NIST Cybersecurity Framework 2.0
NIST's voluntary cybersecurity risk-management framework, updated in February 2024 to add a sixth function — Govern — and to explicitly serve organizations of every size and sector, not just critical infrastructure.
The NIST Cybersecurity Framework is not a regulation and carries no direct legal force of its own — it's a voluntary, outcome-based framework organizations use to structure and communicate their cybersecurity risk-management posture. Version 2.0, published February 26, 2024, is organized around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern is new to 2.0 — it establishes and monitors an organization's cybersecurity risk-management strategy, expectations, and policy, and CSF 2.0 treats it as informing all five other functions rather than sitting alongside them as a peer.
Despite having no enforcement mechanism of its own, CSF 2.0 functions as a real, practical lingua franca across other frameworks — NIST SP 800-53 (which underlies FedRAMP), NIST SP 800-171 (which underlies CMMC), and it's frequently used as the reference vocabulary in framework-mapping tables across ISO 27001, SOC 2, PCI DSS, and DORA. An organization that maps its actual security program to the CSF's six functions typically finds the mapping to other frameworks meaningfully easier, since so much of the industry already speaks in Identify/Protect/Detect/Respond/Recover terms.
Who is impacted
Any organization, regardless of size, sector, or existing maturity — CSF 2.0 was explicitly rewritten to serve small and medium businesses as well as critical-infrastructure operators. No entity is legally required to adopt it, but many regulators and customer due-diligence processes reference it as a recognized baseline, making informal adoption pressure real even without a formal mandate.
Requirements
CSF 2.0 has no mandatory requirements — it's organized as six functions, each containing categories and subcategories describing security outcomes, plus four Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive) describing how mature and integrated an organization's risk-management practices are. Organizations select which subcategories are relevant to their own risk profile via an Organizational Profile, rather than being held to a single fixed checklist.
Key deadlines
NIST CSF 2.0 published
Executive guides & research
NIST CSF 2.0: The Complete Executive Guide
The six functions, Organizational Profiles, and Implementation Tiers behind NIST's voluntary cybersecurity framework — and why fluency in it makes every other framework easier.
Glossary
CSF Implementation Tier
One of four levels (Partial, Risk Informed, Repeatable, Adaptive) NIST CSF 2.0 uses to describe how mature and integrated an organization's cybersecurity risk-management practices are — a maturity descriptor, not a pass/fail compliance grade.
Govern Function (NIST CSF 2.0)
The function new to CSF 2.0 — establishing, communicating, and monitoring an organization's cybersecurity risk-management strategy, expectations, and policy. CSF 2.0 treats Govern as informing all five other functions rather than sitting alongside them as a peer.
Related
Stay ahead of NIST CSF 2.0 changes
Get Regulatory Alerts the moment something about NIST Cybersecurity Framework 2.0 changes — new deadlines, guidance updates, enforcement actions.