NIST CSF 2.0 Explained: The Six Functions and a Practical Starting Point
NIST released Cybersecurity Framework 2.0 in 2024 with a new Govern function at its center. It is voluntary, widely referenced, and a useful structure for building a security program that other frameworks can plug into.
What the framework is
The NIST Cybersecurity Framework (CSF) is a voluntary framework that helps organizations understand, assess, prioritize, and communicate cybersecurity risk. Version 2.0, released in February 2024, extends the original scope beyond critical infrastructure to organizations of any size and sector. It is not a certification and not a list of mandatory controls. It is a structure for organizing the work.
The six functions
- Govern (new in 2.0): risk strategy, roles, policy, supply chain risk, and oversight by leadership
- Identify: asset inventory, business environment, risk assessment, and improvement planning
- Protect: identity and access management, awareness and training, data security, platform security, and resilience
- Detect: continuous monitoring and adverse event analysis
- Respond: incident management, analysis, mitigation, and reporting
- Recover: restoring capabilities and services after an incident
Profiles and tiers
A profile describes your current state and target state across the functions, so you can see the gap between them. Profiles are the working tool for prioritizing investment. Implementation tiers describe how rigorously your organization applies risk management practices. They are not maturity levels, and a higher tier is not automatically better for every organization.
Why it matters for compliance work
CSF 2.0 is useful because it is a common language. It maps to controls in NIST SP 800-53, ISO/IEC 27001, and other frameworks through published informative references. Many customers reference it in security questionnaires, and it gives you a neutral structure for reporting to executives and boards. It is also often the simplest way to explain your program to a non-technical audience.
A practical starting point
- Govern: name an owner, define risk appetite in plain terms, and get leadership to review the risk register at least quarterly.
- Identify: build an asset inventory and data map. You cannot protect what you have not listed.
- Protect: start with identity. Enforce MFA, review privileged access, and remove stale accounts.
- Detect: centralize logs from identity, endpoints, and cloud, and assign someone to review alerts.
- Respond and Recover: write an incident response plan and test the backup restore, not just the backup job.
Use CSF 2.0 to organize the program, then use a control framework such as ISO 27001 or SOC 2 to prove it. The two are complementary, not competing.
Frequently asked questions
Is NIST CSF 2.0 a certification?
No. It is a voluntary framework. Organizations use it to structure programs and communicate risk. It is not certifiable.
What is new in CSF 2.0?
The most visible change is the Govern function, which covers risk strategy, roles, and oversight. The framework also broadened its scope beyond critical infrastructure.
Are CSF tiers the same as maturity levels?
No. Tiers describe how rigorously risk management is applied. They are not a scorecard, and a lower tier is not necessarily a failing grade for every organization.
How does CSF relate to CMMC or 800-171?
NIST SP 800-171 defines the controls that CMMC Level 2 assesses. CSF is a higher-level structure, and the two can be mapped to each other.
Related articles
Want this applied to your company?
A free 30-minute scoping call tells you which frameworks apply and what it would take.