NIST Cybersecurity Framework 2.0

Purpose, scope and authority

Use CSF to describe the security outcomes an organisation needs and communicate gaps to leadership. It is an adaptable framework, not a prescribed technical configuration or a certification scheme. Its Core, organisational Profiles and Tiers serve different purposes. A contractual or regulatory adoption can create obligations; merely using the framework does not establish compliance. [1]

Principles and operating logic [1]

1. Govern

Establish organisational context, risk strategy, roles, policy, oversight and supply-chain risk management. Decide who can accept risk and how cybersecurity decisions connect with enterprise objectives. Governance informs every other function; it is not a preliminary task that ends when operations begin.

2. Identify

Understand assets, risks and opportunities to improve. Include services, information, suppliers and dependencies, rather than limiting the inventory to devices. A useful risk assessment explains the operational consequence of losing confidentiality, integrity or availability.

3. Protect

Manage identities and permissions, awareness, data security, platform security and infrastructure resilience. Select safeguards against the scenarios that matter. A deployed product is evidence of an implementation activity, not proof that the intended outcome has been achieved.

4. Detect

Monitor relevant activity and analyse adverse events. Define which evidence supports an incident declaration, and consider information from multiple sources. Detection depends on visibility and context, not simply the volume of alerts.

5. Respond

Manage incidents, investigate, communicate and mitigate. Establish decision authority and coordinate with internal and external stakeholders. Containment must account for operational consequences and the possibility that normal communications are untrustworthy.

6. Recover

Execute recovery plans and communicate progress. Verify restoration before declaring normal service. Restoring availability and establishing trust in the restored information are related but different tests.

Application · editorial recommendations

Create a Current Profile and a Target Profile for one defined mission or service. Compare outcomes, prioritise gaps, assign owners and resources, and revise the profiles as evidence changes. Tiers describe the rigour of risk governance and management: Partial, Risk Informed, Repeatable and Adaptive. Do not turn them into an automatic score or assume every organisation must pursue the highest Tier regardless of need.

Evidence for the CISO · proposed review pack

Our suggested review pack: service scope; current and target outcomes; evidence supporting the current assessment; prioritised gap register; accountable owners; investment decisions; and review triggers. For each gap, ask what mission consequence is reduced and how progress will be demonstrated. A hypothetical communications service might prioritise tested recovery before purchasing another monitoring tool.

Common mistakes and limits

Avoid treating the six functions as a one-way sequence, confusing an informative mapping with control equivalence, or reporting a framework adoption as certification. Read the Core for the actual categories and subcategories; this guide explains their management logic rather than replacing every outcome in the official text.

Official sources and reading route

Read these sections in the source: Sections 1–5; Appendices A–B.

1. NIST Cybersecurity Framework 2.0 · CSWP 29 · 2024-02-26