NIST CSF 2.0
Plain-language NIST CSF 2.0 guide to the six Functions, Current and Target Profiles, , implementation examples, evidence, and action planning.
Published by NIST on February 26, 2024, CSF 2.0 is guidance for managing cybersecurity risk through a common taxonomy of outcomes. Organizations can adopt it voluntarily, while laws, policies, or contracts may separately require or reference its use. The CSF itself is not a certification scheme or proof of compliance.
Define the organizational, system, service, supplier, or threat-scenario scope; use GOVERN to establish context and direction; and address all six Functions together across relevant IT, operational technology, Internet of Things, cloud, mobile, and AI environments. Build a from outcomes achieved now, select and prioritize a , analyze the gaps, and choose actions and evidence that fit the organization's risks and requirements.
Set the boundary, gather evidence, resolve outcome decisions, and assign owners to a gap action plan.
Record one Profile header and one row per selected outcome, with Current evidence, Target priority, gap, decision, and action owner.
Connect a scoped outcome to a claim and supporting records, then document coverage, uncertainty, and the next decision.
Establish organizational context, risk strategy, roles, policy, oversight, and cybersecurity supply-chain risk management. GOVERN informs how the other five Functions are prioritized and carried out.
Scope an , document current and desired outcomes, analyze the differences, and maintain a prioritized action plan with owners and review triggers.
Work at Category and Subcategory level, then select context-appropriate practices, controls, and records. NIST's examples and mappings inform choices but are not mandatory baselines.
New to the framework? Start with what CSF 2.0 is, what it does not require by itself, and how the six Functions work together. Then build Profiles, choose implementation evidence, and use comparisons only after your scope and desired outcomes are clear.
Understand the Core, why GOVERN informs the other five Functions, and how NIST guidance differs from a certification or a legal, contractual, or policy requirement that separately calls for CSF use.
Define a useful boundary, gather policies and risk information, document the , select and prioritize the , and turn the gap analysis into an action plan.
Select context-appropriate actions, connect evidence to specific Subcategory outcomes, and check the scope of each mapping instead of treating examples or references as complete control baselines.
See when CSF outcomes can organize risk communication and when a control catalog, management-system standard, or system life-cycle process supplies a different kind of structure.
Use the FAQ for direct answers about , GOVERN, supplier risk, board reporting, Profiles, examples, and evidence mapping.
"does not prescribe how outcomes should be achieved"
Next steps
Keep the Profile scope, selected outcomes, supporting evidence, gap decisions, owners, and review triggers together so teams can explain the current posture, the desired state, and the reason for each priority.
Turn selected NIST CSF 2.0 outcomes and Profile gaps into owned tasks, evidence requests, and review checkpoints.
Keep documents, evidence, and control records together with their sources and decisions.
Review your current process, evidence model, and next implementation steps.