PlaybookGLOBAL

NIST CSF 2.0 Compliance

A practical operating model for NIST CSF 2.0 implementation with profiles, tiers, and evidence.

Designed for security, risk, audit, and leadership teams that need repeatable outcomes and board-readable metrics.

Author
Sorena AI
Published
Mar 4, 2026
Updated
Mar 4, 2026
Sections
6

Structured answer sets in this page tree.

Primary sources
4

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Mar 4, 2026
Updated Mar 4, 2026
Overview

NIST CSF 2.0 is an outcomes-based framework for managing cybersecurity risk. It does not prescribe exactly how to achieve outcomes. Instead, it gives organizations a common structure for understanding, assessing, prioritizing, and communicating cybersecurity risk using the CSF Core, Organizational Profiles, Tiers, and a growing online CSF portfolio of informative references, implementation examples, quick-start guides, and profile resources.

Section 1

Use CSF 2.0 the way NIST wrote it: outcomes first, controls second

CSF 2.0 describes desirable outcomes, not a mandatory task list. The Core is organized as Functions, Categories, and Subcategories, and the outcomes are sector-, country-, and technology-neutral so each organization can tailor them to its mission and risk profile.

That means CSF 2.0 works best when you pair it with your chosen control sources and practices instead of mistaking it for a prescriptive control catalog.

  • Use the Core to describe what good looks like
  • Use informative references and implementation examples to decide how to achieve the outcomes
  • Use one evidence index so the outcome view and the control view stay aligned
Section 2

Step 1 - Start with GOVERN because it sets the tone for all other Functions

NIST puts GOVERN in the center of the CSF wheel because it informs how the other five Functions are implemented. GOVERN covers organizational context, risk management strategy, roles and authorities, policy, oversight, and cybersecurity supply chain risk management.

The Core makes this more concrete through GOVERN categories such as GV.OC for organizational context, GV.RM for risk management strategy, and GV.SC for cybersecurity supply chain risk management.

  • Define mission, stakeholder expectations, legal and contractual requirements, and key dependencies
  • Establish risk objectives, risk appetite and tolerance, and enterprise-risk integration
  • Treat supplier and third-party governance as part of the core cyber program, not a side process
Section 3

Step 2 - Build a Current Profile with actual scope and evidence

A Current Profile specifies the Core outcomes the organization is currently achieving or attempting to achieve and characterizes the extent to which each outcome is achieved. NIST expects scope assumptions to be documented up front because an organization can have multiple profiles for different purposes.

A good Current Profile is evidence-based and scoped. It can cover the whole enterprise, a single business unit, a technology environment, or a threat-driven use case such as ransomware.

  • Document scope facts and assumptions before scoring outcomes
  • Select relevant outcomes and capture current-state evidence and implementation notes
  • Use the Current Profile to communicate capabilities and improvement opportunities internally and externally
Section 4

Step 3 - Define a Target Profile and use gap analysis to build the action plan

A Target Profile captures the desired and prioritized outcomes the organization selects to meet its cybersecurity risk management objectives. It should reflect mission needs, stakeholder expectations, legal and regulatory drivers, technology changes, and threat trends.

NISTs profile workflow explicitly calls for analyzing the gaps between the Current and Target Profiles and creating a prioritized action plan such as a risk register, risk detail report, or POA&M.

  • Use Community Profiles when they help accelerate or normalize a target state
  • Tie each priority outcome to planned work, owner, and due date
  • Refresh Target Profiles when requirements, technologies, or threat intelligence change
Section 5

Step 4 - Use Tiers to characterize rigor, not to perform false maturity theater

CSF Tiers characterize the rigor of cybersecurity risk governance and management practices. They complement a risk methodology rather than replace it and are explicitly described by NIST as a notional illustration.

The value of Tiers is strategic alignment: they help the organization communicate how formal, repeatable, and adaptive its practices need to be given its risk exposure and assurance demands.

  • Tier 1 Partial: ad hoc practices with limited awareness and weak supplier-risk consistency
  • Tier 2 Risk Informed: management-approved but not fully institutionalized practices
  • Tier 3 Repeatable: formalized policies and organization-wide, consistently implemented practices
  • Tier 4 Adaptive: continuous improvement, strong executive integration, and near real-time awareness
Section 6

Step 5 - Use the CSF portfolio and keep the program alive

CSF 2.0 is part of a larger portfolio. NIST explicitly points users to informative references, implementation examples, quick-start guides, and profile resources that are updated online. Those resources are what make the framework operational.

The program stays credible when outcomes, action plans, and evidence are reviewed continuously, especially as supplier dependencies, cloud environments, and AI systems change.

  • Map outcomes to references such as NIST SP 800-53, ISO 27001, or other internal control libraries
  • Use board and management reporting to show movement from Current to Target Profile
  • Treat profile updates, action-plan closure, and evidence refresh as a continuous cycle
Recommended next step

Turn NIST CSF 2.0 Compliance into an operational assessment

Assessment Autopilot can take NIST CSF 2.0 Compliance from operationalizing the guidance into a tracked program to a reusable workflow inside Sorena. Teams working on NIST CSF 2.0 can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Primary sources

References and citations

doi.org
Referenced sections
  • Primary source describing CSF 2.0 components: Core, Profiles, Tiers, and implementation approach.
Related guides

Explore more topics