NIST Cybersecurity Framework
Also known as: NIST CSF, Cybersecurity Framework, CSF 2.0, NIST Framework
The NIST Cybersecurity Framework (NIST CSF) is a set of standards, guidelines, and best practices published by the US National Institute of Standards and Technology to help organizations manage cybersecurity risk.
Version 1.1 organized guidance around five core functions: Identify, Protect, Detect, Respond, and Recover. CSF 2.0 (2024) added a sixth function, Govern, placing security risk management in a broader organizational governance context. The framework is voluntary, sector-agnostic, and widely adopted globally.
NIST Cybersecurity Framework, explained at three levels
At home
The NIST CSF is a guide that helps any organization think through its cybersecurity in an organized way. It asks five basic questions: Do you know what you need to protect? Have you put protections in place? Can you spot a problem when it happens? Can you respond to it? Can you recover from it? These five areas give organizations a common language to talk about cybersecurity even without deep technical expertise.
At work
The NIST CSF gives your organization a structured way to assess and communicate cybersecurity risk. Each of the core functions breaks down into categories and subcategories that map to specific security controls. You use the framework by creating a Current Profile (where you are today), a Target Profile (where you want to be), and a gap analysis to plan your roadmap. Implementation Tiers (1-4) describe the rigor of your cybersecurity risk management practices.
At home
The six CSF 2.0 functions are: Govern (establish strategy and accountability), Identify (asset management, risk assessment), Protect (access control, training, data security), Detect (anomaly detection, continuous monitoring), Respond (incident management, communication), and Recover (recovery planning, improvements). The framework does not specify how to implement each subcategory -- it defines outcomes to achieve, not the specific controls to use. This makes it adaptable to any organization size or maturity level.
At work
CSF is designed to complement, not replace, existing standards. NIST publishes informative references that map CSF subcategories to specific controls in ISO 27001, COBIT, CIS Controls, and NIST SP 800-53. This makes CSF useful as an integration layer -- an organization running ISO 27001 and PCI DSS can use CSF as a common language to view combined control coverage.
At home
CSF 2.0's new Govern function addresses a long-standing gap: cybersecurity risk management was treated as a technical discipline separate from enterprise risk management. Govern covers organizational context, risk management strategy, supply chain risk, roles and responsibilities, and oversight. This shift aligns with SEC cybersecurity disclosure rules (2023) requiring public companies to describe their cybersecurity governance in annual reports.
At work
From a practitioner standpoint, the most common CSF misuse is treating it as a compliance checklist and marking subcategories as 'done' without assessing actual control effectiveness. The framework's value is in the Current Profile to Target Profile gap analysis. For organizations managing third-party risk, CSF 2.0's expanded supply chain guidance provides a structured basis for vendor cybersecurity assessments. CSF is increasingly referenced in regulatory guidance from the SEC, CISA, and several state-level privacy regulations.
Real-world examples
At home
Carlos manages IT for a small manufacturing company and was asked by their largest customer to demonstrate their cybersecurity posture. He used the NIST CSF self-assessment tool to map the company's current controls, identified gaps in the Detect category (no centralized log monitoring), and built a 12-month improvement plan to share with the customer.
At work
The CISO at Broadview Energy completed a CSF Current Profile assessment across all operational technology and IT systems after a ransomware incident hit a peer utility. The gap analysis showed Tier 1 maturity in Respond and Recover despite Tier 3 maturity in Protect -- leading to a $2M investment in incident response planning and business continuity testing.
Common confusions
- The NIST CSF is not a standard you can be certified against -- there is no NIST CSF certificate. Organizations can be assessed against it and document their Implementation Tier, but no independent body issues a certificate. Vendors claiming 'NIST CSF certified' are using the term loosely.
- The framework was originally developed for critical infrastructure -- power grids, water systems, financial networks -- but CSF 2.0 explicitly removed that framing and positions the framework as applicable to all organizations regardless of sector or size.
- Reaching Implementation Tier 4 (Adaptive) is not the universal goal. Tiers describe the rigor of your risk management practices relative to your risk context. A small nonprofit may be entirely appropriate at Tier 2; Tier 4 for a nonprofit with minimal digital assets and low threat exposure would represent over-investment.
For analysts
The NIST CSF is useful in BA contexts when scoping security requirements for new systems or assessing vendor security. Map proposed system designs to CSF functions to identify which control categories need addressing in requirements. The Identify function's asset management categories translate directly to data flow diagrams and information asset registers -- artifacts BAs routinely produce. When writing security NFRs, reference the relevant CSF subcategory and its informative reference to a specific control standard so that implementation teams have unambiguous guidance.
History & origin
The NIST Cybersecurity Framework originated from a 2013 executive order directing NIST to develop a voluntary framework for critical infrastructure cybersecurity following concern about nation-state attacks on power grids, water systems, and financial institutions. Version 1.0 was released in February 2014, developed through extensive public-private collaboration. Version 1.1 (April 2018) added supply chain risk management and self-assessment guidance. CSF 2.0 (February 2024) expanded the framework's scope beyond critical infrastructure to all organizations, added the Govern function, and restructured implementation guidance.