Use the six Functions as connected groups of cybersecurity outcomes, not as project phases or six summary scores. GOVERN sets context and direction; all six Functions inform the organization's Current and Target Profiles.
Choose relevant outcomes at Category and Subcategory level, assign accountable owners, identify context-appropriate implementation and evidence, and track gaps through the Profile action plan.
Structured answer sets in this page tree.
Cited legal and guidance references.
Published in NIST CSF 2.0 on February 26, 2024, the is a sector-, country-, and technology-neutral taxonomy of cybersecurity outcomes arranged as Functions, Categories, and Subcategories. Its six Functions - GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER - are not sequential project phases or a checklist. Address them concurrently: GOVERN informs priorities for the other five, while the full set covers preparation, protection, detection, incident handling, and restoration.
Functions are the highest level of the Core. CSF 2.0 divides them into 22 Categories and then into more specific outcomes. Use the Function level to communicate the shape of the program; use Categories and Subcategories to make implementation, ownership, evidence, and gap decisions.
The Core applies to all information and communications technology used by the organization, including information technology, operational technology, and Internet of Things, as well as cloud, mobile, and artificial intelligence environments. A specific can cover the entire organization or a narrower boundary such as financial systems, a supplier relationship, or a ransomware scenario; exclusions should be explicit so Function-level claims are not read as enterprise-wide.
The order and visual size of Functions, Categories, and Subcategories do not establish sequence or importance. NIST says GOVERN, IDENTIFY, PROTECT, and DETECT actions should happen continuously. RESPOND and RECOVER capabilities should remain ready and operate when incidents occur.
Dependencies run in both directions. Asset and risk information from IDENTIFY shapes safeguards under PROTECT. Planning and testing under GOVERN and IDENTIFY support DETECT, RESPOND, and RECOVER. Incident and exercise findings feed the IDENTIFY Improvement Category and can change governance priorities, policies, and the Target Profile.
The CSF describes desired outcomes but does not prescribe how to achieve them. Select evidence that shows the outcome for the defined scope and period. A policy may support a GOVERN outcome, for example, but technical records, tests, and monitoring may be needed to support related PROTECT or DETECT outcomes.
The examples below are evidence choices, not NIST requirements. The appropriate record depends on the selected , technology, risk, external requirements, and the conclusion the organization needs to support.
Connect selected Subcategory outcomes to owners, implementation records, evidence, gap decisions, and review points.
Create cited tasks, evidence requests, and review checkpoints for this NIST CSF 2.0 scope.
Check source coverage, ownership, evidence gaps, and next steps before using the Profile in an assessment or publishing it.
A Function-level percentage can hide materially different outcomes, risks, and evidence. If the organization uses scores, retain the -level judgments, weighting method, scope, evidence, exceptions, and uncertainty. Report significant gaps directly instead of relying on an average.
Keep the Core separate from supporting resources. Informative References map relationships to other content and may provide only partial coverage. Implementation Examples illustrate possible actions and are neither exhaustive nor a required baseline.
NIST gives a five-step Profile process: scope the Profile, gather information, create it, analyze gaps and create an action plan, then implement the plan and update the Profile. Repeat the process when risks, requirements, technologies, evidence, or organizational context change.
A Current Profile records outcomes achieved or being attempted and how or to what extent they are achieved. A Target Profile contains selected and prioritized desired outcomes. A Community Profile can inform the Target Profile, but the organization still has to tailor it to its own scope, mission, stakeholders, threats, and requirements.