NIST Cybersecurity Framework 2.0
NIST CSF 2.0: the six functions and how to use them
What CSF 2.0 contains, what changed from 1.1, how Profiles and Tiers work, why there is no certificate, and how the framework lines up with ISO 27001 and SOC 2.
In short
NIST CSF 2.0 is a voluntary framework for managing cybersecurity risk, published by the US National Institute of Standards and Technology in February 2024. It organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0 added Govern, dropped "critical infrastructure" from the title so it applies to any organisation, and moved supply chain risk management under governance. There is no certificate. You describe where you are and where you want to be, then close the gap.
What the framework is
CSF 2.0 describes cybersecurity outcomes, not specific controls or products. Each subcategory states a result an organisation should achieve, such as "the organisation's cybersecurity risk management strategy is established and communicated". How you achieve it is your decision.
So it works more as a shared vocabulary than a checklist. Boards, security teams and suppliers can discuss the same outcome without first agreeing on one control catalogue. It is often used as the organising layer above more prescriptive sets such as ISO 27001 Annex A or NIST SP 800-53.
| Function | What it covers | Categories and subcategories |
|---|---|---|
| Govern (GV) | Context, risk strategy, roles, policy, oversight, supply chain risk | 6 and 31 |
| Identify (ID) | Assets, risk assessment, improvement | 3 and 21 |
| Protect (PR) | Identity and access, awareness, data security, platform security, resilience of technology | 5 and 22 |
| Detect (DE) | Continuous monitoring, adverse event analysis | 2 and 11 |
| Respond (RS) | Incident management, analysis, reporting, mitigation | 4 and 13 |
| Recover (RC) | Recovery plan execution, recovery communication | 2 and 8 |
Count the subcategories against Appendix A of CSWP 29 if you need an exact figure for a report. Some secondary sources quote 107; NIST's structure gives 106.
What changed between CSF 1.1 and 2.0
The biggest change is the new Govern function. In 1.1, governance sat inside Identify and was easy to treat as paperwork. In 2.0 it is a function of its own that informs the other five, and it holds leadership decisions on risk appetite, roles and policy.
- Govern is new. Six categories: organisational context (GV.OC), risk management strategy (GV.RM), roles and responsibilities (GV.RR), policy (GV.PO), oversight (GV.OV) and cybersecurity supply chain risk management (GV.SC).
- Scope widened. The title no longer refers to critical infrastructure. CSF 2.0 is written for organisations of any sector and size.
- Supply chain moved up. Supply chain risk management moved from Identify, where it was category ID.SC in CSF 1.1, to Govern, as category GV.SC.
- Same approach underneath. The framework still describes outcomes rather than controls. If you mapped your programme to 1.1, most of that work carries forward, but the governance outcomes need a fresh look.
Using Profiles and Tiers
You use CSF 2.0 by writing two Profiles. A Current Profile records which outcomes you achieve today and how well. A Target Profile records the outcomes you intend to achieve, chosen for your risks and obligations. The difference between them is your plan.
Tiers describe how rigorous your cybersecurity risk management is overall, from Tier 1 (Partial) to Tier 4 (Adaptive). They are not maturity scores to chase. A small firm may sensibly target Tier 2, while a regulated operator may need Tier 3 or 4.
- Current Profile
- The outcomes your organisation achieves now, with the evidence behind each one.
- Target Profile
- The outcomes you have decided to achieve, prioritised by risk, budget and obligations.
- Gap
- The work between the two Profiles, which becomes a prioritised action plan with owners.
- Tiers 1 to 4
- Partial, Risk Informed, Repeatable, Adaptive. A description of how risk management works across the organisation, not a pass mark.
How NIST CSF relates to ISO 27001 and SOC 2
NIST maintains a catalogue of Informative References (the OLIR programme) that maps CSF 2.0 to other standards. It lists a mapping from ISO/IEC 27001:2022 to CSF 2.0. NIST notes that it does not test or endorse mappings it did not write, so treat them as a starting point to check against your own controls.
The frameworks have different purposes. ISO 27001 is a certifiable management system with mandatory clauses and an Annex A control set. SOC 2 is an attestation report from a CPA firm against the Trust Services Criteria. CSF 2.0 is neither. It is a way to describe and prioritise outcomes, and it can sit above either one.
Many teams use CSF for board reporting and run ISO 27001 or SOC 2 underneath as the programme that holds the evidence. The controls are the same; only the way they are reported changes.
Putting CSF 2.0 to work
Start with Govern. Outcomes in the other five functions are hard to prioritise until you have written down your risk appetite, roles and policy.
-
01
Set the scope
Decide which parts of the organisation, systems and suppliers the Profiles cover.
Your security lead and leadership
-
02
Write the Current Profile
Assess each relevant subcategory and link the evidence that shows how you achieve it.
Your team, in Certifyi
-
03
Write the Target Profile
Choose the outcomes and Tier you are aiming for, based on risk and obligations.
Leadership and risk owners
-
04
Close the gap
Turn the difference into owned, dated actions and review progress on a cadence.
Control owners
Who does what
CSF 2.0 has no regulator and no certification body. Your organisation assesses itself, and customers, insurers or auditors may review the result. Certifyi is software. It records the work and does not assess or certify you.
| Task | Your team | Certifyi | Reviewer (customer, auditor, insurer) |
|---|---|---|---|
| Profiles | Write Current and Target Profiles | Records the assessment of each subcategory and its evidence | May ask to see the Profiles and evidence |
| Governance | Set risk strategy, roles and policy | Policy register, and a risk register with owners | Reviews whether governance is real or on paper |
| Gap actions | Prioritise and deliver improvements | Tracks owners, due dates and status | Looks for progress over time |
| Assurance | Decide whether you need third-party assurance | Gives an auditor scoped, read-only access to the evidence | Issues a report or opinion only under its own scheme |
How Certifyi helps
Run CSF 2.0 on the controls you already have
If you already run ISO 27001 or SOC 2, much of the evidence a CSF Profile needs already exists. Certifyi keeps it in one place, linked to the subcategories it supports.
-
CSF 2.0 in the framework catalogue
Adopt NIST CSF 2.0 and record how you achieve each subcategory, with the evidence behind it.
-
One control, several frameworks
Map a control once to CSF 2.0 and ISO 27001, and reuse the mapping across frameworks.
-
Records for the Govern function
Keep your policies, and a risk register with owners and treatment decisions, as the records behind the Govern outcomes.
-
Reports for leadership
Build a report from the platform's data and export it to PDF for leadership or a customer review.
Questions
NIST CSF 2.0, answered
Is NIST CSF 2.0 mandatory?
No. CSF 2.0 is voluntary guidance from NIST. Some contracts, regulators or customers may ask you to describe your programme against it, but the framework itself imposes no legal obligation.
Can my organisation be certified to NIST CSF?
No. NIST does not certify organisations and there is no official CSF certificate. You assess yourself using Profiles and Tiers. For third-party assurance, ISO 27001 certification or a SOC 2 report is the usual route.
What changed from NIST CSF 1.1 to 2.0?
CSF 2.0 added the Govern function, widened the scope beyond critical infrastructure to any organisation, and moved supply chain risk management from Identify into Govern.
How many subcategories are in NIST CSF 2.0?
CSF 2.0 has six functions, 22 categories and 106 subcategories. Govern is the largest function, with six categories and 31 subcategories.
Does NIST CSF map to ISO 27001?
Yes. NIST's Informative References catalogue lists a mapping from ISO/IEC 27001:2022 to CSF 2.0. NIST does not test or endorse mappings it did not produce, so review it against your own controls.
What are NIST CSF Tiers?
Tiers 1 to 4 (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorous your cybersecurity risk management is. They help you set a realistic target. They are not a score to maximise.
Does Certifyi make us NIST CSF compliant?
No. Certifyi records your controls, evidence, risks and gap actions against CSF 2.0. The outcomes you achieve depend on the work your organisation does.
Write your first CSF 2.0 Profile in a 30-minute call.
Bring the frameworks you already run. We will show which CSF subcategories your existing controls and evidence already cover.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them