The NIST Cybersecurity Framework (CSF) 2.0 is a free, voluntary guide from the US National Institute of Standards and Technology for managing cybersecurity risk. Version 2.0, published in February 2024, is written for every kind of organization — not just critical infrastructure — and adds a sixth function, Govern. Here is what it says, without the jargon, and how to start using it.
The CSF Core is organized into six functions, 22 categories and 106 subcategories (specific outcomes). Govern sits in the middle and informs the other five.
| Function | In plain English | Categories | Related kits |
|---|---|---|---|
| Govern (GV) | New in 2.0. Sets and monitors the organization's cybersecurity strategy, expectations and policy. | Organizational Context; Risk Management Strategy; Roles, Responsibilities and Authorities; Policy; Oversight; Cybersecurity Supply Chain Risk Management | GRC, Third-Party Risk |
| Identify (ID) | Understand the organization's current cybersecurity risks — assets, risks and improvements. | Asset Management; Risk Assessment; Improvement | Vulnerability Management, GRC |
| Protect (PR) | Use safeguards to manage those risks. | Identity Management, Authentication and Access Control; Awareness and Training; Data Security; Platform Security; Technology Infrastructure Resilience | IAM, Endpoint, Cloud, DLP, Awareness |
| Detect (DE) | Find and analyze possible attacks and compromises. | Continuous Monitoring; Adverse Event Analysis | SOC, Threat Intelligence |
| Respond (RS) | Take action on a detected cybersecurity incident. | Incident Management; Incident Analysis; Incident Response Reporting and Communication; Incident Mitigation | Incident Response |
| Recover (RC) | Restore assets and operations affected by an incident. | Incident Recovery Plan Execution; Incident Recovery Communication | BCDR |
Govern answers "who decides, based on what, and how do we know it's working?" Its six categories cover the organization's context and obligations, a risk management strategy and risk appetite, clear roles and authorities, cybersecurity policy, leadership oversight of results, and cybersecurity supply chain risk management. In practice it means a named executive owner, an agreed risk appetite, policies people actually follow, and a regular Steering Committee that reviews KPIs and makes decisions.
A Current Profile describes the outcomes you achieve today; a Target Profile describes the outcomes you want. The gap between them is your roadmap.
Tiers describe how rigorous your cybersecurity risk governance and management are: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive. They are not a maturity score to chase — pick the tier that fits your risk.
Each Cyber Program Kit gives one security domain a live Excel tracker, a ready-to-adopt SOP with NIST CSF 2.0 mapping, and six PowerPoint decks from daily stand-up to Steering Committee.
Browse the 16 kitsFree SOC KPI Dashboard| Framework | What it is | Who uses it |
|---|---|---|
| NIST CSF 2.0 | Voluntary, outcome-based risk framework | Any organization |
| CMMC 2.0 | US Department of Defense certification; Level 2 is based on NIST SP 800-171 | Defense contractors handling CUI |
| ISO/IEC 27001:2022 | Certifiable information security management system standard | Organizations wanting certification |
They work well together: many teams use the CSF to structure their program and map controls to CMMC or ISO 27001.
No. It is voluntary guidance. Some regulators, customers and contracts reference it, so check your own obligations.
Six: Govern, Identify, Protect, Detect, Respond and Recover.
The CSF describes outcomes (what good looks like); SP 800-53 is a detailed catalog of security and privacy controls you can use to achieve them.
On NIST's website: nist.gov/cyberframework.
Educational summary only — not legal, audit or compliance advice. Always confirm details against the official NIST publication. NIST does not endorse any commercial product; framework names are used for reference.