The NIST Cybersecurity Framework is a widely used, voluntary framework for managing cybersecurity risk. Version 2.0, published in 2024, broadened its scope to organizations of all sizes and sectors.
What the framework is
The framework, published by the U.S. National Institute of Standards and Technology, provides a common structure for describing and improving cybersecurity outcomes. It is outcome-based and does not prescribe specific technologies.
The six functions
CSF 2.0 organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern, added in version 2.0, addresses strategy, roles, policy, and oversight, including supply chain risk management.
Profiles
A current profile describes an organization's present outcomes, and a target profile describes the desired outcomes. Comparing the two highlights gaps and helps prioritize work.
Tiers
Tiers describe the rigor of an organization's cybersecurity risk governance and management practices, ranging from Partial to Adaptive. They help set expectations rather than serving as a certification.
Using the framework
Organizations often use the CSF to structure security programs, communicate with leadership, and map to other standards such as ISO/IEC 27001 or the CIS Controls. Use of the framework is voluntary and does not by itself demonstrate compliance with any law.
Key takeaways
- CSF 2.0 has six functions, including Govern.
- Profiles compare current and target states.
- Tiers describe practice rigor.
- It is voluntary and technology-neutral.
This article provides general information and is not a substitute for advice specific to your organization.