- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyNIST Frameworks
- Regulatory ContextTypeFrameworkLegal InstrumentFrameworkSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionNorth AmericaRegion DetailUnited StatesPublisherNational Institute of Standards and Technology (NIST)
- VersioningVersionCSF 2.0 (NIST CSWP 29)Effective DateFebruary 26, 2024Issue DateFebruary 26, 2024
- AdoptionAdoption ModelVoluntaryImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
NIST publications are works of the U.S. government. CSF 2.0 (CSWP 29), the Quick-Start Guides, the Profile template and the CSF 2.0 Reference Tool are free on the NIST CSF website and the CSRC publication page.
Framework text is licensed by its publisher and is included only where stated above.
- NIST CSF 2.0 (NIST CSWP 29, February 26, 2024) is the current edition of NIST's voluntary framework for managing and reducing cybersecurity risk.
- It is written for organizations of any size, sector, or maturity, widening the scope beyond critical infrastructure.
- The Core has 6 Functions, 22 Categories, and 106 Subcategories, with Organizational Profiles and Tiers.
- The new Govern Function covers strategy, policy, roles, oversight, and supply chain risk.
- The document describes outcomes, not methods; Informative References, Implementation Examples, and Quick-Start Guides are published online.
Overview
The NIST Cybersecurity Framework (CSF) 2.0, published as NIST CSWP 29 on February 26, 2024, is the current edition of NIST's voluntary framework for managing and reducing cybersecurity risk. It is written for organizations of any size, sector or maturity, including industry, government, academia and nonprofits, and it widens the scope of earlier editions beyond critical infrastructure: NIST dropped the old title, “Framework for Improving Critical Infrastructure Cybersecurity.” The previous edition is described on the NIST CSF 1.1 page.
CSF 2.0 has three components: the CSF Core, a taxonomy of outcomes arranged as 6 Functions, 22 Categories and 106 Subcategories; Organizational Profiles that describe an organization's current and target posture; and Tiers that characterize the rigor of its cybersecurity risk governance and management. Its new Function, Govern, sits at the center of the Core and covers strategy, policy, roles, oversight and supply chain risk. NIST states that the CSF may be adopted voluntarily and through governmental policies and mandates.
The document describes outcomes, not methods. Informative References, Implementation Examples, Quick-Start Guides and Community Profiles are published online by NIST so they can be updated more often than the document itself. NIST states that the document is updated infrequently to give users stability, and that suggestions for new Informative References go to the NIST OLIR program.
Why does it matter?
CSF 2.0 gives executives, managers and practitioners one outcome vocabulary for cybersecurity risk, and it puts governance first. The Govern Function makes risk strategy, risk appetite, roles, policy, oversight and supplier risk explicit outcomes, so cybersecurity can sit beside financial, privacy, supply chain and reputational risk in enterprise risk management. Because the Core is sector-, country- and technology-neutral, one structure serves a small business and a regulated enterprise, and it applies to IT, the Internet of Things and operational technology, in cloud, mobile and artificial intelligence environments.
Key benefits include:
- Governance as a Function
GV.RM-02 asks that risk appetite and risk tolerance statements are established, communicated and maintained, and GV.RR-01 makes leadership accountable for cybersecurity risk.
- Supplier risk in the Core
The GV.SC Category has ten Subcategories; GV.SC-05 requires supply chain cybersecurity requirements to be integrated into contracts, and GV.SC-07 requires supplier risk to be monitored over the relationship.
- Profiles close the gap
A Current Profile and a Target Profile, compared side by side, give a prioritized action plan such as a risk register or Plan of Action and Milestones.
- Tiers for governance
Tier 1 Partial to Tier 4 Adaptive characterize the rigor of risk governance and management and apply to Profiles, not to the Core.
- Resources that stay current
Informative References, Implementation Examples and Quick-Start Guides are online, so mappings to SP 800-53 and other sources update without a new edition.
How does it work?
Appendix A is the CSF Core. Outcomes run from Function to Category to Subcategory, with identifiers such as GV.OC-03 (legal, regulatory and contractual requirements are understood and managed) and DE.CM-01 (networks and network services are monitored to find potentially adverse events). NIST states the outcomes are not a checklist and that Function order does not imply sequence or importance. Gaps in the numbering mark CSF 1.1 Subcategories that were relocated.
Section 3.1 describes five steps to build an Organizational Profile: scope it; gather the information needed; create it; analyze the gaps between the Current and Target Profiles and create an action plan; then implement the plan and update the Profile. An organization can hold several Profiles with different scopes, and a Community Profile can serve as the basis of a Target Profile.
Section 3.2 adds the Tiers, and section 5 shows how the CSF improves communication between executives, managers and practitioners and integrates with enterprise risk management, the NIST Risk Management Framework, privacy risk, supply chain risk and emerging technologies. The Core also exists in a legacy format similar to CSF 1.1 for teams that migrate gradually.
Key Elements
- Six Functions
Govern, Identify, Protect, Detect, Respond and Recover; Govern informs how the other five are implemented, and Detect, Respond and Recover address incidents.
- 22 Categories, 106 Subcategories
Govern has 6 Categories and 31 Subcategories, Identify 3 and 21, Protect 5 and 22, Detect 2 and 11, Respond 4 and 13, and Recover 2 and 8.
- Organizational and Community Profiles
Current and Target Profiles describe posture in terms of Core outcomes; a Community Profile is a published baseline for a sector, technology or threat type.
- Tiers
Partial, Risk Informed, Repeatable and Adaptive, applied to Profiles to characterize governance and risk management rigor.
- Online resources
Informative References, Implementation Examples and Quick-Start Guides (Small Business, Supply Chain Risk Management, Tiers, Enterprise Risk Management and others), with the CSF 2.0 Reference Tool.
- Transition tools
NIST's CSF 1.1 to 2.0 Core Transition Changes Overview spreadsheet maps version 1.1 Subcategories to their CSF 2.0 outcomes.
What does it cover?
The CSF is designed for organizations of all sizes and sectors, with individuals who develop and lead cybersecurity programs as the primary audience. Executives, boards, acquisition professionals, risk managers, lawyers, human resources staff and auditors can use it to guide decisions, and policymakers such as regulators and associations can use it to set priorities. NIST states that the Functions, Categories and Subcategories apply to all information and communications technology an organization uses: information technology, the Internet of Things and operational technology, in cloud, mobile and artificial intelligence systems. The CSF is not country-specific, and governments outside the United States have used earlier versions.
What are its objectives?
Section 1 states what the CSF helps an organization do with its outcomes.
Understand and assess: describe the current or target posture of part or all of an organization, find gaps and assess progress.
Prioritize: organize actions that align with mission, legal and regulatory requirements and risk expectations.
Communicate: provide a common language inside and outside the organization about risks, capabilities, needs and expectations.
Use the CSF with other frameworks, standards and guidelines to manage information and communications technology risk at enterprise level.
Framework in Context
CSF 2.0 is meant to be used with other resources. NIST describes how it complements the Risk Management Framework (SP 800-37, SP 800-30 and the SP 800-53 control catalog), enterprise risk management (IR 8286 and SP 800-221), the NIST Privacy Framework, and SP 800-161 Rev. 1 for supply chain risk. NIST warns that the CSF does not prescribe how outcomes are achieved: it links to Informative References, which may be narrower than a Subcategory, such as a single SP 800-53 control, or broader, such as a policy requirement.
Common Framework Mappings
NIST publishes Informative References online, and organizations extend them to the frameworks below so one control set and one body of evidence serves several programs.
Mapped frameworks include:
CIS Controls v8.1
ISO 27001:2022
ISO 27002:2022
ISO 27701
MITRE ATT&CK
NIST Privacy Framework v1.0
NIST 800-171 Rev. 3
NIST 800-53 Rev.5
How SmartSuite Supports NIST CSF 2.0
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Cyber & IT Risk to track cyber risks, vulnerabilities and security controls against the Core outcomes, Enterprise Risk Management to bring cybersecurity risk into the enterprise risk register that the Govern Function expects, and Third Party Risk Management for the GV.SC supplier outcomes. Compliance Management holds the policies, controls, testing and evidence behind each Target Profile.
Core Outcome Library
Load the 22 Categories and 106 Subcategories with an owner, implementation status and linked controls and evidence.
Organizational Profiles
Record the Current Profile and Target Profile for each scope, compare them side by side and track the gap actions from section 3.1.
Govern Records
Hold the risk strategy, risk appetite and tolerance statements (GV.RM-02), roles and accountability (GV.RR) and policies (GV.PO) as linked records with approval history.
Supplier Risk Tracking
Assess and monitor suppliers against GV.SC-05 and GV.SC-07 in Third Party Risk Management, with contract requirements and review dates.
Cyber Risk Register
Log cybersecurity risks and vulnerabilities in Cyber & IT Risk with owners, treatments and the Core outcomes they affect, and share them with Enterprise Risk Management.
Tier and Transition Record
Document the Tier chosen for each Profile and keep the mapping from CSF 1.1 Subcategories to CSF 2.0 outcomes.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
MITRE ATT&CK is a free knowledge base of adversary tactics, techniques and sub-techniques from The MITRE Corporation, updated twice a year; the current release is v20.0.
The NIST Privacy Framework Version 1.0 is a voluntary tool for managing privacy risk: five Functions, 18 Categories, 100 Subcategories, Profiles and four Implementation Tiers.
Frequently Asked Questions For NIST Cybersecurity Framework (CSF) v2.0
CSF 2.0 adds a sixth Function, Govern, which covers organizational context, risk management strategy, roles and responsibilities, policy, oversight and cybersecurity supply chain risk management. It names organizations of all sizes and sectors as the audience, drops the critical infrastructure title, adds Implementation Examples and online Informative References, and treats Profiles and Tiers as tools for governance. The Core has 22 Categories and 106 Subcategories.
Appendix A lists six Functions (Govern, Identify, Protect, Detect, Respond, Recover), 22 Categories identified in Table 1 and 106 Subcategories. Govern has 6 Categories and 31 Subcategories; Identify 3 and 21; Protect 5 and 22; Detect 2 and 11; Respond 4 and 13; Recover 2 and 8.
An Organizational Profile describes an organization's current and/or target cybersecurity posture in terms of Core outcomes (section 3.1). A Current Profile shows what is achieved now and a Target Profile shows what has been selected and prioritized. Comparing them gives the gap analysis and action plan. A Community Profile is a published baseline for a sector, technology or threat type that an organization can use as the basis for its own Target Profile.
Section 3.2 and Appendix B describe Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive. They characterize the rigor of an organization's cybersecurity risk governance practices (Govern) and its risk management practices (Identify through Recover), and they are applied to Current and Target Profiles. NIST says Tiers should complement an organization's risk methodology, and that moving to a higher Tier is encouraged when risks or mandates are greater or a cost-benefit analysis supports it.
The CSF is a foundational resource that may be adopted voluntarily and through governmental policies and mandates (section 1). NIST describes outcomes and does not prescribe how to achieve them, so organizations express their posture with Profiles and Tiers and not with a certificate.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.