NIST Cybersecurity Framework 2.0 Guide

The NIST Cybersecurity Framework is the most widely used common language for cybersecurity risk, yet many organisations still treat it as a checklist to score rather than a way to decide what to improve next. CSF 2.0, published as NIST CSWP 29 on 26 February 2024, was the first major update since the framework appeared in 2014. It added a Govern function, widened the scope from critical infrastructure to every organisation, and moved its supporting material into online tools. This guide explains the Core, Organizational Profiles, Tiers, the Quick-Start Guides, Informative References, Implementation Examples and Community Profiles, and how to run and measure a CSF programme. It is written for CISOs, GRC leads, risk managers and security architects who need to apply CSF 2.0, not just reference it.

Key takeaways

• CSF 2.0 has six Functions, 22 Categories and 106 Subcategories. Govern joins Identify, Protect, Detect, Respond and Recover, and sits at the centre of the other five.
• It describes outcomes, not controls. NIST states "The CSF does not prescribe how outcomes should be achieved." SP 800-53, ISO/IEC 27001 and CIS Controls supply the how, through Informative References.
• Profiles are the working tool. A Current Profile and a Target Profile, compared at Subcategory level, produce the prioritised action plan that justifies budget.
• Tiers describe rigour, not a score to maximise. Tier 1 Partial to Tier 4 Adaptive are chosen by leadership to fit risk, and inform the Target Profile.
• Identity is a named Category. PR.AA covers identities and credentials for "users, services, and hardware", which brings service accounts, API keys and workload identities explicitly into scope.

What CSF 2.0 is, and what changed from 1.1

CSF 2.0 is voluntary guidance from the US National Institute of Standards and Technology. It gives a taxonomy of high-level cybersecurity outcomes that any organisation can use to understand, assess, prioritise and communicate its efforts. It is not a certification scheme: there is no CSF certificate, and claims of "CSF compliance" usually mean an assessment against a chosen Target Profile. The framework consists of three parts: the CSF Core, CSF Organizational Profiles and CSF Tiers.

Gaps in 2.0 numbering, such as the missing ID.AM-06 or DE.CM-04, mark 1.1 Subcategories that were relocated or withdrawn. NIST published a CSF 1.1 to 2.0 Core Transition Changes Overview spreadsheet in September 2024; use it to migrate an existing 1.1 assessment rather than re-mapping by hand.

The Core: Functions, Categories and Subcategories

The Core is a hierarchy. Functions organise outcomes at the highest level, Categories group related outcomes, and Subcategories are the specific outcome statements you assess. Subcategory IDs follow the pattern Function.Category-number, for example GV.SC-04 "Suppliers are known and prioritized by criticality".

Some 2.0 Subcategories carry more weight than their 1.1 equivalents and are easy to underrate:

• ID.RA-07: "Changes and exceptions are managed, assessed for risk impact, recorded, and tracked". Exception registers are now an explicit outcome.
• ID.RA-09: "The authenticity and integrity of hardware and software are assessed prior to acquisition and use", which covers software supply chain checks.
• PR.PS-04: "Log records are generated and made available for continuous monitoring", paired with DE.CM-09 on monitoring hardware, software, runtime environments and their data.
• DE.AE-08: "Incidents are declared when adverse events meet the defined incident criteria", which requires written criteria.
• RC.RP-03: "The integrity of backups and other restoration assets is verified before using them for restoration".

The Govern function in practice

Govern is where CSF 2.0 differs most from 1.1. Its outcomes are about decisions and accountability, so the evidence is board papers, risk appetite statements and contracts, not tool configurations.

• Organizational Context (GV.OC): mission, stakeholders, legal and regulatory requirements (GV.OC-03 includes privacy and civil liberties obligations) and dependencies in both directions.
• Risk Management Strategy (GV.RM): risk appetite and tolerance statements (GV.RM-02), integration with enterprise risk management (GV.RM-03), and a standardised method for calculating and prioritising risk (GV.RM-06). See the Cyber Risk Quantification Guide.
• Roles, Responsibilities, and Authorities (GV.RR): leadership accountability (GV.RR-01), defined roles (GV.RR-02), adequate resources (GV.RR-03) and cybersecurity in HR practices (GV.RR-04).
• Policy (GV.PO): policy established from context and strategy, then reviewed and updated as requirements, threats and technology change.
• Oversight (GV.OV): results of the strategy are reviewed and performance is evaluated (GV.OV-03), which is where metrics belong.
• Supply Chain (GV.SC): ten outcomes from programme set-up through supplier criticality, contract requirements (GV.SC-05), due diligence, monitoring (GV.SC-07), incident involvement (GV.SC-08) and exit (GV.SC-10). See the Third-Party Access Guide.

Organizational Profiles: Current and Target

An Organizational Profile describes current and target posture in terms of Core outcomes. The Current Profile records which outcomes are being achieved and how well; the Target Profile records the outcomes selected and prioritised to meet risk objectives. NIST provides a spreadsheet template and the SP 1301 Quick-Start Guide. CSWP 29 sets out five steps:

1. Scope the Profile: which business unit, system, product or the whole organisation, with its high-level facts and assumptions. Several Profiles for different units are normal.
2. Gather information: policies, risk priorities, legal and contractual requirements, existing assessments and control evidence.
3. Create the Profile: for each in-scope Subcategory, record current state, target state, priority and the evidence or rationale. Subcategories that do not apply can be excluded with a reason.
4. Analyse gaps and plan: compare Current and Target, then build a prioritised action plan with owners, cost and dates, often fed into a POA&M or risk register.
5. Implement and update: deliver the plan and refresh the Profile, at least annually and after major changes such as acquisitions, new regulation or a significant incident.

Rating Subcategories: CSF does not prescribe a scale. Common choices are a 0 to 4 or 0 to 5 implementation scale, or simply "not achieved, partially achieved, achieved". Define what each level requires in evidence terms before scoring, or scores drift between assessors and years.

Tiers

Tiers characterise the rigour of risk governance (the Govern Function) and risk management (the other five Functions). The SP 1302 Quick-Start Guide recommends that leadership select Tiers at Function or Category level rather than per Subcategory.

• Not a maturity score to maximise: SP 1302 says "Progression to higher Tiers is encouraged when needed to address risks or mandates", and CSWP 29 says Tiers should complement an organisation's risk methodology "rather than replace it". Tier 4 everywhere is rarely cost-justified.
• Tiers and Profiles: a chosen Tier shapes the Target Profile. A Tier 3 target for Respond implies documented, approved and consistently applied incident procedures across RS Categories.
• Maturity models: if the board wants a maturity number, report Profile attainment against target alongside Tiers. See the Identity Security Maturity Model for a domain-specific example.

Quick-Start Guides, references, examples and Community Profiles

NIST moved most supporting material out of the CSF document into separately maintained resources.

• Informative References: mappings between Core outcomes and other standards, published through the Online Informative References (OLIR) Program. Listed mappings include CSF 2.0 to SP 800-53 Release 5.2.0, ISO/IEC 27001:2022, CIS Controls v8.1, PCI DSS 4.0.1, the CRI Profile 2.0 and the CSA Cloud Controls Matrix v4.0. NIST does only limited conformance testing on non-NIST mappings and does not check their correctness, so validate any mapping you rely on for audit.
• Implementation Examples: short, action-oriented, notional illustrations of how to achieve a Subcategory. They are not a required baseline and should not be scored as if they were controls.
• CSF 2.0 Reference Tool and CPRT: browse, search and export the Core and mapped content in human-readable and machine-readable formats (JSON and Excel), useful for loading into GRC platforms. See the GRC Platform Buyer's Guide.
• Community Profiles: baselines of CSF outcomes for a sector, technology or threat. NIST lists profiles for manufacturing, ransomware risk management, semiconductors, genomic data and transit, plus the Financial Sector profile from the Cyber Risk Institute and a Cloud Security profile from the Cloud Security Alliance. SP 800-61 Rev. 3 (April 2025), which superseded Rev. 2, is the incident response Community Profile.
• Since 2024: NIST released a preliminary draft Cybersecurity Framework Profile for Artificial Intelligence (NISTIR 8596) on 16 December 2025, organised around securing AI systems, AI-enabled defence and thwarting AI-enabled attacks, with an initial public draft planned for 2026. As of 17 October 2026, nist.gov lists no CSF 2.1 or revised Core.

Using CSF with SP 800-53, ISO 27001 and other control sets

CSF says what to achieve; control catalogues say how. Most organisations pair it with one control set and use the Informative References to connect the two. The detail on each catalogue is in the NIST SP 800-53 Guide, the ISO 27001 Certification Guide and the Control Mapping Guide; this section covers only how to choose.

• CSF with SP 800-53: for US federal agencies, contractors handling federal systems and organisations that want granular, parameterised controls. Strong where FedRAMP or the RMF already apply.
• CSF with ISO/IEC 27001: for organisations that need a certifiable management system for customers or regulators. CSF Profiles become a communication layer over the ISMS and Statement of Applicability.
• CSF with CIS Controls v8.1: for small and mid-sized organisations that want a prioritised, technical starting set through Implementation Groups.
• Regulation: regimes such as NIS2, DORA or sector rules can be expressed as a Target Profile, so one assessment serves several obligations. See the NIS2 Directive Guide.
• Small vs large: a small organisation can run one Profile in a spreadsheet using SP 1300; a large group typically runs Profiles per business unit or critical service, rolls them up to an enterprise view, and holds them in a GRC platform.

Where identity fits: PR.AA and machine identities

PR.AA is the identity Category, and its wording matters for non-human identities. PR.AA-01 covers identities and credentials for "authorized users, services, and hardware", and PR.AA-03 says "Users, services, and hardware are authenticated". Service accounts, API keys, workload identities, certificates and AI agents are therefore in scope of a Target Profile, not an afterthought.

Related controls are common pairings for orientation, not NIST's official Informative References; use the OLIR mappings for formal work. ID.AM-02 (software, services and systems inventories) and DE.CM-03 (monitoring personnel activity and technology usage) are where NHI discovery and behaviour monitoring land. See the Service Account Security Guide and the NHI Governance Maturity Model.

Implementing CSF 2.0 step by step

1. Secure sponsorship and scope (weeks 1 to 4): agree with the executive sponsor what the Profile covers and who owns each Function. Record the decision under GV.RR.
2. Pilot one Profile (months 1 to 3): choose one business unit or critical service, build Current and Target Profiles with the NIST template, and test the rating scale and evidence rules on it before scaling.
3. Set Tiers and targets: leadership selects Tiers per Function, then sets Subcategory targets that are feasible and tied to risk appetite (GV.RM-02).
4. Map to your control set: link each in-scope Subcategory to existing controls through the OLIR mapping for SP 800-53, ISO 27001 or CIS, so evidence is collected once.
5. Build and fund the action plan: rank gaps by risk reduction and cost, assign owners, and feed them into the risk register and budget cycle.
6. Scale out: extend to other units, reuse a Community Profile where one fits your sector, and roll up results for the board.
7. Review and correct: reassess at least annually. If the pilot shows targets were unrealistic or the scale was inconsistent, reset the Target Profile and rescore rather than carrying forward misleading baselines; keep version history so changes are visible.

Measuring progress

GV.OV-03 expects cybersecurity risk management performance to be evaluated. NIST SP 800-55 Vol. 1 (December 2024), the Measurement Guide for Information Security, explains how to identify and select measures; pair it with Profile data rather than inventing a parallel scorecard. See the Identity Security Metrics Guide.

• Target attainment: percentage of in-scope Subcategories at or above target, by Function, tracked quarterly.
• Gap closure: number of high-priority gaps closed per quarter against plan, and average age of open gaps.
• Tier attainment: Functions meeting their selected Tier for governance and for management.
• Profile currency: percentage of Profiles reviewed in the last 12 months or after a major change.
• Supplier coverage: percentage of critical suppliers (GV.SC-04) with contract requirements and current assessments.
• Identity outcome: percentage of service accounts and machine credentials with an owner, rotation and review evidence (PR.AA-01, PR.AA-05).

Common failure patterns

• Scoring without targets: a Current Profile scored 1 to 5 with no Target Profile produces a heat map but no decisions.
• Treating Tier 4 as the goal: chasing Adaptive everywhere spends budget on low-risk areas and ignores the SP 1302 advice to progress when risk or mandates require it.
• Govern on paper only: policies exist but risk appetite is undefined and no one reviews outcomes, so GV.RM and GV.OV are rated as achieved on document existence.
• Supply chain as a questionnaire: GV.SC-07 asks for supplier risk to be understood, assessed, responded to and monitored throughout the relationship. The Salesloft Drift breach showed how a connected integration's OAuth tokens can reach hundreds of customers' Salesforce tenants, a risk an annual questionnaire would not have surfaced.
• Human identities only: PR.AA assessed against workforce SSO and MFA while service accounts, API keys and CI/CD tokens are left out, despite the "services, and hardware" wording.
• Trusting unvalidated mappings: importing a third-party CSF to control mapping and claiming coverage without checking it, which NIST itself says it does not verify for non-NIST mappings.

Practitioner checklist

• Confirm you are using CSF 2.0 (CSWP 29) and migrate any 1.1 assessment with the NIST transition spreadsheet.
• Agree Profile scope, owners per Function and an evidence-based rating scale before the first assessment.
• Have leadership select Tiers per Function and approve risk appetite statements under GV.RM-02.
• Build Current and Target Profiles with the NIST template and record rationale for every excluded Subcategory.
• Link Subcategories to your control set through the OLIR mappings, and validate any non-NIST mapping.
• Include service accounts, API keys, certificates and AI agents in PR.AA-01 and PR.AA-03 assessments.
• Check for a Community Profile for your sector or use case before writing targets from scratch.
• Report target attainment, gap closure and Profile currency to the board, and refresh Profiles at least annually.

Standards and references

• NIST: The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29
• NIST: SP 1302 CSF 2.0 Quick-Start Guide, Using the CSF Tiers
• NIST: SP 1299 CSF 2.0 Resource and Overview Guide
• NIST: CSF 2.0 Quick-Start Guides
• NIST: CSF 2.0 Informative References
• NIST: CSF 2.0 Profiles
• NIST: SP 800-61 Rev. 3 Incident Response Recommendations, a CSF 2.0 Community Profile
• NIST: SP 800-55 Vol. 1 Measurement Guide for Information Security

Related NHI Mgmt Group resources: NIST SP 800-53 Guide · ISO 27001 Certification Guide · Control Mapping Guide · Identity Security Programme Guide · Incident Response Guide