NIST Cybersecurity Framework 2.0
NIST Cybersecurity Framework 2.0 is the first major revision of NIST's flagship voluntary cybersecurity guidance since 2014, published 26 February 2024. CSF 2.0 adds a sixth core function — Govern — alongside the original five (Identify, Protect, Detect, Respond, Recover), broadens the framework's scope beyond critical infrastructure to organisations of all sizes and sectors, and introduces Implementation Examples, Profiles and Quick-Start Guides aimed at small enterprises, supply-chain risk, and AI-system risk.
On this page · 9 sections
How does NIST Cybersecurity Framework 2.0 apply to your shop floor?
Pick your industry and scale — Ask V5 rewrites the definition in your context, gives a worked example, and shows what V5 does on day one.
01What the CSF is and is not
The CSF is a voluntary framework — not a regulation, not a standard, not an audit certification. It is a structured vocabulary of cybersecurity outcomes (the Core), a method for setting targets and measuring current state (Profiles), and a way to describe maturity (Tiers). Organisations adopt it to communicate consistently across business, IT, security and supplier domains, and to map their controls to a common reference structure.
What it is not: a list of mandatory controls. The Core describes outcomes (e.g. 'Backups of data are conducted, maintained and tested'); the controls that achieve them come from NIST SP 800-53, ISO/IEC 27002, CIS Critical Security Controls, sector-specific guidance, or the organisation's own choice.
02What 2.0 changed
- Govern (GV) added as a sixth function alongside Identify, Protect, Detect, Respond, Recover.
- Scope broadened from 'critical infrastructure' (the 1.x framing) to organisations of all sizes and sectors.
- Implementation Examples introduced for each subcategory — concrete actions that satisfy the outcome.
- Reference Tool and Informative References modernised — mappings to SP 800-53 Rev 5, ISO/IEC 27001:2022, CIS Controls v8 and others.
- Quick Start Guides for small business, supply-chain risk, enterprise risk management, and creating community profiles.
- AI risk management — CSF 2.0 + the NIST AI RMF (AI 100-1) are presented as complementary; the CSF Profile concept is extended to AI-system risk.
- Supply-chain risk management elevated from a single Identify category to a Govern category (GV.SC) reflecting executive accountability.
03The Govern function in detail
Govern (GV) is the bridge between enterprise risk management and cybersecurity-specific functions. It contains the categories where executive accountability lives:
- GV.OC — Organizational Context (mission, stakeholders, legal/regulatory requirements, critical dependencies).
- GV.RM — Risk Management Strategy (objectives, appetite, statements, communication).
- GV.RR — Roles, Responsibilities, and Authorities.
- GV.PO — Policy (cybersecurity policy is established, communicated, enforced).
- GV.OV — Oversight (results of activities inform leadership; corrections are made).
- GV.SC — Cybersecurity Supply Chain Risk Management.
04The six functions
| Function | Purpose | Example outcome |
|---|---|---|
| Govern (GV) | Cybersecurity risk-management strategy, expectations, and policy | Cybersecurity supply-chain risk is integrated into procurement |
| Identify (ID) | Understand the assets, suppliers, and risks | Inventories of hardware, software, services and data are maintained |
| Protect (PR) | Safeguards to limit or contain the impact | Identities are managed, authenticated and authorised |
| Detect (DE) | Identify the occurrence of cybersecurity events | Anomalies and indicators of compromise are detected |
| Respond (RS) | Take action regarding a detected incident | Incidents are contained and eradicated |
| Recover (RC) | Restore capabilities or services impaired | Backups and restoration capabilities are tested |
05Profiles — Current, Target, Community
A Profile is the organisation's view of the Core: which outcomes apply, at what maturity, in what priority. CSF 2.0 distinguishes:
- Current Profile — where the organisation stands today against the chosen outcomes.
- Target Profile — where the organisation needs to be, based on mission, risk tolerance, legal requirements and stakeholder expectations.
- Community Profile — a baseline Profile authored for a sector or use case (e.g. SMB, healthcare, AI systems, election infrastructure) that organisations adopt and tailor.
The Current vs Target gap drives the prioritised action plan. CSF 2.0's emphasis on Community Profiles makes adoption easier for organisations that previously found the framework too abstract — they start from a sector baseline rather than from a blank Core.
06Implementation Tiers
Tiers (1 Partial → 2 Risk-Informed → 3 Repeatable → 4 Adaptive) describe the rigour and integration of cybersecurity risk management. Tiers apply to the organisation as a whole and to specific functions or categories — an organisation can be Tier 3 on Protect and Tier 2 on Respond.
07Why CSF matters in regulated industries
- Medical devices — FDA's premarket cybersecurity guidance and Section 524B align with CSF outcomes (SBOM, threat modelling, vulnerability handling, monitoring).
- Critical-infrastructure operators — many sector-specific regulations (TSA pipeline security, FERC/NERC CIP, water/wastewater EPA guidance) cross-reference CSF.
- Federal contractors — CMMC and SP 800-171 inherit CSF concepts.
- Cloud / SaaS providers serving regulated customers — CSF Profile aligns naturally with SOC 2 TSC, ISO 27001 Annex A and FedRAMP control families.
- Boards — Govern function provides the structure for SEC cybersecurity disclosure (Reg S-K Item 106) conversations.
08Adopting CSF 2.0 in practice
- Pick the Community Profile that fits if one exists (small business, manufacturing, healthcare, AI). Start from the baseline.
- Identify the in-scope assets, services and suppliers (Identify + Govern.OC).
- Score the Current Profile against the subcategories. Be honest — overscored Current Profiles produce undersized action plans.
- Set the Target Profile based on risk appetite, regulatory obligations and stakeholder expectations.
- Prioritise the gap. The Govern function should set the priority criteria.
- Operate. Detect and Respond outcomes generate the telemetry that the next Current Profile review uses.
- Repeat annually (or after a material event) — CSF is a continuous, not a one-shot, activity.
09How V5 handles this
Frequently asked questions
Q.Is CSF mandatory?+
No. CSF is a voluntary framework. Some federal contracts, sector regulators and state laws reference it, and some customers contractually require it, but there is no statutory mandate. Its strength is voluntary adoption across sectors using a common vocabulary.
Q.Do I need to throw away CSF 1.1 work?+
No. The 2.0 Core extends rather than discards 1.1. Most 1.1 subcategories map cleanly to 2.0 subcategories. The Govern function is new; supply-chain risk has moved into Govern from Identify; Implementation Examples are added. Plan a migration, not a rewrite.
Q.How does CSF 2.0 relate to ISO/IEC 27001:2022?+
Complementary. CSF is an outcomes framework with no certification; 27001 is a management-system standard with certification. Many programmes use 27001 as the certified ISMS and CSF as the outcomes vocabulary for cross-functional and board communication. The Informative References in CSF 2.0 map directly to 27001 Annex A.
Q.Where does the AI RMF fit?+
NIST positions the AI Risk Management Framework (AI 100-1) and CSF 2.0 as complementary. AI systems introduce risks the CSF can address through the same Profile structure — Community Profiles tailored to AI-system risk are an explicit CSF 2.0 use case.
Primary sources
Further reading
- ISO/IEC 27001:2022Complementary management-system standard.
- FDA cybersecurity premarket (2023)CSF maps to FDA's cybersecurity expectations for medical devices.
- Supply Chain Risk ManagementCSF 2.0 elevates SCRM as a Govern category.
- Data IntegrityIntegrity controls map across CSF Protect and Detect functions.
Want to see how NIST Cybersecurity Framework 2.0 could fit into your own records and workflows? Explore the related V5 pages or talk to our team about what applies to your operation.