NIST CSF 2.0 is version 2.0 of the NIST Cybersecurity Framework, published in February 2024. It organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. The biggest change from version 1.1 is the new Govern function, which puts cybersecurity strategy, roles, policy and supply chain risk under leadership oversight, a role many mid-size organizations fill with a virtual CISO. The framework is voluntary, applies to organizations of any size or sector, and is widely used in the USA and internationally to measure and improve security programs.
Key Takeaways
- CSF 2.0 adds Govern as a sixth function at the center of the framework.
- The scope expanded from critical infrastructure to all organizations.
- Profiles describe current and target states; tiers describe the rigor of risk management practices.
- Supply chain risk management is more prominent.
- A gap assessment against CSF 2.0 gives leadership a clear, prioritized roadmap.
The Six Functions
| Function | Purpose | Example outcomes |
|---|---|---|
| Govern (GV) | Set strategy, expectations and policy | Roles and responsibilities, risk appetite, supply chain risk management |
| Identify (ID) | Understand assets and risks | Asset inventory, risk assessment, improvement |
| Protect (PR) | Safeguard assets | Identity and access management, training, data security, platform security |
| Detect (DE) | Find attacks and anomalies | Continuous monitoring, adverse event analysis |
| Respond (RS) | Act on detected incidents | Incident management, analysis, communication, mitigation |
| Recover (RC) | Restore operations | Recovery plan execution, communication |
Profiles and Tiers
Organizational profiles describe your current state and target state against CSF outcomes. The gap between them becomes your action plan. Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorous and integrated your risk governance and management practices are.
How to Run a NIST CSF 2.0 Gap Assessment
- Agree scope and business priorities with leadership.
- Collect evidence across all six functions: policies, configurations, logs, interviews.
- Score current maturity for each category.
- Define a target profile based on risk appetite, regulatory and customer needs.
- Prioritize gaps by risk and effort.
- Build a 12–18 month roadmap with owners and budgets.
Mapping CSF to Microsoft Security Tools
- Identify: Intune and Defender device inventory, Defender Vulnerability Management.
- Protect: Entra ID, Conditional Access, Purview DLP, sensitivity labels.
- Detect: Defender XDR and Microsoft Sentinel.
- Respond: automated investigation, playbooks, incident response plans.
- Recover: Azure Backup, Microsoft 365 backup and disaster recovery.
CSF vs ISO 27001 vs SOC 2
NIST CSF is a flexible outcomes framework, not a certification. ISO 27001 is a certifiable management system standard, and SOC 2 is an attestation report. Many organizations use CSF to structure their program and then pursue ISO 27001 certification or SOC 2 for customers.
How Skytech Enterprise Helps
Our NIST CSF gap assessment delivers current and target profiles, a prioritized roadmap and board-ready reporting. For ongoing leadership, see our virtual CISO service. Request an assessment.
Frequently Asked Questions
What is new in NIST CSF 2.0?
CSF 2.0 adds the Govern function, broadens the audience to all organizations, expands supply chain risk guidance and adds implementation examples and quick-start guides.
Is NIST CSF mandatory?
For most private organizations it is voluntary. Some government contracts, regulators and customers reference it as an expected baseline.
Can you be certified in NIST CSF?
No. There is no official NIST CSF certification. Organizations demonstrate alignment through assessments and reporting.
How many functions are in NIST CSF 2.0?
Six: Govern, Identify, Protect, Detect, Respond and Recover.
Is NIST CSF used outside the USA?
Yes. Organizations worldwide, including in the Middle East, use CSF to structure security programs and communicate with leadership.
How often should we reassess against CSF?
Many organizations reassess annually and track progress against the target profile quarterly.