Compliance Guide - NIST Cybersecurity Framework (CSF) 2.0¶

Overview¶

The NIST Cybersecurity Framework (CSF) is a voluntary framework from the US National Institute of Standards and Technology for understanding, managing and communicating cybersecurity risk. It is organised around six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0, published in February 2024, broadened it from critical infrastructure to organisations of every size and sector, and added the Govern function to put cybersecurity strategy, roles and supply chain risk at the centre.

Two things make the CSF different from the other guides in this section:

• There is no CSF certification. No auditor issues a "CSF certificate". Organisations use it to assess themselves, set targets, structure a security programme and report to boards and regulators. Claims of "CSF compliance" mean an assessment against it, usually by the organisation itself or a consultant.
• It is outcome-based, not prescriptive. It says what a good programme achieves ("Identities and credentials for authorised users are managed") without saying how. The how comes from mapped references such as NIST SP 800-53, ISO 27001 and the CIS Controls.

That makes it a common language: a CISO can describe the whole programme to a board in six words, and an engineer can trace any one of those words down to specific controls.

The CSF at a glance¶

flowchart TB
  GV[GOVERN<br/>strategy, roles, policy,<br/>oversight, supply chain risk]
  GV --> ID[IDENTIFY<br/>assets, risk assessment,<br/>improvement]
  GV --> PR[PROTECT<br/>identity and access, training,<br/>data and platform security, resilience]
  GV --> DE[DETECT<br/>continuous monitoring,<br/>adverse event analysis]
  GV --> RS[RESPOND<br/>incident management,<br/>analysis, communication, mitigation]
  GV --> RC[RECOVER<br/>recovery plan execution,<br/>recovery communication]
  ID --> PR --> DE --> RS --> RC

Govern sits over the other five functions and informs all of them; Identify, Protect, Detect, Respond and Recover describe the lifecycle of managing risk and incidents.

The Core: functions, categories and subcategories¶

The CSF Core is a hierarchy: 6 functions, 22 categories and 106 subcategories (specific outcomes). Each category has a short identifier used in assessments and mappings.

What changed from CSF 1.1¶

• Govern is new. Governance outcomes that were scattered across Identify in 1.1 now have their own function, alongside new outcomes on strategy and oversight.
• Supply chain risk management moved into Govern and expanded.
• Scope widened from critical infrastructure to all organisations, with Quick Start Guides for small businesses and other audiences.
• Implementation Examples were added for each subcategory, plus online Informative References mapping to other standards.
• Several 1.1 categories were merged or renamed (for example, Protect now has Platform Security and Technology Infrastructure Resilience).

Tiers and Profiles¶

Tiers: how mature is the risk management?¶

Tiers describe the rigour of an organisation's cybersecurity risk governance and management. They are not a maturity score to be maximised everywhere; organisations choose a target tier that fits their risk.

Profiles: where are we, and where do we want to be?¶

• A Current Profile records which outcomes the organisation achieves today, and how well.
• A Target Profile records the outcomes it wants to achieve, prioritised for its risks and business goals.
• The gap between them becomes the action plan.

Community Profiles are shared target profiles for a sector or use case (for example, manufacturing or a specific threat like ransomware) that organisations can start from.

How to use the CSF: a practical walk-through¶

1. Scope: decide which business units, systems or products the assessment covers.
2. Gather context: business objectives, legal and regulatory obligations, risk appetite, key suppliers.
3. Build the Current Profile: for each in-scope subcategory, rate how well the outcome is achieved today (for example on a 0-5 scale, or "not / partially / largely / fully"), with evidence.
4. Build the Target Profile: decide the desired level per subcategory, driven by risk, not by "max everything".
5. Analyse the gaps and estimate the cost and risk reduction of closing each.
6. Write an action plan, prioritised, with owners and dates.
7. Implement and measure, then reassess on a regular cycle (often yearly).

A worked example¶

A 60-person SaaS company runs a first CSF assessment. Highlights:

The action plan becomes the security roadmap, and the next year's assessment shows progress in the board's own vocabulary.

Cloud Provider CSF Support¶

Because the CSF is outcome-based, cloud providers support it through mappings and automated checks that assess your configuration against mapped controls.

AWS¶

AWS Config offers a conformance pack that maps managed rules to CSF subcategories, and Audit Manager includes CSF-based frameworks for evidence collection.

Azure¶

Google Cloud¶

How the CSF relates to other frameworks¶

Assessment Preparation Checklist¶

Documentation that makes an assessment straightforward¶

• Cybersecurity strategy and risk appetite statement (GV.RM)
• Named roles and RACI for security responsibilities (GV.RR)
• Security policies, approved and reviewed (GV.PO)
• Supplier inventory with risk tiers (GV.SC)
• Asset inventory: hardware, software, cloud, SaaS, data (ID.AM)
• Risk register (ID.RA)
• Access control standard and review records (PR.AA)
• Training records (PR.AT)
• Data classification and encryption standard (PR.DS)
• Hardening baselines and patch SLAs (PR.PS)
• Logging standard and alert catalogue (DE.CM, DE.AE)
• Incident response plan, runbooks and exercise records (RS)
• Backup, restore test and DR records (RC)

Common gaps found in first assessments¶

• Govern outcomes missing: no one accountable, no risk appetite, security not reported to leadership.
• Incomplete asset inventories, especially SaaS and shadow IT.
• Detection exists on paper, but alerts are not monitored or have no owners.
• Incident response plans never exercised.
• Backups never restored in a test.
• Supplier risk managed only at contract signing, never reviewed.

Certification Exam Relevance¶

NIST CSF knowledge is relevant for: - CompTIA Security+ and CySA+ - frameworks and their purpose - ISC2 CISSP and CC - security governance and frameworks - ISACA CISM and CISA - building and auditing a security programme - Microsoft SC-100 - aligning a security strategy with industry frameworks

Exams commonly test the function names and their order, the difference between tiers and profiles, and the fact that the CSF is voluntary and not certifiable.

Documentation Links¶

📖 NIST Cybersecurity Framework - the CSF home page, quick start guides and resources

📖 NIST CSF 2.0 (CSWP 29) - the framework document itself

📖 AWS Config: Operational best practices for NIST CSF - the conformance pack mapping Config rules to CSF

📖 Azure: NIST CSF offering - Microsoft's CSF mapping and resources