Platform
Modules
By sector
By sector
By standard
Blog
News
Events
NIST CSF 2.0
Individuals developing and leading a cybersecurity programme, and the executives, risk managers and acquisition professionals who use it to communicate risk
NIST's voluntary taxonomy of cybersecurity outcomes, Govern, Identify, Protect, Detect, Respond and Recover, that organisations use to assess their own risk posture and communicate it; there is no certification against it.
The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary taxonomy of high-level cybersecurity outcomes, published by the US National Institute of Standards and Technology, that "any organization... regardless of its size, sector, or maturity" can use to understand, assess, prioritise and communicate its cybersecurity risk. It does not prescribe how an outcome should be achieved or in what order; it describes what a well-run cybersecurity programme covers, then leaves the how to a separate, continuously updated set of online resources.
Before this version the document was called the "Framework for Improving Critical Infrastructure Cybersecurity," a title the document says plainly "is not used for CSF 2.0." The 2.0 revision broadens the framing from critical infrastructure to any organisation and adds GOVERN, a new Function placed at the centre of the model because governance decisions set priorities for the other five.
The CSF Core (Appendix A) organises outcomes under six Functions, each split into Categories and further into Subcategories describing an outcome rather than a procedure:
Two mechanisms sit above the Core. An Organizational Profile (Current and/or Target) records which outcomes an organisation is achieving now and which it has prioritised for later, scoped as broadly or narrowly as the organisation chooses: an entire organisation, or something as specific as "countering ransomware threats and handling ransomware incidents involving those financial systems." Tiers then characterise how rigorous the organisation's governance and risk management practices actually are, from Partial (Tier 1: ad hoc, "generally unaware of the cybersecurity risks associated with its suppliers") to Adaptive (Tier 4: organisation-wide and continuously improving). Neither is scored against a passing threshold; they describe a state, and the gap between a Current and a Target Profile becomes the organisation's own action plan.
The document names "individuals responsible for developing and leading cybersecurity programs" as its primary audience, extending to executives, boards of directors, acquisition professionals, risk managers, and those who make and influence policy. Nothing in the CSF creates an obligation by existing: it "may be adopted voluntarily and through governmental policies and mandates," and, in practice, a supplier often meets it because a customer that has already adopted the CSF sets out its "requirements and expectations to suppliers, partners, and other third parties as a target for those parties to achieve" through a Target Profile.
NIST is a US federal agency, but the CSF is explicit that its "taxonomy and referenced standards, guidelines, and practices are not country-specific," and notes that earlier versions "have been leveraged successfully by many governments and other organizations both inside and outside of the United States."
The Subcategories describe outcomes, not procedures, and the CSF supplies none of the how itself: that is delegated to Informative References, Implementation Examples and Quick-Start Guides, hosted online and revised on their own schedule, separately from this document. The numbering inside the Core is also deliberately not sequential: gaps in the numbering mark where a CSF 1.1 Subcategory was relocated in 2.0, not an error.
There is no certification against the CSF. The document names no accreditation body, government-surveillance regime, or notified body; it simply does not describe one. What it describes instead is self-assessment: an organisation documents its current and target posture, works out the gaps, and tracks the result through its own action plan (a risk register, a risk detail report, or a Plan of Action and Milestones), reviewed as part of its own ongoing risk management.
The one place a third party enters is contractual, not official: a customer or partner that has adopted the CSF can hold a supplier to a Target Profile as a stated expectation. What that customer checks, in that case, is whatever the Target Profile specifies, since the CSF itself sets no pass mark. A regulator or agency that has adopted the CSF through its own policy checks against that policy, not against this document.
NIST's own Risk Management Framework (NIST SP 800-37) and security controls catalogue (NIST SP 800-53) are named as the pairing the CSF complements for an organisation already using them. [NIST SP 800-30](/standards/nist-sp-800-30), the risk assessment guide, and [NIST AI RMF](/standards/nist-ai-rmf), which uses the same Function/Category/Subcategory structure for AI-specific risk, are both named directly. The NIST Privacy Framework, SP 800-161r1 (supply chain risk), SP 800-221 and SP 800-221A (enterprise ICT risk), and NIST IR 8286 A-D (enterprise risk management) are each named for a specific integration point; none are yet in our catalogue, so they are named here rather than linked.
The CSF itself is a taxonomy, not a stack of paperwork to produce on its own account. What an organisation actually builds while working through it is a set of real documents: a risk management policy (GOVERN), an asset inventory and risk register (IDENTIFY), access-control and training records (PROTECT), monitoring and incident records (DETECT and RESPOND), and a recovery plan with verified restoration evidence (RECOVER), plus the Current and Target Profiles that tie the picture together.
ComplyTrain, as a quality management and evidence system, is where an organisation holds the documents and records that trail creates: the risk management policy and its review history, supplier risk assessments and contract requirements, training records showing personnel completed cybersecurity awareness training, and the audit trail connecting a Current Profile finding to the corrective action that closed it. Two concrete examples: a controlled policy document that carries its own review and approval history, and a training record proving awareness training reached the specialised roles it was aimed at.
ComplyTrain does not perform the technical work the Functions describe: it does not monitor a network, run incident analysis, or execute a recovery. Those are security operations carried out with an organisation's own tools and people. What ComplyTrain holds is the evidence that the policy existed, the training happened, and the finding was tracked to closure. Most readers here are already holding a customer security questionnaire or a new obligation that references the CSF; the standards explorer shows what else sits alongside it, and if your organisation needs to hold that trail, talk to us.
Tell us how you need to work with NIST CSF 2.0 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. The CSF is voluntary guidance that "may be adopted voluntarily and through governmental policies and mandates." It becomes a practical requirement only where a government policy references it or a customer contract sets it as an expectation; the document itself creates no obligation.
No. The CSF names no accreditation body, certifying body, or audit scheme of any kind. An organisation documents its own posture through an Organizational Profile; there is nothing to be certified against.
CSF 2.0 adds GOVERN as a new Function, placed at the centre of the model because governance decisions set priorities for the other five. It also broadens the framing from critical infrastructure specifically to any organisation, and adds a dedicated Cybersecurity Supply Chain Risk Management category. The framework's older name, "Framework for Improving Critical Infrastructure Cybersecurity," is no longer used.
They work together rather than compete. SP 800-53 is NIST's catalogue of security controls; the CSF's outcomes give an organisation already using SP 800-53 a way to select and prioritise which controls to apply first, without replacing the controls themselves.
No. It describes the full set of outcomes any organisation might consider and leaves the selection, scoping and prioritisation to the organisation building its own Profile, based on its mission, risk appetite and stakeholder expectations.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.