---
title: "NIST CSF 2.0 vs NIST SP 800-53 Rev. 5: practical side-by-side comparison"
canonical_url: "https://www.sorena.io/artifacts/global/nist-csf-2-0/nist-csf-vs-nist-sp-800-53"
source_url: "https://www.sorena.io/artifacts/global/nist-csf-2-0/nist-csf-vs-nist-sp-800-53"
author: "Sorena AI"
description: "Compare NIST CSF 2.0 and NIST SP 800-53 Rev. 5 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows."
published_at: "2026-05-09"
updated_at: "2026-05-09"
keywords:
  - "NIST CSF 2.0 vs NIST SP 800-53 Rev. 5"
  - "NIST CSF 2.0"
  - "comparison"
  - "evidence mapping"
  - "source-linked decision"
  - "Cyber risk governance"
  - "Profiles"
  - "Tiers"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# NIST CSF 2.0 vs NIST SP 800-53 Rev. 5: practical side-by-side comparison

Compare NIST CSF 2.0 and NIST SP 800-53 Rev. 5 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

*Side-by-side* *GLOBAL* *NIST CSF 2.0*

## NIST CSF 2.0 vs NIST SP 800-53 Rev. 5: practical side-by-side comparison

Use the cited NIST sources to turn framework language into owners, evidence, review cadence, and decisions that a reader can act on.

This comparison helps teams mapping NIST CSF 2.0 with NIST SP 800-53 Rev. 5. The goal is not to pick a winner; it is to separate scope, owners, evidence, review cadence, and assurance so one implementation record can support both sides without overclaiming.

## NIST CSF 2.0 vs NIST SP 800-53 Rev. 5: practical side-by-side comparison

Compare NIST CSF 2.0 and NIST SP 800-53 Rev. 5 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

- **NIST CSF 2.0**: NIST CSF 2.0 is the primary scoping column: use it to confirm covered facts, accountable owners, mandatory artifacts, timing, and enforcement exposure before assigning implementation work.
- **NIST SP 800-53 Rev. 5**: NIST SP 800-53 Rev. 5 is the second workstream in this comparison. Use it to test where the comparator has different scope, owners, triggers, evidence, timing, enforcement, and reuse limits from NIST CSF 2.0.

| Dimension | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | Operational implication | Sources |
| --- | --- | --- | --- | --- |
| Scope and covered activity | CSF describes outcomes and communication structure. Use NIST CSF 2.0 to define the in-scope system, product, service, supplier, release, incident, or governance process before mapping evidence. | SP 800-53 provides a detailed control catalog and assessment ecosystem. Use NIST SP 800-53 Rev. 5 to define the separate assurance, certification, legal, contractual, or operating lens before claiming equivalence. | For scope, write separate acceptance criteria for NIST CSF 2.0 and NIST SP 800-53 Rev. 5; reuse evidence only where it proves both claims without changing the meaning. | [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.<br>[NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.<br>[NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.<br>[NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog.<br>[NIST SP 800-53A Rev. 5 Assessment Procedures](https://doi.org/10.6028/NIST.SP.800-53Ar5?ref=sorena.io) - Primary NIST source for control assessment objectives, methods, depth, and coverage. |
| Who must act | Assign NIST CSF 2.0 work to the owner who can approve the scoped risk, control, software, supplier, incident, or governance decision and provide evidence. | Assign NIST SP 800-53 Rev. 5 work to the owner who controls that program, contract, certification, legal obligation, or operational procedure. | A shared team can support both sides, but the accountable owner should be named separately for NIST CSF 2.0 and NIST SP 800-53 Rev. 5. | [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.<br>[NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.<br>[NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.<br>[NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog.<br>[NIST SP 800-53A Rev. 5 Assessment Procedures](https://doi.org/10.6028/NIST.SP.800-53Ar5?ref=sorena.io) - Primary NIST source for control assessment objectives, methods, depth, and coverage. |
| Trigger or threshold | NIST CSF 2.0: state the internal adoption trigger, such as a profile workshop, risk review, supplier reassessment, incident lesson learned, executive target profile, or customer request. | NIST SP 800-53 Rev. 5: state the control-selection trigger, such as system categorization, baseline tailoring, assessment planning, authorization work, contract requirement, or internal control-maturity review. | Record the adoption and control-selection criteria in plain language so security, risk, procurement, and assurance teams know when the comparison must be rerun. | [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.<br>[NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.<br>[NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization. |
| Core obligations | NIST CSF 2.0 requires organizations to select outcomes from its six Functions, build a Current Profile showing which outcomes are achieved today, create a Target Profile showing the desired security state, and produce a prioritized action plan to close the gap between the two profiles. The framework is outcome-oriented and does not prescribe specific controls, allowing organizations to draw on any control catalog to satisfy each selected outcome. | NIST SP 800-53 Rev. 5 requires organizations to select a control baseline (Low, Moderate, or High impact), tailor the catalog by applying overlays and organizational parameters, implement each selected control, document implementation details in a System Security Plan, and assess controls against their stated objectives using the SP 800-53A assessment procedures. Compliance is determined at the control level, and federal systems must obtain an Authorization to Operate based on the resulting evidence package. | Turn the comparison into an action list with separate duties, shared controls, and unresolved gaps, then cite the source that supports each reused artifact. | [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.<br>[NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.<br>[NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization. |
| Evidence and records | NIST CSF 2.0: keep the evidence that proves this side of the decision, including cited text, registers, policies, test records, contracts, notices, reports, approvals, or audit artifacts. | NIST SP 800-53 Rev. 5: keep comparator evidence in a distinct record set and link only the artifacts that genuinely satisfy both source-linked requirements. | Keep a traceable evidence matrix: source, claim, owner, artifact, review date, and whether the evidence satisfies NIST CSF 2.0, NIST SP 800-53 Rev. 5, or both. | [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.<br>[NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.<br>[NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization. |
| Timing and cadence | NIST CSF 2.0: capture the application date, commencement date, transition period, reporting clock, review cadence, remediation window, or certification renewal that controls this side. | NIST SP 800-53 Rev. 5: track the comparator schedule separately so a later deadline, recurring audit, or incident timer is not hidden by the other workstream. | Use separate clocks for each side and surface the earliest decision date, longest retention or review duty, and any transition period that changes implementation sequencing. | [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.<br>[NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.<br>[NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization. |
| Enforcement or assurance route | NIST CSF 2.0: identify the internal assurance route, profile review owner, governance forum, customer evidence request, or maturity review tied to this side. | NIST SP 800-53 Rev. 5: identify the control assessment route, assessor role, assessment objective, authorization package, customer audit request, or contractual assurance path tied to this side. | Escalate when assurance routes differ because a profile review, control assessment, customer audit, or contract counterparty may require different proof. | [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.<br>[NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.<br>[NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization. |
| Overlap and reuse | NIST CSF 2.0: reuse controls only where the source-linked duty, evidence standard, owner, and timing align with the comparator; otherwise keep a bridge note. | NIST SP 800-53 Rev. 5 can reuse evidence from the other side only when the same fact pattern, system boundary, control, owner, and source-linked requirement are genuinely aligned. | Reuse evidence carefully: overlap can reduce duplicated work, but it does not merge scope, actors, deadlines, penalties, or public-facing wording. | [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.<br>[NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.<br>[NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization. |
| Practical decision rule | Choose NIST CSF 2.0 as the primary lens when the question is about the NIST CSF 2.0 scope, terminology, evidence, and audience. | Choose NIST SP 800-53 Rev. 5 as the primary lens when the question is about the NIST SP 800-53 Rev. 5 scope, terminology, evidence, and audience. | When both apply, write one decision record with two source-linked claims instead of forcing one framework to stand in for the other. | [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.<br>[NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.<br>[NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.<br>[NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog.<br>[NIST SP 800-53A Rev. 5 Assessment Procedures](https://doi.org/10.6028/NIST.SP.800-53Ar5?ref=sorena.io) - Primary NIST source for control assessment objectives, methods, depth, and coverage. |

Sources for Scope and covered activity - NIST CSF 2.0:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Scope and covered activity - NIST SP 800-53 Rev. 5:

- [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog.
  - Quote: "catalog of security and privacy controls"
- [NIST SP 800-53A Rev. 5 Assessment Procedures](https://doi.org/10.6028/NIST.SP.800-53Ar5?ref=sorena.io) - Primary NIST source for control assessment objectives, methods, depth, and coverage.
  - Quote: "methodology and set of procedures"

Sources for Scope and covered activity - operational implication:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Who must act - NIST CSF 2.0:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Who must act - NIST SP 800-53 Rev. 5:

- [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog.
  - Quote: "catalog of security and privacy controls"
- [NIST SP 800-53A Rev. 5 Assessment Procedures](https://doi.org/10.6028/NIST.SP.800-53Ar5?ref=sorena.io) - Primary NIST source for control assessment objectives, methods, depth, and coverage.
  - Quote: "methodology and set of procedures"

Sources for Who must act - operational implication:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Trigger or threshold - NIST CSF 2.0:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Trigger or threshold - NIST SP 800-53 Rev. 5:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Trigger or threshold - operational implication:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Core obligations - NIST CSF 2.0:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Core obligations - NIST SP 800-53 Rev. 5:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Core obligations - operational implication:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Evidence and records - NIST CSF 2.0:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Evidence and records - NIST SP 800-53 Rev. 5:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Evidence and records - operational implication:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Timing and cadence - NIST CSF 2.0:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Timing and cadence - NIST SP 800-53 Rev. 5:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Timing and cadence - operational implication:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Enforcement or assurance route - NIST CSF 2.0:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Enforcement or assurance route - NIST SP 800-53 Rev. 5:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Enforcement or assurance route - operational implication:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Overlap and reuse - NIST CSF 2.0:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Overlap and reuse - NIST SP 800-53 Rev. 5:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Overlap and reuse - operational implication:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Practical decision rule - NIST CSF 2.0:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

Sources for Practical decision rule - NIST SP 800-53 Rev. 5:

- [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog.
  - Quote: "catalog of security and privacy controls"
- [NIST SP 800-53A Rev. 5 Assessment Procedures](https://doi.org/10.6028/NIST.SP.800-53Ar5?ref=sorena.io) - Primary NIST source for control assessment objectives, methods, depth, and coverage.
  - Quote: "methodology and set of procedures"

Sources for Practical decision rule - operational implication:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"

### When should teams use NIST CSF 2.0 first versus NIST SP 800-53 Rev. 5 first?

- Use NIST CSF 2.0 first when the primary need is to structure NIST outcomes, controls, practices, or response procedures into an owned program.
- Use NIST SP 800-53 Rev. 5 first when the dominant driver is control selection, assessment procedures, contractual assurance, authorization support, or a separate program such as FedRAMP.
- Use both when one set of evidence can support two clearly separated source-linked claims.

Sources for the practical decision rule:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"
- [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog.
  - Quote: "catalog of security and privacy controls"
- [NIST SP 800-53A Rev. 5 Assessment Procedures](https://doi.org/10.6028/NIST.SP.800-53Ar5?ref=sorena.io) - Primary NIST source for control assessment objectives, methods, depth, and coverage.
  - Quote: "methodology and set of procedures"

## How should teams use the NIST CSF 2.0 vs NIST SP 800-53 Rev. 5 comparison in practical compliance decisions?

Read the table row by row and write a decision record for the actual scope. The useful output is a source-linked mapping, not a broad statement that the two frameworks are similar.

- Define whether NIST CSF 2.0 outcomes or NIST SP 800-53 Rev. 5 controls are the primary driver for the decision.
- Identify shared evidence only after both the CSF Profile claim and the SP 800-53 control claim are clear.
- Keep NIST CSF 2.0 profile reviews, SP 800-53 control assessments, customer commitments, and internal governance timers separate.

Sources for this answer:

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
- [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog.
- [NIST SP 800-53A Rev. 5 Assessment Procedures](https://doi.org/10.6028/NIST.SP.800-53Ar5?ref=sorena.io) - Primary NIST source for control assessment objectives, methods, depth, and coverage.

*Recommended next step*

*Placement: after the practical workflow*

## Put this NIST CSF 2.0 guidance into practice

Use the cited sources to turn the guidance into scoped decisions, owners, evidence requests, and review checkpoints.

- [Open Assessment Autopilot for NIST CSF 2.0](/solutions/research-copilot.md): Create source-linked tasks, evidence requests, and review checkpoints for this NIST CSF 2.0 scope.
- [Review this NIST CSF 2.0 scope with Sorena](/contact.md): Check source coverage, ownership, evidence gaps, and next steps before publishing or operationalizing the work.

## Primary sources

- [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
  - Quote: "does not prescribe how outcomes should be achieved"
- [NIST Cybersecurity Framework Resource Center](https://www.nist.gov/cyberframework?ref=sorena.io) - NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
  - Quote: "CSF portfolio"
- [NIST SP 800-30 Rev. 1 Risk Assessment Guide](https://doi.org/10.6028/NIST.SP.800-30r1?ref=sorena.io) - NIST risk assessment guidance used as adjacent support for risk analysis and prioritization.
  - Quote: "Guide for Conducting Risk Assessments"
- [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog.
  - Quote: "catalog of security and privacy controls"
- [NIST SP 800-53A Rev. 5 Assessment Procedures](https://doi.org/10.6028/NIST.SP.800-53Ar5?ref=sorena.io) - Primary NIST source for control assessment objectives, methods, depth, and coverage.
  - Quote: "methodology and set of procedures"

## Related Topic Guides

- [How should teams handle evidence mapping under NIST CSF 2.0?](/artifacts/global/nist-csf-2-0/faq/evidence-mapping.md): How should teams handle evidence mapping under NIST CSF 2.0? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps.
- [How should teams handle implementation examples under NIST CSF 2.0?](/artifacts/global/nist-csf-2-0/faq/implementation-examples.md): How should teams handle implementation examples under NIST CSF 2.0? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps.
- [How should teams handle supplier risk under NIST CSF 2.0?](/artifacts/global/nist-csf-2-0/faq/supplier-risk.md): How should teams handle supplier risk under NIST CSF 2.0? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps.
- [How should teams handle target profiles under NIST CSF 2.0?](/artifacts/global/nist-csf-2-0/faq/target-profiles.md): How should teams handle target profiles under NIST CSF 2.0? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps.
- [How should teams handle tiers under NIST CSF 2.0?](/artifacts/global/nist-csf-2-0/faq/tiers.md): How should teams handle tiers under NIST CSF 2.0? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps.
- [NIST CSF 2.0 compliance playbook](/artifacts/global/nist-csf-2-0/compliance.md): Practical NIST CSF 2.0 compliance playbook guidance with source-linked decisions, owner checklists, evidence records, and implementation steps.
- [NIST CSF 2.0 Core Functions Deep Dive](/artifacts/global/nist-csf-2-0/core-functions.md): Practical NIST CSF 2.0 Core Functions Deep Dive guidance with source-linked decisions, owner checklists, evidence records, and implementation steps.
- [NIST CSF 2.0 current and target profile template: operating columns and evidence rows](/artifacts/global/nist-csf-2-0/current-target-profile-template.md): A practical NIST CSF 2.0 Current and Target Profile Operating Template workflow with steps, owners, evidence fields, decisions, and source-linked review triggers.
- [NIST CSF 2.0 Current vs Target Profile Template](/artifacts/global/nist-csf-2-0/current-vs-target-profile-template.md): Practical NIST CSF 2.0 Current vs Target Profile Template guidance with source-linked decisions, owner checklists, evidence records, and implementation steps.
- [NIST CSF 2.0 Evidence Mapping Workflow](/artifacts/global/nist-csf-2-0/csf-evidence-mapping-workflow.md): A practical NIST CSF 2.0 Evidence Mapping Workflow with steps, owners, evidence fields, decisions, and source-linked review triggers.
- [NIST CSF 2.0 FAQ: practical implementation questions](/artifacts/global/nist-csf-2-0/faq.md): Standalone NIST CSF 2.0 FAQ questions with source-linked answers, implementation checklists, and evidence guidance.
- [NIST CSF 2.0 GOVERN Function FAQ](/artifacts/global/nist-csf-2-0/faq/govern-function.md): Start the NIST CSF 2.0 GOVERN function by naming decision owners, risk strategy, policy expectations, oversight cadence, and supplier-risk accountability before mapping controls.
- [NIST CSF 2.0 Governance and Metrics Guide](/artifacts/global/nist-csf-2-0/governance-and-metrics.md): Practical NIST CSF 2.0 Governance and Metrics Guide guidance with source-linked decisions, owner checklists, evidence records, and implementation steps.
- [NIST CSF 2.0 Implementation Examples Guide](/artifacts/global/nist-csf-2-0/implementation-examples.md): Practical NIST CSF 2.0 Implementation Examples Guide guidance with source-linked decisions, owner checklists, evidence records, and implementation steps.
- [NIST CSF 2.0 Profile Workshop Template](/artifacts/global/nist-csf-2-0/profile-workshop-template.md): Practical NIST CSF 2.0 Profile Workshop Template guidance with source-linked decisions, owner checklists, evidence records, and implementation steps.
- [NIST CSF 2.0 Profile Workshop Workflow](/artifacts/global/nist-csf-2-0/profile-workshop-workflow.md): A practical NIST CSF 2.0 Profile Workshop Workflow with steps, owners, evidence fields, decisions, and source-linked review triggers.
- [NIST CSF 2.0 vs CIS Controls v8: mapping table and gap analysis](/artifacts/global/nist-csf-2-0/csf-vs-cis-controls.md): Compare NIST CSF 2.0 and CIS Controls with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.
- [NIST CSF 2.0 vs CIS Controls: practical side-by-side comparison](/artifacts/global/nist-csf-2-0/nist-csf-vs-cis-controls.md): Compare NIST CSF 2.0 and CIS Controls with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.
- [NIST CSF 2.0 vs ISO/IEC 27001: practical side-by-side comparison](/artifacts/global/nist-csf-2-0/nist-csf-vs-iso-27001.md): Compare NIST CSF 2.0 and ISO/IEC 27001 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.
- [NIST CSF 2.0 vs NIST RMF: practical side-by-side comparison](/artifacts/global/nist-csf-2-0/csf-vs-rmf.md): Compare NIST CSF 2.0 and NIST RMF with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.
- [NIST CSF 2.0 vs SP 800-53 Rev. 5: control mapping and coverage gaps](/artifacts/global/nist-csf-2-0/csf-vs-nist-sp-800-53.md): Compare NIST CSF 2.0 and NIST SP 800-53 Rev. 5 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.
- [NIST CSF 2.0: step-by-step workflow for building current and target profiles](/artifacts/global/nist-csf-2-0/current-target-profile-decision-workflow.md): Practical NIST CSF 2.0 Current and Target Profile Decision Workflow guidance with source-linked decisions, owner checklists, evidence records, and implementation steps.
- [What should an NIST CSF 2.0 Current Profile include to be useful for audits and risk decisions?](/artifacts/global/nist-csf-2-0/faq/current-profiles.md): A useful CSF 2.0 Current Profile should show current outcomes, accountable owners, supporting evidence, known gaps, dependencies, and review dates. It should be specific enough that a reviewer can understand what is true today without re-interviewing every team.
- [Which NIST CSF 2.0 metrics are useful for board and executive reporting?](/artifacts/global/nist-csf-2-0/faq/board-metrics.md): Use board-level CSF 2.0 metrics that show risk decisions, business impact, target-profile gaps, and progress against priorities. Avoid only reporting control counts; executives need to see whether cybersecurity outcomes are improving in the context of organizational objectives.


---

[Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/global/nist-csf-2-0/nist-csf-vs-nist-sp-800-53