CyphrQ
Menu

NIST CSF 2.0 Explained: Six Functions, Profiles and Tiers

What NIST CSF 2.0 is, its six functions including the new Govern function, how Profiles and Tiers work, and why you cannot be certified.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

8 min read

The NIST Cybersecurity Framework (CSF) 2.0 is a free, voluntary framework that helps any organisation describe, assess and improve how it manages cybersecurity risk. It groups outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0 was published on 26 February 2024 and added Govern. It is guidance, not a certifiable standard.

What is NIST CSF 2.0 and who publishes it?

The framework is published by the US National Institute of Standards and Technology (NIST) as NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0, dated 26 February 2024. NIST's Cybersecurity Framework page is the official starting point and links the document, quick start guides, profile templates and mappings.

Two details from NIST's own wording are worth keeping in mind. The publication describes the CSF as a taxonomy of high-level cybersecurity outcomes that any organisation can use. And it states that the CSF does not prescribe how outcomes should be achieved.

That second point is the key to reading it. The CSF tells you what a well-run programme should be able to say ("we understand our assets", "we can detect problems"). It leaves the how to you, to your other standards and to your budget.

What changed in CSF 2.0?

NIST's release announcement calls this the first major update since the original 2014 release. Two changes matter most:

  • Wider audience. The earlier versions were aimed at critical infrastructure. NIST says 2.0 is designed for all audiences, industry sectors and organisation types.
  • A new Govern function. NIST frames cybersecurity as a major source of enterprise risk that senior leaders should consider alongside matters like finance and reputation.

NIST also describes the release as a suite of resources, not a single document: quick start guides, implementation examples, a reference tool for browsing and exporting the framework, and a searchable catalogue of informative references.

What are the six functions of NIST CSF 2.0?

The functions are the top level of the framework's core. Together they cover the life cycle of managing cybersecurity risk. Below is my plain-language reading, not NIST's wording.

Function The question it answers
Govern Who decides what risk we accept, who is accountable, and what is our policy?
Identify What assets, suppliers and risks do we actually have?
Protect What safeguards stop or limit harm?
Detect How would we notice something going wrong?
Respond What do we do when it does?
Recover How do we get back to normal and learn from it?

Below the functions sit categories and subcategories: finer outcome statements you can assess one by one. I am not quoting their text here; read them in the CSF 2.0 document itself.

What does the new Govern function add?

Govern is about decisions made before any incident. It covers the organisation's context and obligations, its risk strategy and appetite, roles and authority, policy, oversight and supply chain risk. The practical effect is that CSF 2.0 gives a board or executive team an agreed place to ask "who owns this?" instead of leaving security as a purely technical topic.

Who uses NIST CSF 2.0, and can you be certified?

Anyone can use it. Typical users are security teams building a programme, risk managers who need a common language with executives, and organisations that want to show customers or regulators they follow a recognised approach.

You cannot be certified against the CSF. Nothing in NIST's pages I read describes a certification scheme, and the framework itself says it does not prescribe how outcomes are met. If a supplier says it is "CSF certified", ask what that means: more often it means they assessed themselves, or an assessor mapped their controls to the CSF.

NIST publishes quick start guides for different readers, listed on its quick start guides page: a resource and overview guide (NIST SP 1299), small businesses (SP 1300), enterprise risk managers (SP 1303) and supply chain risk (SP 1305).

How do Profiles and Tiers work in NIST CSF 2.0?

A Profile is a snapshot of where you stand against the outcomes, or where you want to be. NIST's profiles page offers a spreadsheet template for creating a Current Profile and a Target Profile and comparing them side by side to find gaps. The gaps become your plan.

NIST also describes a Community Profile: a baseline of outcomes created for the shared interests of a group of organisations. Examples listed on that page include a Ransomware Risk Management CSF Profile and a Manufacturing CSF Profile from NIST, and a Financial Sector CSF Profile from the Cyber Risk Institute.

Tiers describe how rigorously you govern and manage risk. NIST's guide on Tiers (SP 1302) says to apply them to Profiles to characterise that rigour. The four tier names are Partial, Risk Informed, Repeatable and Adaptive. Tiers are not a ladder you must climb: a small organisation can reasonably decide a lower tier fits its risk.

In practice: the two layers answer different questions. Profiles say which outcomes you cover. Tiers say how consistently and deliberately you cover them.

How does NIST CSF 2.0 relate to ISO/IEC 27001 and other frameworks?

  • ISO/IEC 27001 is a certifiable management system standard; the CSF is a non-certifiable outcome framework. Many organisations use the CSF to structure the conversation and 27001 to build the auditable system. See ISO/IEC 27001 explained.
  • NIST SP 800-53 is a detailed control catalogue. NIST's release page says its informative references map the CSF to more than 50 other documents, including SP 800-53 Rev. 5.
  • Sector rules and laws such as NIS2 set legal duties. The CSF can help organise the work but does not satisfy a law by itself.

More framework explainers live in the Frameworks subtopic. Our Tools section is organised by CSF function, so you can browse tools by what they help you do; the Identify group is the first.

How do organisations adopt NIST CSF 2.0 in practice?

There is no audit stage. Adoption is a loop you run yourself:

  1. Decide the scope and who owns it.
  2. Build a Current Profile against the outcomes.
  3. Build a Target Profile based on your risk and obligations.
  4. Compare, rank the gaps and plan the work.
  5. Re-assess on a schedule and update the Profile.

Going deeper: for security and IT teams

Use the Organizational Profile template as your working record. NIST's template is a spreadsheet you can fill in per outcome. Add columns for owner, evidence location, implementation status, and the informative reference you rely on. The structure matters more than the tool: each outcome needs one accountable person and one place an assessor can find proof.

Map to controls with informative references. NIST's catalogue links CSF outcomes to other documents, including SP 800-53 Rev. 5, and has its own guide (SP 1347). Use it to translate a gap ("we cannot show we detect misuse of privileged accounts") into specific controls from the catalogue you already follow. If you hold ISO/IEC 27001, map the outcomes to your Statement of Applicability so one set of evidence serves both.

Evidence to prepare. The CSF is not audited, but customers, insurers and internal audit often ask for a self-assessment. Keep:

  • The dated Current and Target Profiles, with the reviewer named.
  • A risk register and the risk strategy that sets appetite, which is what Govern outcomes look for.
  • An asset and supplier inventory, since most other functions rely on it.
  • Policy documents with owners and review dates.
  • Incident response and recovery plans, with the date of the last test and its findings.
  • The scope statement: which business units, systems and sites the Profile covers.

Common weaknesses, described generally. Profiles that rate every outcome "done" with no evidence. A Target Profile copied from a community template with no link to your own risk. Govern outcomes assigned to the security team alone, when the point is executive accountability. Supplier risk covered by a questionnaire that is never read. Recovery plans that have never been exercised.

Use Community Profiles to save time, not to skip thinking. If a profile exists for your sector, start from it and edit. The ransomware profile on NIST's page is a useful example of a threat-specific cut across all six functions. Our ransomware post covers the attack side.

Be careful with Tiers in reporting. Giving one Tier for the whole organisation hides variation. Apply Tiers per scope or per function and say why. Do not present a Tier as a score to a board without explaining that a lower Tier can be a deliberate, risk-based choice.

Questions to ask a supplier that cites the CSF:

  • Which version of the CSF, and was it 1.1 or 2.0?
  • Who did the assessment: self, internal audit or an independent party?
  • Can I see the scope and the Target Profile, not just a summary?
  • How do you cover Govern outcomes and supply chain risk?

Ask your own team: Which outcomes would we struggle to evidence? Who signs off the Target Profile? When did we last re-assess?

What should you do next about NIST CSF 2.0?

  • Read NIST's resource and overview guide (SP 1299) first.
  • Download the Organizational Profile template and fill in a first Current Profile in an afternoon, accepting that it is rough.
  • Name the executive who owns the Govern outcomes.
  • Pick the three largest gaps and give each an owner and a date.

Learn more

Key takeaways

  • NIST CSF 2.0 (CSWP 29) was published on 26 February 2024 and is voluntary guidance.
  • It has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new.
  • It describes outcomes, not methods, and it cannot be certified.
  • Profiles show current and target position; Tiers describe how rigorously you manage risk.
  • Pair it with ISO/IEC 27001 or SP 800-53 when you need an auditable system or detailed controls.

Sources