Skip to content
AUSEC
Esc
  • Home/
  • Services/services/
  • Penetration testing/services/penetration-testing/
  • Vulnerability assessment/services/vulnerability-assessment/
  • Security audit/services/security-audit/
  • Compliance consulting/services/compliance-consulting/
  • Incident response and digital forensics/services/digital-forensics/
  • Corporate training and workshops/services/corporate-training/
  • Audit methodology/methodology/
  • Security posture quiz/#quiz
  • Threat Lab: attack simulator/threat-lab/#simulator
  • Threat Lab: cyber kill chain/threat-lab/#kill-chain
  • Threat Lab: defence in depth/threat-lab/#defence
  • Threat Lab: spot the phish/threat-lab/#phish
  • Threat Lab: terminal/threat-lab/#terminal
  • Frameworks hub/frameworks/
  • Framework cross-mapping/frameworks/#crossmap
  • PCI DSS v4.0.1/frameworks/pci-dss/
  • ISO/IEC 27001:2022/frameworks/iso-27001/
  • ISO/IEC 27002:2022/frameworks/iso-27002/
  • NIST Cybersecurity Framework 2.0/frameworks/nist-csf/
  • CERT-In Audit Guidelines (India)/frameworks/cert-in/
  • Training and internships/training/
  • Resources: articles and checklists/resources/
  • PCI DSS v4.0.1: what changed, and what it means now/resources/pci-dss-4-0-1-changes/
  • ISO/IEC 27001:2022 Annex A for beginners/resources/iso-27001-annex-a-beginners/
  • NIST CSF 2.0: the Govern function explained/resources/nist-csf-govern-function/
  • How to prepare for a CERT-In audit/resources/prepare-cert-in-audit/
  • Glossary/resources/#glossary
  • Team and certifications/team/
  • About Ausec/about/
  • Contact and book an assessment/contact/
  • Privacy policy/privacy/
  • Terms of use/terms/
  • Responsible disclosure/responsible-disclosure/
  • Design system/styleguide/

NIST Cybersecurity Framework 2.0

A voluntary, risk-based framework for managing cybersecurity, now with Govern at the centre.

Published
Feb 2024
Functions
6
Categories
22
Subcategories
106

What is NIST Cybersecurity Framework 2.0?

The NIST Cybersecurity Framework (CSF) 2.0 was published by the US National Institute of Standards and Technology in February 2024. It is voluntary and widely used to build and communicate risk-based security programmes.

Version 2.0 broadens the scope from critical infrastructure to organisations of every size and sector, and adds a sixth function, Govern, covering strategy, policy, oversight and supply chain risk.

Who needs it

  • Organisations that want a common language between the board and security teams
  • Companies serving US customers or partners that reference the CSF
  • Security leaders building a multi-year roadmap from current to target state
  • Teams already using ISO/IEC 27001 that want a complementary outcome view

Six functions, 22 categories

Select a function to see its purpose and categories.

IDENTIFYPROTECTDETECTRESPONDRECOVERGOVERN

GV · FUNCTION

Govern

Establish and monitor cybersecurity risk management strategy, expectations and policy

  • GV.OCOrganizational Context
  • GV.RMRisk Management Strategy
  • GV.RRRoles, Responsibilities, and Authorities
  • GV.POPolicy
  • GV.OVOversight
  • GV.SCCybersecurity Supply Chain Risk Management
Show all categories as a list

Govern

Establish and monitor cybersecurity risk management strategy, expectations and policy

  • GV.OC Organizational Context
  • GV.RM Risk Management Strategy
  • GV.RR Roles, Responsibilities, and Authorities
  • GV.PO Policy
  • GV.OV Oversight
  • GV.SC Cybersecurity Supply Chain Risk Management

Identify

Understand current cybersecurity risks to assets

  • ID.AM Asset Management
  • ID.RA Risk Assessment
  • ID.IM Improvement

Protect

Use safeguards to manage cybersecurity risks

  • PR.AA Identity Management, Authentication, and Access Control
  • PR.AT Awareness and Training
  • PR.DS Data Security
  • PR.PS Platform Security
  • PR.IR Technology Infrastructure Resilience

Detect

Find and analyse possible cybersecurity attacks and compromises

  • DE.CM Continuous Monitoring
  • DE.AE Adverse Event Analysis

Respond

Take action regarding a detected cybersecurity incident

  • RS.MA Incident Management
  • RS.AN Incident Analysis
  • RS.CO Incident Response Reporting and Communication
  • RS.MI Incident Mitigation

Recover

Restore assets and operations affected by a cybersecurity incident

  • RC.RP Incident Recovery Plan Execution
  • RC.CO Incident Recovery Communication

Tiers and Profiles

The CSF is not certifiable. Organisations assess themselves, or engage an assessor, using Profiles and Tiers.

  1. 01

    Current Profile

    Document which CSF outcomes you achieve today and how well.

  2. 02

    Target Profile

    Decide which outcomes you need, based on risk, obligations and business goals.

  3. 03

    Implementation Tiers 1 to 4

    Partial, Risk Informed, Repeatable and Adaptive describe how rigorous your risk governance and management practices are.

  4. 04

    Action plan

    Close the gap between Current and Target Profiles with a prioritised, funded roadmap.

From gap to evidence

  • Current and Target Profile assessments across all six functions
  • Tier assessment and a board-level summary of where you stand
  • Prioritised roadmap linking gaps to concrete projects
  • Mapping CSF outcomes to your ISO/IEC 27001 and PCI DSS controls

Frequently asked questions

Is NIST CSF 2.0 mandatory?

No. It is voluntary, although customers, partners or regulators may reference it.

What is new in version 2.0?

A new Govern function, a scope that covers all organisations rather than only critical infrastructure, more emphasis on supply chain risk, and new implementation resources such as Quick-Start Guides.

Can we be certified to NIST CSF?

No. There is no certification. You can be assessed against it and report your Current and Target Profiles.

Does it work alongside ISO/IEC 27001?

Yes. NIST publishes informative references that map CSF outcomes to other standards, so the two are commonly used together.

Working towards NIST CSF 2.0?

Start with a gap assessment and a clear, prioritised plan.

Book a gap assessment