NIST Cybersecurity
Framework 2.0

What Is the NIST CSF?

The NIST Cybersecurity Framework (CSF) is a voluntary, outcome-based framework published by the National Institute of Standards and Technology — a non-regulatory agency of the U.S. Department of Commerce. It is designed to help organizations of all sizes and sectors understand, communicate, assess, and manage cybersecurity risk.

The key word here is outcome-based. The CSF does not tell you which firewall vendor to use, which SIEM to deploy, or which specific technical controls to implement. Instead, it describes the results you should be working toward — and maps those results to a wide variety of standards, guidelines, and practices that can help you get there. This makes it both technology-neutral and sector-neutral, which is a large part of why it has been adopted so broadly worldwide.

The CSF is organized around three components: the CSF Core (a hierarchy of functions, categories, and subcategories describing cybersecurity outcomes), Organizational Profiles (a mechanism for describing current and target cybersecurity posture), and Implementation Tiers (context for how an organization views and manages cybersecurity risk).

Why Was It Created?

The original CSF (version 1.0) was created in direct response to Executive Order 13636, "Improving Critical Infrastructure Cybersecurity," signed by President Obama in February 2013. The order directed NIST to work with the private sector to develop a framework for reducing cyber risks to critical infrastructure — power grids, water systems, financial networks, telecommunications, and other sectors on which the nation's safety and economy depend.

At the time, there was no single, widely-adopted standard that organizations across these diverse sectors could use to assess and communicate their cybersecurity posture. Different industries operated with different standards, different vocabularies, and different levels of maturity. The CSF was intended to provide that common language and structural approach — while remaining flexible enough to be adopted voluntarily across vastly different organizational contexts.

NIST published CSF 1.0 in February 2014, just one year after the executive order. It was rapidly adopted by both public and private sector organizations well beyond the original critical infrastructure scope. CSF 1.1 followed in April 2018 with refinements but no structural overhaul.

By 2022, NIST recognized that the cyber landscape had shifted significantly enough to warrant a substantive revision. The world had experienced accelerating cloud adoption, a dramatic expansion of remote work, the emergence of widespread ransomware campaigns, large-scale supply chain attacks (including SolarWinds and Kaseya), and increasing attention to AI and quantum computing as both tools and threat vectors. NIST opened a public comment and workshop process in early 2022, publishing CSF 2.0 on February 26, 2024.

What Changed in Version 2.0?

Expanded Scope

Perhaps the most significant change is one that formalizes what had already been happening in practice: CSF 2.0 explicitly applies to organizations of all sizes and sectors — not just critical infrastructure. The original framework was scoped to critical infrastructure but was widely adopted beyond it anyway. Version 2.0 acknowledges this reality and designs for it intentionally, including dedicated Quick-Start Guides for small businesses, for organizations new to cybersecurity, and for those improving existing programs.

The Govern Function

The most structurally notable change is the addition of a sixth core function: Govern (GV). In CSF 1.1, governance-related activities were embedded within subcategories and not given top-level prominence. Elevating Govern to a core function signals that cybersecurity governance — leadership accountability, strategy alignment, risk management policy, and supply chain oversight — must be treated as a foundational, first-class organizational priority rather than an administrative afterthought.

Supply Chain Risk Management

CSF 2.0 significantly expands guidance around supply chain risk management (SCRM). CSF 1.1 introduced supply chain risk as a category, but version 2.0 elevates and expands it — particularly within the Govern function — with more detailed subcategories covering roles, responsibilities, and specific practices for managing third-party and supplier cyber risk. This reflects the dramatic increase in supply chain-based attacks observed between 2018 and 2024.

Organizational Profiles & Community Profiles

CSF 2.0 formalizes and expands the use of Organizational Profiles — structured descriptions of an organization's current and target cybersecurity posture. It also introduces Community Profiles, which are pre-built profile templates designed for specific sectors or use cases, allowing organizations within the same industry to benchmark against a shared baseline rather than starting from zero.

Simplified Language & Implementation Examples

The framework uses clearer, more accessible language throughout. CSF 2.0 adds implementation examples for each subcategory — concrete illustrations of what achieving a given outcome might look like in practice, without being prescriptive about the specific method. This reduces the gap between the framework's abstract outcomes and the practitioner's real-world decisions.

The Six Core Functions

The CSF Core is organized into six Functions, each representing a high-level cybersecurity outcome. These functions are not sequential steps — they are concurrent, continuous activities. Every mature cybersecurity program operates across all six simultaneously.

Each Function is broken down into Categories (specific outcomes within the function) and Subcategories (granular outcome statements). CSF 2.0 contains 22 categories and 106 subcategories across the six functions.

Implementation Tiers

The four Implementation Tiers describe how an organization views cybersecurity risk and the processes it has in place to manage it. They are not maturity levels to be climbed sequentially — they are descriptors that help an organization understand its current posture and determine whether that posture is appropriate given its risk appetite. A Tier 2 organization is not "failing" — it may be exactly where it needs to be given its size and context.

Organizational Profiles

An Organizational Profile is the CSF's mechanism for applying the framework to a specific organization's context. It documents the organization's cybersecurity outcomes — current state and target state — in terms of the CSF Core, informed by the organization's mission, risk appetite, threat environment, and legal/regulatory requirements.

CSF 2.0 also introduces Community Profiles — profile templates developed for specific sectors, subsectors, or technology types. For example, a Community Profile might be developed for small healthcare providers, or for organizations deploying industrial control systems. Community Profiles allow organizations within the same domain to benchmark against a shared reference point rather than starting profile development from a blank page.

Who Should Use It?

The CSF is genuinely useful for a wide range of organizations. Its strength is in providing structure for conversations that might otherwise be impossible — between technical teams and executive leadership, between procurement and security, between an organization and its regulators or auditors. It also maps to many other frameworks and standards, including NIST SP 800-53, ISO/IEC 27001, CIS Controls, and others, making it a useful translation layer across different compliance environments.

"The CSF prompts its users to consider their cybersecurity posture in context and then adapt the CSF to their specific needs." — NIST CSF 2.0

For small and mid-sized organizations new to structured cybersecurity: start with the CSF 2.0 Quick-Start Guide and use the framework as an assessment and prioritization tool. You don't need to achieve all subcategories — you need to understand your risks and make informed decisions about where to invest.

For larger organizations with existing programs: use Organizational Profiles to formally document current vs. target posture, and use the Govern function specifically to ensure leadership alignment with cybersecurity strategy.

For federal agencies and contractors: CSF 2.0 maps to SP 800-53 and can complement your RMF (Risk Management Framework) process. NIST provides official mapping documentation between the two.

Limitations & Uncertainty

Adoption statistics: Precise, current global adoption figures are not reliably available. Claims about what percentage of organizations use CSF typically originate from vendor surveys with limited methodological transparency. We have not cited specific adoption percentages.

Compliance mapping precision: NIST provides mappings between CSF 2.0 and other frameworks (including SP 800-53), but these mappings are not one-to-one. The documentation itself notes that "mappings and crosswalks are not always one-to-one and relationship analysis can be subjective." Do not treat mapping tables as equivalence tables.

Implementation complexity: The CSF is intentionally flexible, which means implementation difficulty varies enormously by organization. There is no single right way to implement it, and NIST does not prescribe one. What works for a large federal agency may be entirely inappropriate for a 50-person nonprofit.

This is not compliance advice: Nothing in this article constitutes legal, regulatory, or compliance guidance. If your organization has specific FISMA, FedRAMP, HIPAA, or other regulatory obligations, consult qualified professionals and the primary NIST publications directly.