vulnerabilities and likely impact (ID.RA), including suppliers (GV.SC).
5. Build the Target Profile. Prioritise subcategories based on risk and requirements. Not every subcategory needs the same attention.
6. Analyse gaps and plan. Turn the differences into a prioritised plan with owners, budgets and dates. Use informative references to pick specific controls, for example from the CIS Controls or NIST SP 800-53.
7. Implement. Typical early work for IT companies: asset inventory, MFA and single sign-on, privileged access control, patching, secure configuration, backups with restore tests, central logging and alerting, an incident response plan, and supplier reviews.
8. Measure and report. Track progress against the Target Profile and report to leadership in the language of the functions.
9. Repeat. Update profiles when risks, systems or requirements change (ID.IM, Improvement).

Using the CSF in a software product team

For a company that builds and runs software, several CSF outcomes land directly in the product and the delivery pipeline rather than in corporate IT. Mapping them explicitly keeps the product inside the programme:

CSF outcome area	What it means for a product team
GV.SC Supply chain risk management	Track third-party services and open source dependencies; review their security; keep a software bill of materials
ID.AM Asset management	Inventory of services, repositories, environments, data stores and the data classes each holds
PR.AA Identity, authentication and access control	SSO and MFA for staff; role-based access, session management and MFA options for customers
PR.DS Data security	Encryption in transit and at rest, key management, tenant isolation, secure backups
PR.PS Platform security	Secure configuration, patching, secure development practices and protected build pipelines
DE.CM Continuous monitoring	Application and infrastructure logs, alerting on suspicious authentication and data access
RS and RC	Runbooks for the product, customer communication templates, tested restores and failover

Writing these into your Target Profile makes the engineering backlog part of the security plan, and it gives you ready answers when customers ask how the product itself is protected.

Documentation you will need

The CSF does not mandate documents. In practice, an organisation using it keeps:

• A cybersecurity strategy and policy approved by leadership (GV.PO, GV.RM).
• Roles and responsibilities, including who owns cybersecurity risk (GV.RR).
• Current and Target Profiles and the gap analysis and action plan.
• A risk register (ID.RA).
• Asset inventories for hardware, software, services and data (ID.AM).
• Supplier inventory and supplier risk assessments (GV.SC).
• Incident response and recovery plans, with test records (RS, RC).
• Training records and metrics reported to leadership (PR.AT, GV.OV).

Assessment and certification

There is no certification. Organisations self-assess, have internal audit assess them, or ask an independent firm to assess them against their Target Profile. If customers want certified or attested assurance, use the CSF to run the programme and obtain ISO/IEC 27001 certification or a SOC 2 report, both of which NIST and the AICPA have mapped to the CSF. Be wary of any offer of "NIST CSF certification": NIST does not certify against it.

Timeline and cost considerations

A first Current and Target Profile for a small or mid-sized IT company can be produced in a short, focused exercise; closing the gaps takes longer and is a continuing programme rather than a project. The framework itself is free. Costs come from the people doing the assessment, the controls you choose to implement (identity, endpoint, logging, backup, scanning), external assessors if you use them, and staff time. Because the CSF lets you prioritise, it is easy to scale cost to risk.

Benefits and risks of not using a framework

The CSF gives leaders and engineers a common vocabulary, helps prioritise limited budgets, makes board reporting consistent, and maps to the controls customers and auditors ask about, so effort is reused. Its Govern function in particular forces decisions about risk appetite and accountability that are often missing.

There is no penalty for not using the CSF. The risk of not using any framework is a security programme driven by the latest incident or the latest customer questionnaire, with gaps nobody sees until an attacker finds them. In disputes and regulatory inquiries, showing that you followed a recognised framework helps demonstrate reasonable care, although it is not a legal defence by itself.

Common mistakes and challenges for IT companies

• Treating the CSF as a checklist. It is outcome-based; the work is deciding which outcomes matter and how well you achieve them.
• Skipping Govern. Without risk appetite and ownership, profiles turn into wish lists.
• Aiming for Tier 4 everywhere. Tiers should match risk, not ambition.
• No link to specific controls. Outcomes need concrete controls; use the informative references.
• Forgetting the product. Software companies often assess corporate IT and forget the application they sell, which is where customers' data lives.
• Profiles that are never updated. A profile from two years ago describes a different company.

Best practices, tools and technologies

• Use NIST's quick-start guides for small businesses and for creating profiles.
• Download the CSF Core and mappings from the Cybersecurity and Privacy Reference Tool rather than copying tables by hand.
• Use the CIS Controls Implementation Group 1 as a practical first set of controls for Protect and Detect.
• Automate asset discovery from cloud accounts, identity providers and device management.
• Centralise logs and alerts to support Detect, and rehearse incidents to test Respond and Recover.
• Track supply chain risk for cloud services, open source dependencies and contractors.
• Report to leadership by function, with a small set of metrics per function.

For the application layer of your target profile, such as access control, logging, secure development and recovery, see our maintenance and support and web application development services.

How the NIST CSF relates to other frameworks

Framework	Relationship
NIST SP 800-53	Detailed control catalogue; mapped to CSF subcategories as an informative reference.
NIST SP 800-171	Requirements for protecting CUI in nonfederal systems; mapped to the CSF.
ISO/IEC 27001	Certifiable management system; NIST publishes a mapping.
CIS Controls	Prioritised safeguards; CIS maps them to CSF 2.0.
NIST Privacy Framework	Companion framework with the same structure for privacy risk.
NIST AI RMF	AI risk framework; NIST is aligning it with CSF concepts.
CMMC	US defence program based on NIST SP 800-171, not on the CSF directly.

Real-world implementation examples

NIST publishes success stories and community profiles on its CSF website, from sectors including manufacturing, financial services and election infrastructure. Many US state governments and universities publish their security programmes organised by the CSF functions, which shows how the framework is used for public reporting.

An illustrative example for a 40-person software company: the Current Profile shows strong Protect outcomes in the product (encryption, access control) but weak Govern (no risk appetite, no board reporting) and weak Recover (backups never restored). The Target Profile prioritises six Govern subcategories, asset management, log monitoring and recovery testing. Within two quarters, the company has an approved policy, a risk register reviewed monthly, a tested restore, and a one-page report by function for its board. Customers' questionnaires become easier because the answers now exist.

Next steps

1. Read the CSF 2.0 document and the small business quick-start guide.
2. Agree scope and owners, starting with the Govern function.
3. Draft Current and Target Profiles and the gap list.
4. Map gaps to specific controls and plan them.
5. Decide whether customers also need ISO/IEC 27001 or SOC 2, and design controls to serve both.

Frequently asked questions

Is the NIST Cybersecurity Framework mandatory?

No. It is voluntary for private organisations. US federal agencies are directed by policy to use it, and some contracts and regulators reference it.

What is the latest version of the NIST CSF?

CSF 2.0, published on 26 February 2024. It replaced version 1.1 from 2018.

What are the six functions of NIST CSF 2.0?

Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in version 2.0.

How many categories and subcategories does CSF 2.0 have?

22 categories and 106 subcategories across the six functions.

Can we get NIST CSF certified?

No. NIST does not offer certification. You can self-assess or be assessed against a profile, or obtain ISO/IEC 27001 certification or a SOC 2 report mapped to the CSF.

What is the difference between NIST CSF and ISO 27001?

The CSF is a voluntary set of outcomes and a way to describe current and target states. ISO/IEC 27001 is a requirements standard for a management system that can be certified. They complement each other and are formally mapped.

What are CSF tiers?

Four levels describing the rigour of cybersecurity risk governance and management: Partial, Risk Informed, Repeatable and Adaptive. They are not targets to maximise.

Is NIST CSF suitable for small businesses?

Yes. NIST publishes a small business quick-start guide, and the framework lets you prioritise only the outcomes that matter to you.

Does NIST CSF apply outside the US?

It can be used anywhere. It has no legal force outside the US, but many organisations and some governments use it as a reference.

What is the Govern function?

The function covering organisational context, risk management strategy, roles and responsibilities, policy, oversight and cybersecurity supply chain risk management. It informs how the other five functions are carried out.

How does the CSF relate to NIST SP 800-53?

SP 800-53 is a catalogue of specific controls. The CSF's informative references map its outcomes to SP 800-53 controls, so you can use one to plan and the other to implement.

How often should profiles be updated?

Whenever risks, systems, requirements or the business change significantly, and at least on a regular cycle such as annually.