NIST Cybersecurity Framework 2.0: A Practical Guide

The NIST Cybersecurity Framework is the most widely referenced way to describe and improve a cybersecurity programme in plain business terms. Version 2.0, released in February 2024, widened its scope from critical infrastructure to every organisation and added a new Govern function. For IT companies it is useful twice over: to run your own security programme, and to speak a common language with clients, insurers and boards. This guide explains the structure of CSF 2.0, how to build current and target profiles, and how it fits with ISO 27001, SOC 2 and other frameworks.

What is the NIST CSF?

The CSF is a taxonomy of high-level cybersecurity outcomes that any organisation can use to understand, assess, prioritise and communicate its cybersecurity efforts. It deliberately does not prescribe how to achieve each outcome; instead it points to informative references such as NIST SP 800-53, ISO/IEC 27001 and the CIS Controls.

Full form and definition

NIST CSF stands for the National Institute of Standards and Technology Cybersecurity Framework. Its components are:

• CSF Core: functions, categories and subcategories of outcomes.
• CSF Organizational Profiles: descriptions of current and target posture in terms of Core outcomes.
• CSF Tiers: characterisations of the rigour of risk governance and management, from Tier 1 (Partial) to Tier 4 (Adaptive).

Law, standard or certification?

It is a voluntary framework. There is no "NIST CSF certification". Consultants and auditors can assess maturity against it, and some US regulations and contracts reference it, but conformance is self-declared.

History and background of the NIST CSF

US Executive Order 13636 of February 2013 directed NIST to develop a voluntary framework for critical infrastructure cybersecurity with industry input. Version 1.0 was released in February 2014, and the Cybersecurity Enhancement Act of 2014 formalised NIST's role. Version 1.1 in April 2018 added supply chain risk management and identity refinements.

CSF 2.0, released on 26 February 2024, changed the title from "Framework for Improving Critical Infrastructure Cybersecurity" to "The NIST Cybersecurity Framework", added the Govern function, expanded supply chain guidance and came with quick-start guides, implementation examples and an online reference tool.

Why was the NIST CSF introduced?

Critical infrastructure owners needed a common, flexible way to manage cyber risk that did not depend on one sector's regulations. Its plain structure made it popular well beyond infrastructure, including with boards, insurers and small businesses.

Main objectives and purpose

• Give a common language for cybersecurity risk across technical and business audiences.
• Help organisations assess current posture and prioritise improvements.
• Connect cybersecurity with enterprise risk management through governance.
• Map to detailed control catalogues without replacing them.
• Support communication with suppliers, customers and regulators.

Who needs the NIST CSF?

Industries

• IT and SaaS companies serving US clients that ask for NIST alignment
• Managed service and security providers that assess clients
• Critical infrastructure, financial services, healthcare and energy organisations
• US federal agencies, which are directed to use the CSF for risk management
• Small and mid-size businesses wanting a simple structure

Geography

The CSF is a US framework used internationally. It has been translated into many languages and is referenced by regulators and industry bodies in several countries. Indian organisations often use it to structure programmes that must also meet CERT-In Directions.

Key requirements: the six functions

NIST CSF 2.0 functions

Function	What it covers	Example categories
Govern (GV)	Strategy, expectations and policy for cybersecurity risk	Organizational context, risk management strategy, roles and responsibilities, policy, oversight, cybersecurity supply chain risk management
Identify (ID)	Understanding current risk	Asset management, risk assessment, improvement
Protect (PR)	Safeguards to manage risk	Identity management, authentication and access control; awareness and training; data security; platform security; technology infrastructure resilience
Detect (DE)	Finding and analysing attacks and compromises	Continuous monitoring, adverse event analysis
Respond (RS)	Actions on detected incidents	Incident management, analysis, reporting and communication, mitigation
Recover (RC)	Restoring assets and operations	Incident recovery plan execution, recovery communication

Govern sits at the centre: it informs how the other five are prioritised and carried out.

Tiers

• Tier 1, Partial: ad hoc, reactive risk management.
• Tier 2, Risk Informed: management approves practices, but they are not organisation-wide policy.
• Tier 3, Repeatable: formally approved, consistently applied and regularly updated.
• Tier 4, Adaptive: continuously improved based on lessons learned and predictive indicators.

Tiers are not maturity levels to maximise blindly; choose the tier that fits your risk and resources.

How to implement the NIST CSF: step by step

1. Scope: decide whether the profile covers the whole company, a product, or a client-facing service.
2. Gather context: business objectives, legal and contractual requirements, risk appetite and threats.
3. Build a current profile: assess each subcategory and record how well the outcome is achieved today.
4. Define a target profile: choose the outcomes and tier you need, informed by clients, regulations and risk.
5. Analyse gaps and estimate effort and risk reduction for each.
6. Create a prioritised action plan, mapping actions to detailed controls from CIS Controls or SP 800-53.
7. Implement and measure, then reassess at least yearly.
8. Report progress to leadership using CSF functions as the reporting structure.

Documentation required

The CSF requires no specific documents, but a working programme normally has:

• Current and target organizational profiles
• Gap analysis and action plan
• Cybersecurity strategy and policies (Govern)
• Asset inventory and risk register (Identify)
• Control evidence mapped to subcategories
• Incident response and recovery plans
• Supplier risk assessments

Audit and assessment requirements

No formal audit scheme exists. Assessments are usually internal or performed by consultants, sometimes scored on a 0 to 5 maturity scale per subcategory. If you need an independent opinion, combine CSF with an auditable framework such as SOC 2 or ISO 27001, using the CSF as the reporting lens.

Estimated implementation timeline

• Current and target profile for a mid-size IT company: 4 to 8 weeks
• First improvement cycle: 6 to 12 months
• Full roadmap to target profile: typically 12 to 24 months

Cost considerations

The framework is free. Costs come from assessment effort (internal or consultant), the controls you implement to close gaps, and tooling for monitoring and evidence. The CSF helps control cost by directing investment to the highest-risk gaps.

Benefits of the NIST CSF

• A clear story for boards and clients about where you are and where you are going.
• Flexible: works for a 20-person start-up and a global enterprise.
• Maps to most other frameworks, reducing duplicate work.
• Widely accepted by US clients and cyber insurers.

Risks of ignoring it

There are no penalties for not using the CSF. But without a structured view, security investment tends to follow the latest incident or vendor pitch, and clients that use the CSF in vendor assessments may score you poorly.

Common implementation mistakes

• Treating the CSF as a checklist and scoring everything "yes" or "no".
• Setting a target of Tier 4 everywhere without the resources to sustain it.
• Skipping Govern and starting with tools.
• Never mapping outcomes to concrete controls and owners.
• Assessing once and never reassessing.

Compliance challenges for IT companies

• Clients send CSF-based questionnaires with different interpretations.
• Supply chain outcomes (GV.SC) require visibility into your own vendors and open-source components.
• Translating outcomes for cloud-native and serverless environments.

Best practices and recommendations

• Use the CSF as the reporting layer and ISO 27001 or SOC 2 as the audit layer.
• Use NIST's quick-start guides and community profiles for your sector.
• Assign an owner to every category.
• Reassess after major incidents, acquisitions or platform changes.

Tools and technologies that help

• NIST's CSF 2.0 Reference Tool and Cybersecurity and Privacy Reference Tool for mappings
• GRC platforms with CSF assessment templates
• Asset inventory, vulnerability management and SIEM tools for Identify and Detect outcomes
• Backup and disaster recovery platforms for Recover outcomes

Relationship with other compliance frameworks

NIST CSF and related frameworks

Framework	Relationship
NIST SP 800-53	Detailed control catalogue referenced by CSF subcategories
CIS Controls	Prioritised safeguards mapped to CSF 2.0; practical for implementation
ISO 27001	Certifiable management system; CSF outcomes map to Annex A controls
SOC 2	Attestation report; CSF can structure the control set behind it
FISMA	US federal agencies use the CSF in their FISMA risk management and reporting
CERT-In Directions	CSF Respond outcomes help meet India's 6-hour incident reporting

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

Managed service provider

An MSP used CSF 2.0 to assess 50 small business clients, producing a one-page current-versus-target view per client and a standard improvement package mapped to CIS Controls Implementation Group 1.

SaaS company reporting to its board

A SaaS company replaced a 40-page security report with a CSF function heatmap, showing quarterly progress against its target profile and linking each gap to an owner and budget.

Frequently asked questions

What is new in NIST CSF 2.0?

A new Govern function, a scope covering all organisations, expanded supply chain risk guidance, and new resources such as quick-start guides, implementation examples and an online reference tool.

Is NIST CSF mandatory?

No. It is voluntary for private organisations, although US federal agencies are directed to use it and some contracts and regulations reference it.

Can we get NIST CSF certified?

No. There is no certification. You can be assessed against it, or combine it with an auditable standard.

What are the six functions of NIST CSF 2.0?

Govern, Identify, Protect, Detect, Respond and Recover.

How many categories and subcategories does CSF 2.0 have?

22 categories and 106 subcategories.

What are CSF tiers?

Four levels describing the rigour of cybersecurity risk governance and management: Partial, Risk Informed, Repeatable and Adaptive.

Is NIST CSF only for US companies?

No. It is used worldwide and is available in many languages.

How does NIST CSF compare with ISO 27001?

ISO 27001 is a certifiable management system standard; the CSF is a flexible outcome framework. Many companies use both.

Is NIST CSF good for small businesses?

Yes. NIST publishes a small business quick-start guide, and the outcomes can be scaled to available resources.

How often should we reassess?

At least annually and after major changes or incidents.

Conclusion and next steps

NIST CSF 2.0 is the easiest way to explain a security programme to non-specialists and to prioritise what to do next. Pair it with detailed controls and, if clients need it, an auditable standard.

1. Scope and gather context.
2. Build current and target profiles.
3. Prioritise gaps and map them to controls.
4. Report progress using the six functions.
5. Reassess every year.

How we keep this guide up to date

We review this guide every six months and whenever NIST publishes updates to the CSF, its quick-start guides, community profiles or mappings.