NIST CSF guide
NIST Cybersecurity Framework 2.0: functions, tiers and help
The NIST Cybersecurity Framework (CSF) is a voluntary framework from the US National Institute of Standards and Technology for managing cybersecurity risk. Version 2.0, released on 26 February 2024, is the first major update since the framework was created in 2014.
CSF 2.0 is written for organisations of any size or sector, not only critical infrastructure. It describes outcomes to achieve rather than controls to copy, so you pair it with a control catalogue such as NIST SP 800-53 or ISO 27001 Annex A.
Published 4 November 2026. Last reviewed 6 November 2026. This guide is general information, not legal advice.
Who uses the NIST CSF
CSF 2.0 is meant for organisations of every size, sector and maturity, in the US and elsewhere. Companies use it to structure their security programme and to report to the board, because its six Functions give security teams and executives a shared vocabulary.
The six Functions
- Govern (new in 2.0): the organisation's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored
- Identify: the organisation's current cybersecurity risks are understood
- Protect: safeguards to manage those risks are used
- Detect: possible cybersecurity attacks and compromises are found and analysed
- Respond: actions are taken about a detected cybersecurity incident
- Recover: assets and operations affected by an incident are restored
Profiles and Tiers
An Organizational Profile describes your security posture in terms of CSF outcomes. A Current Profile records the outcomes you achieve today and a Target Profile the outcomes you aim for; the gap between them becomes your plan. Community Profiles are public baselines for a sector, technology or threat that you can build your Target Profile on.
Tiers describe how rigorous your cybersecurity risk governance and management are, from Tier 1 (Partial) through Tier 2 (Risk Informed) and Tier 3 (Repeatable) to Tier 4 (Adaptive).
Supporting resources
NIST publishes Quick-Start Guides for specific audiences such as small businesses, Implementation Examples that suggest concrete actions for each Subcategory, and informative references that map CSF outcomes to more than 50 other documents, including NIST SP 800-53 Rev. 5. The online CSF 2.0 Reference Tool lets you browse and export the core.
What good NIST CSF help looks like
NIST does not offer certifications or endorsements of CSF-related products, implementations or services, so there is no accredited CSF assessor. Treat any "CSF certified" badge with suspicion.
Useful outside help builds your Current and Target Profiles, agrees target Tiers with leadership, turns the gap into a prioritised plan, and maps the outcomes to the controls you already use, such as ISO 27001 or SP 800-53. Ask providers for profiles they have built in your sector and how they report progress to a board.
How CISO Talents helps
At launch you can post a vCISO request through a guided brief, for example to run a CSF assessment, report to the board and work through the roadmap. Verified vCISOs and consultants who list NIST CSF work see it with the reason it matched, and reply in a common format.
Frequently asked questions
Is the NIST Cybersecurity Framework mandatory?
No. The CSF is voluntary. Customers, contracts or sector regulators may ask you to align with it, but NIST itself does not require anyone to use it.
Is there a NIST CSF certification?
No. NIST does not offer certifications or endorsements of CSF-related products, implementations or services. A provider can assess you against the CSF, but the result is their opinion, not a certificate.
What changed in NIST CSF 2.0?
The main changes are the new Govern Function, a scope that covers all organisations rather than mainly critical infrastructure, and new resources such as Quick-Start Guides, Implementation Examples and the online Reference Tool.
