NIST Cybersecurity Framework (CSF) v1.1

Why does it matter?

Version 1.1 is the edition that older Profiles, self-assessments and gap assessments refer to, and its structure differs from the current one: CSF 2.0 adds a sixth Function, Govern, and uses identifiers such as PR.AA where version 1.1 used PR.AC. A team that holds a Current Profile or Target Profile written against 1.1 needs the exact Category and Subcategory wording to carry it forward, and NIST publishes a CSF 1.1 to 2.0 Core transition overview for that purpose.

Key benefits include:

• One outcome vocabulary

The Core states outcomes, not tasks. ID.AM-1, for example, reads 'Physical devices and systems within the organization are inventoried', so executives and practitioners share a plain target.

• Profiles expose the gap

Section 2.3 compares a Current Profile with a Target Profile; the difference becomes a prioritized action plan sized to business needs and available resources.

• Tiers describe rigor, not maturity

Section 2.2 rates risk management process, integrated risk management program and external participation from Tier 1 to Tier 4, and states that Tiers do not represent maturity levels.

• Supply chain outcomes

Version 1.1 added the Supply Chain Risk Management Category (ID.SC) with five Subcategories covering supplier assessment, contracts, audits and joint response planning.

• Self-assessment guidance

Section 4.0 explains how to self-assess cybersecurity risk with the Framework, including the limits of measurement and the value of leading measures.

How does it work?

The Core (section 2.1 and Appendix A, Table 2) is a table of Functions, Categories, Subcategories and Informative References. NIST states that it is not a checklist of actions to perform and that the Functions should run concurrently and continuously. Each Subcategory has an identifier such as PR.AC-7 or DE.CM-4, and Table 1 lists the Category identifiers from ID.AM to RC.CO.

Section 3.2 gives seven steps for a new or improved program: prioritize and scope; orient; create a Current Profile; conduct a risk assessment; create a Target Profile; determine, analyze and prioritize gaps; and implement the action plan. The steps repeat as needed to improve continuously. Section 2.4 describes how mission priorities and risk tolerance pass from the executive level to the business/process level, which builds the Profile with the implementation/operations level and reports progress back up.

Sections 3.3 and 3.4 apply the Profile to other parties. A Target Profile can state cybersecurity requirements to a service provider, a Current Profile can report results to a customer, and a Target Profile can inform buying decisions when requirements cannot be imposed on the supplier. Section 3.5 describes how users can propose new or revised Informative References, so the mappings can keep up with new standards and practices.

Key Elements

• Five Functions

Identify, Protect, Detect, Respond and Recover organize the outcomes; Identify has 6 Categories, Protect 6, Detect 3, Respond 5 and Recover 3, for 23 in all.

• 108 Subcategories

Outcomes such as PR.AC-7, 'Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction'.

• Informative References

Each Subcategory cites sections of CIS CSC, COBIT 5, ISA 62443-2-1:2009, ISA 62443-3-3:2013, ISO/IEC 27001:2013 and NIST SP 800-53 Rev. 4 as examples, not an exhaustive list.

• Implementation Tiers

Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4), each described across risk management process, integrated risk management program and external participation.

• Framework Profiles

A Current Profile shows outcomes now achieved and a Target Profile shows the outcomes needed; comparing them reveals gaps.

• Version 1.1 additions

Self-assessment (section 4.0), supply chain risk management (section 3.3, 3.4 and ID.SC), identity proofing and authentication (PR.AC-6, PR.AC-7) and vulnerability disclosure (RS.AN-5).

What does it cover?

Version 1.1 was written to improve cybersecurity risk management for critical infrastructure, which the Framework defines through the USA PATRIOT Act of 2001 as systems and assets so vital that their incapacity or destruction would have a debilitating impact on security, national economic security, public health or safety. NIST states that organizations in any sector or community can use it. It applies to information technology, industrial control systems, cyber-physical systems and connected devices including the Internet of Things, and it is technology neutral. It places no regulatory requirements on businesses.

What are its objectives?

Section 1 states the purposes the Framework serves for an organization.

Describe the organization's current cybersecurity posture.

Describe its target state for cybersecurity.

Identify and prioritize opportunities for improvement within a continuous and repeatable process.

Assess progress toward the target state.

Communicate about cybersecurity risk among internal and external stakeholders.

Framework in Context

NIST built the Framework on existing standards, so its Informative References point to CIS CSC, COBIT 5, ISA 62443, ISO/IEC 27001:2013 and NIST SP 800-53 Rev. 4. Version 1.1 followed Version 1.0 (February 2014) and its companion Roadmap, and CSF 2.0 followed it in 2024. NIST cautions that phrases such as “compliance with the Framework” can mean different things to different stakeholders, because organizations use the Framework in many ways; it is a structure for expressing compliance with an organization's own cybersecurity requirements.

Common Framework Mappings

The Informative References in Table 2 cite CIS CSC, COBIT 5, ISA 62443, ISO/IEC 27001:2013 and NIST SP 800-53 Rev. 4; organizations extend that mapping to the frameworks below so one set of controls and evidence serves several programs.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

GDPR

HIPAA (NIST SP 800-66 Rev. 2)

ISO 27001:2022

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2