What is NIST CSF?

Why organizations need a common cybersecurity language

A ransomware attack, a stolen credential or a compromised supplier does not stay inside the IT department. It stops production, exposes customer data and forces management to answer questions it may not be ready for. Who is responsible for cybersecurity? What are the most important assets? How quickly can the organization recover? Boards, regulators, insurers and customers increasingly ask these questions in the same terms.

The NIST CSF was created to give organizations a shared way to answer them. NIST is a non-regulatory agency of the US Department of Commerce, and the CSF is a framework of good practice built through collaboration with industry. It describes outcomes in plain terms so that technical teams, executives and suppliers can talk about cybersecurity risk without a different vocabulary in every meeting.

What is the NIST Cybersecurity Framework?

The NIST CSF is a set of guidance, organized as outcomes, that helps an organization manage and reduce cybersecurity risk. It does not tell the organization how to inventory its devices or which tool to buy; it states the outcome to achieve, such as having an inventory of hardware and software, and leaves the method to the organization.

The framework began in response to US Executive Order 13636 in 2013 and was first published in 2014 as a framework for critical infrastructure. Version 1.1 followed in 2018. CSF 2.0, the current version, was published in 2024 and extends the scope from critical infrastructure to organizations of all types and sizes, in any country. NIST's page lists CSF 1.1 as an archive, so confirm that you are working from CSF 2.0.

The CSF is voluntary. Some regulations, contracts and customers reference it, but the framework itself does not create legal obligations.

NIST CSF vs. ISO 27001

The NIST CSF and ISO 27001 are often compared. Both address information security and cybersecurity risk, but they are different in nature, and many organizations use them together.

• Nature: ISO 27001 specifies requirements for an information security management system (ISMS) that can be audited; the NIST CSF is a framework of outcomes that organizations use voluntarily
• Certification: an organization can be certified against ISO 27001 by an accredited certification body; the CSF has no certification, and NIST does not issue certificates
• Approach: ISO 27001 requires a management system with clauses on context, leadership, risk assessment, audit and review; the CSF describes outcomes and leaves the management method to the organization
• Controls: ISO 27001 Annex A provides a reference list of controls; the CSF provides categories and subcategories that can be mapped to controls from ISO 27001 and other sources
• Use together: many organizations use the CSF to communicate and prioritize risk, and ISO 27001 to build and certify the management system

The six functions of CSF 2.0

The core of the CSF is organized into six functions. They are not steps to be completed once; they are performed concurrently and continuously and together describe the full life cycle of cybersecurity risk management.

• Govern: establish and monitor the organization's cybersecurity risk management strategy, expectations and policy. This is the function added in CSF 2.0, and it covers context, strategy, roles and responsibilities, policy, oversight and supply chain risk management. Is the board actually setting risk tolerance?
• Identify: understand the organization's assets, suppliers and risks so that effort is focused where it matters. For example, a company cannot protect a system it does not know it has
• Protect: use safeguards to manage risk, including identity management and access control, awareness and training, data security, platform security and the resilience of technology infrastructure
• Detect: find and analyse possible attacks and compromises through continuous monitoring and adverse event analysis
• Respond: take action on a detected incident through incident management, analysis, reporting and communication, and mitigation
• Recover: restore assets and operations affected by an incident, including executing the recovery plan and communicating about recovery

Categories, subcategories and informative references

Each function is divided into categories, and each category into subcategories. In the published CSF 2.0 there are 22 categories and 106 subcategories, each stating a specific outcome. For example, the Protect function contains a category on data security, and its subcategories describe outcomes such as protecting data at rest and in transit.

Informative references are mappings from the subcategories to the controls of other standards and frameworks, such as ISO 27001 and NIST's own control catalogs. They help the organization choose how to achieve each outcome and make it easier to align the CSF with existing compliance work. The exact references and the current list of categories and subcategories should be taken from the published document and NIST's online resources.

Profiles and tiers

Two features make the CSF practical in management discussions: organizational profiles and tiers.

• Current profile: a description of the cybersecurity outcomes the organization is achieving now, written using the CSF's categories and subcategories
• Target profile: a description of the outcomes the organization wants to achieve, based on its objectives, risks and requirements
• Gap analysis: the difference between current and target profiles, which becomes the action plan with owners, milestones and resources
• Community profiles: shared profiles for a sector or use case, which can be used as a starting point
• Tiers: a way to describe the rigor of the organization's governance and risk management practices, from Partial to Risk Informed, Repeatable and Adaptive. Tiers are not maturity levels to be reached at any cost; a higher tier is appropriate only where the risk justifies it

Who uses the NIST CSF?

The CSF is used by organizations in many sectors, from small businesses to large enterprises and public bodies, and it is referenced in many countries outside the United States. It is particularly useful where an organization wants a flexible starting point for a cybersecurity programme, needs a way to report risk to management, or has to describe its posture to customers, insurers or regulators.

Organizations also use it for supply chain discussions, because the Govern function includes cybersecurity supply chain risk management. In regulated sectors, the CSF can help organize the work for requirements such as DORA or NIS 2, but it does not replace compliance with those laws.

How to implement the NIST CSF

NIST provides quick-start guidance for using the framework, and the general sequence is simple. The steps below follow it in practical terms.

• Scope: define the part of the organization to assess, its objectives and its risk tolerance
• Gather information: identify assets, systems, regulations, contractual requirements and threats
• Create a current profile: record which outcomes are achieved today and how well
• Assess risk: evaluate the likelihood and impact of cybersecurity events in the scoped environment
• Create a target profile: set the outcomes the organization wants and the tier that fits the risk
• Analyse gaps and plan: prioritize the differences between the profiles into an action plan with owners and dates
• Implement and measure: carry out the plan, collect evidence and report progress to management
• Repeat: update the profiles as the business, threats and technology change

Evidence, assurance and how ComplyEncrypt helps

Because there is no certificate, assurance for the NIST CSF comes from evidence: policies, risk assessments, asset inventories, monitoring records, incident reports, exercise results and management reporting that show each outcome is met. An internal or independent assessment against the CSF is useful, but the report is the organization's own evidence, not an official NIST certification. What would an auditor ask to see for each outcome you claim?

NIST CSF is on the ComplyEncrypt roadmap. ComplyEncrypt is built to bring profile templates, policy and procedure drafts, risk and asset records, mappings between the CSF and ISO 27001, GDPR and other frameworks, internal-audit preparation and corrective-action tracking into an AI-assisted workflow. AI assistance applies to documentation work; people still set risk tolerance, make decisions and carry out the controls. A vigorous cybersecurity programme is one that management can explain in its own words. See the NIST CSF framework page for current availability.