The NIST Cybersecurity Framework (CSF) 2.0 was published by the U.S. National Institute of Standards and Technology (NIST) in February 2024. It represents the most significant update to the Framework since its initial release in 2014.
Unlike NIST SP 800-53, which provides a comprehensive catalog of organizational, managerial, operational, and technical security and privacy controls, together with numerous control enhancements, CSF 2.0 describes high-level outcomes and provides a common structure for managing cybersecurity risk.
The Framework provides a common language that enables organizations to understand, assess, prioritize, and communicate cybersecurity risks across technical teams, senior management, business units, partners, and other interested parties.
 
What Is NIST CSF 2.0 Used For?
CSF 2.0 does not prescribe specific organizational or technical measures and is not intended to serve as a mandatory compliance checklist. Instead, it describes the desired outcomes that an organization should achieve without specifying exactly how those outcomes must be implemented.
Each organization determines the policies, processes, controls, technologies, and resources appropriate to its organizational context, activities, risk profile, size, sector, contractual obligations, and applicable regulatory requirements.
To support practical implementation, Informative References are available to other standards, frameworks, guidelines, and control catalogs, including NIST SP 800-53. In addition, mappings to ISO/IEC 27001, CIS Controls, and other widely used standards and frameworks are published through the Online Informative References (OLIR) Program.
CSF 2.0 may be used as the primary framework for managing and assessing cybersecurity risk or integrated with existing standards, management systems, and control catalogs. In practice, its implementation is typically supported by more detailed organizational and technical requirements, procedures, and controls.
 
Structure of CSF 2.0
The core of the Framework, known as the CSF Core, is organized into six Functions comprising a total of 22 Categories and 106 Subcategories.
Govern
Govern is a new standalone Function introduced in CSF 2.0. It covers:

• organizational context;
• cybersecurity risk management strategy;
• roles, responsibilities, and authorities;
• policies;
• oversight;
• cybersecurity supply chain risk management.

The Govern Function integrates cybersecurity risk management with the organization’s overall corporate governance and enterprise risk management. It emphasizes the responsibility of senior management for setting priorities, allocating resources, and overseeing cybersecurity risk management.
 Identify
The Identify Function covers the identification and understanding of:

• organizational assets;
• suppliers and external dependencies;
• vulnerabilities and threats;
• cybersecurity risks facing the organization;
• opportunities to improve cybersecurity risk management.

This Function helps organizations determine the risks that may affect their operations, assets, services, and interested parties.
 Protect
The Protect Function covers the implementation of appropriate safeguards to manage cybersecurity risk and reduce the likelihood and potential impact of cybersecurity incidents.
It includes outcomes related to:

• identity management, authentication, and access control;
• awareness and training;
• data security;
• platform security;
• technology infrastructure resilience.

 Detect
The Detect Function covers the timely identification and analysis of potential cyberattacks, security compromises, anomalies, and other adverse events.
It helps an organization determine whether a cybersecurity event has occurred or may be occurring and whether further analysis or action is required.
 Respond
The Respond Function covers the actions taken following the detection of a cybersecurity incident.
These actions may include:

• incident management;
• incident analysis;
• containment of the incident and mitigation of its impact;
• eradication of the threat and remediation of its effects;
• incident reporting;
• coordination and communication with interested parties.

 Recover
The Recover Function covers the timely restoration of assets, services, and operations affected by a cybersecurity incident.
It includes:

• execution of recovery activities;
• restoration of normal operations;
• mitigation of the incident’s ongoing effects;
• communication with interested parties throughout the recovery process.

 
Key Differences from CSF 1.1
In CSF 1.1, Governance was a Category within the Identify Function. In CSF 2.0, governance-related outcomes have been significantly expanded, restructured, and consolidated into the new standalone Govern Function.
The new Function is not merely a renamed version of the former Governance Category. It incorporates and expands outcomes related to risk management strategy, roles and responsibilities, policies, oversight, and cybersecurity supply chain risk management.
This change highlights the role of senior management and reinforces the need to address cybersecurity as an integral part of corporate governance and enterprise risk management.
 
Expanded Scope Compared with Previous Versions
Earlier versions of the Framework were originally developed with a primary focus on critical infrastructure organizations, although they could also be applied by organizations in other sectors.
CSF 2.0 explicitly emphasizes its universal applicability. The Framework is intended for organizations of all sectors, sizes, and levels of cybersecurity maturity, including:

• small and medium-sized enterprises;
• large and multinational companies;
• government institutions and local authorities;
• educational and research organizations;
• non-governmental organizations;
• service providers and supply chain participants.

CSF 2.0 can be used both by organizations with mature cybersecurity risk management processes and by those that are only beginning to develop their approach.
 
Who Should Use NIST CSF 2.0?
NIST CSF 2.0 is suitable for:

• organizations seeking a common, management-friendly framework for cybersecurity risk management without starting directly with a detailed control catalog;
• organizations wishing to assess their current cybersecurity posture and define a target state for cybersecurity risk management;
• organizations working with U.S. partners or participating in international supply chains where NIST CSF is used as a reference framework;
• organizations already implementing ISO/IEC 27001, NIST SP 800-53, CIS Controls, or other standards and frameworks that require an additional structure for managing and communicating cybersecurity risks;
• organizations implementing the requirements of the Directive (EU) 2022/2555 (NIS2) or applicable national legislation and seeking to structure their cybersecurity risk management through an internationally recognized framework.

The use of CSF 2.0 does not automatically demonstrate compliance with a specific standard, contractual requirement, regulatory obligation, or legal requirement.
 
How Does NIST CSF 2.0 Relate to Other Standards, Frameworks, and Regulatory Requirements?
CSF 2.0 does not replace ISO/IEC 27001, NIST SP 800-53, CIS Controls, or the requirements arising from the NIS2 Directive and applicable national legislation.
These documents serve different purposes:

• ISO/IEC 27001 specifies requirements for an information security management system against which an organization may be certified.
• NIST SP 800-53 provides a comprehensive catalog of security and privacy controls.
• CIS Controls provide a prioritized set of cybersecurity best practices and safeguards.
• NIS2 establishes regulatory obligations that are implemented through the national legislation of each EU Member State.
• NIST CSF 2.0 provides a flexible framework for understanding, managing, assessing, prioritizing, and communicating cybersecurity risk.

CSF 2.0 can serve as a common structure through which an organization can organize its cybersecurity activities, controls, and obligations and link strategic objectives to specific measures.
Informative References and mappings are available between the Framework and various international standards, frameworks, guidelines, and control catalogs, including ISO/IEC 27001, NIST SP 800-53, CIS Controls, and others.
Some of these mappings have been developed by NIST, while others have been submitted by external organizations. The publication of an external mapping in a NIST catalog should not be interpreted as validation of its completeness or accuracy, endorsement by NIST, or evidence of compliance.
Informative References help organizations:

• identify relationships between different standards and requirements;
• select appropriate controls and practices;
• avoid unnecessary duplication of effort;
• integrate different approaches to cybersecurity management;
• communicate cybersecurity outcomes to management and other interested parties.

They do not replace the need for an independent assessment of compliance or conformity with the specific standard, contract, regulatory obligation, or applicable legislation.