NIST Cybersecurity Framework (CSF)

Cybersecurity can be hard to discuss outside technical teams. Boards and executives want to know how well the organization is protected and where to invest, but security teams often describe their work in terms of tools and technical controls. The NIST Cybersecurity Framework bridges this gap. It organizes cybersecurity into a small number of high-level functions and outcomes that leaders can understand, while linking each outcome to more detailed standards and controls that practitioners use. Organizations use it to assess where they are today, decide where they want to be and plan how to close the gap. Because it describes outcomes rather than specific tools, it can be applied by organizations of very different sizes and sectors.

NIST first published the framework in 2014, following a US executive order on improving critical infrastructure cybersecurity, and updated it in 2018. Version 2.0, released in February 2024, broadened its scope from critical infrastructure to organizations of all sizes and sectors and added a new Govern function. Although it is voluntary for most private organizations, it is widely used in the United States and internationally. For security, risk and technology leaders, the CSF provides a common structure for measuring and reporting cybersecurity maturity.

Definition of NIST Cybersecurity Framework

The NIST Cybersecurity Framework is a set of cybersecurity outcomes, organized into functions, categories and subcategories, that organizations can use to describe their current and target cybersecurity posture, identify gaps and prioritize actions, without prescribing how the outcomes must be achieved.

It is often used alongside the more detailed controls in NIST 800-53 or ISO 27001, and its outcomes can be linked to an organization's own controls through control mapping.

The Six Functions of CSF 2.0

Govern establishes and monitors the organization's cybersecurity strategy, expectations, policy, roles and supply chain risk management. It was added in version 2.0 to emphasize leadership's role. Govern sits at the center of the framework and informs how the other five functions are carried out.

Identify helps the organization understand its assets, suppliers and current cybersecurity risks.

Protect covers safeguards to manage risks, such as identity management, training, data security and platform security.

Detect covers finding and analyzing possible attacks and compromises.

Respond covers taking action once an incident is detected, including analysis, containment, reporting and communication.

Recover covers restoring assets and operations affected by an incident. Together, the six functions describe the full cycle of managing cybersecurity risk.

Profiles and Tiers

A current profile describes the outcomes the organization achieves today, and a target profile describes the outcomes it aims to achieve.

Comparing the two profiles shows gaps, which can be prioritized into an action plan. Profiles can be built for the whole organization or for specific systems or business units.

Tiers, from Tier 1 Partial to Tier 4 Adaptive, describe how rigorous and integrated the organization's cybersecurity risk management practices are. The tiers in between are Risk Informed and Repeatable. Higher tiers are not always necessary, and organizations should choose a target tier that fits their risks.

NIST also publishes community profiles for specific sectors and quick-start guides for smaller organizations.

Importance of the NIST Cybersecurity Framework in Risk and Compliance

The CSF creates a common language. Executives, boards, security teams and suppliers can discuss cybersecurity using the same functions and outcomes. This shared structure makes it easier to compare organizations, business units and suppliers.

It supports prioritization. Profiles and gap analysis help organizations focus limited resources on the outcomes that matter most.

It also connects cybersecurity to enterprise risk. The Govern function and related NIST guidance encourage organizations to manage cyber risk as part of enterprise risk management, not in isolation.

The NIST Cybersecurity Framework and Financial Management

Gaps between current and target profiles can be costed, giving leaders a clear basis for cybersecurity budget requests.

Tracking progress against the target profile over time shows what security investment is achieving.

Many cyber insurers and customers ask about CSF-aligned practices, which can affect premiums and contract terms.

Using the CSF as an umbrella over several detailed frameworks avoids building separate programs for each.

Common Challenges

Because the CSF describes outcomes rather than specific controls, organizations must decide how to implement and measure each outcome.

Self-assessments of maturity can be optimistic without evidence or independent review. Internal audit or an outside assessor can provide a more objective view.

Organizations that adopted earlier versions need to update their profiles and reporting for version 2.0, especially the new Govern function. NIST publishes mappings between versions, which make this transition easier.