Ask five security people where to start a cybersecurity programme and you will get five different frameworks. The NIST Cybersecurity Framework (CSF) 2.0 is a strong answer for most organisations, because it is free, it describes outcomes rather than products, and it gives you a common language that boards, IT teams and suppliers can all understand.
This guide explains what changed in version 2.0, how the Core, Tiers and Profiles fit together, which NIST resources are worth your time, and how a small business or an EU organisation can use the CSF alongside ISO 27001 and NIS2.
What the NIST CSF is
The CSF is published by the US National Institute of Standards and Technology. Version 2.0 was released on 26 February 2024 as NIST CSWP 29, replacing version 1.1 from 2018. As of October 2026, CSF 2.0 remains the current version; NIST continues to add supporting resources around it rather than revising the core document.
A few things set the framework apart:
- It is voluntary. Organisations can adopt it on their own, and governments can reference it in policy.
- It is outcome-based. NIST is explicit that the outcomes are not a checklist of actions; how you achieve them depends on your organisation.
- It is for everyone. Version 1.x was written with critical infrastructure in mind. Version 2.0 is aimed at organisations of all sizes and sectors, and NIST notes that its taxonomy is not country-specific.
- It is meant to be combined with other standards and frameworks, not to replace them.
The CSF Core: six functions
The Core organises cybersecurity outcomes into Functions, then Categories, then Subcategories. CSF 2.0 has 6 Functions, 22 Categories and 106 Subcategories.
| Function | Purpose | Categories |
|---|---|---|
| Govern (GV) — new | Establish, communicate and monitor cybersecurity risk strategy, expectations and policy | Organizational Context; Risk Management Strategy; Roles, Responsibilities and Authorities; Policy; Oversight; Cybersecurity Supply Chain Risk Management |
| Identify (ID) | Understand current cybersecurity risks | Asset Management; Risk Assessment; Improvement |
| Protect (PR) | Use safeguards to manage those risks | Identity Management, Authentication and Access Control; Awareness and Training; Data Security; Platform Security; Technology Infrastructure Resilience |
| Detect (DE) | Find and analyse possible attacks and compromises | Continuous Monitoring; Adverse Event Analysis |
| Respond (RS) | Take action on a detected incident | Incident Management; Incident Analysis; Incident Response Reporting and Communication; Incident Mitigation |
| Recover (RC) | Restore affected assets and operations | Incident Recovery Plan Execution; Incident Recovery Communication |
Why Govern matters
The biggest change in 2.0 is the new Govern function. It pulls together outcomes that were scattered in version 1.1 and adds new ones: understanding your organisational context, setting risk appetite and strategy, assigning roles and authority, approving policy, overseeing results, and managing supply chain risk. NIST places Govern at the centre of its function wheel because it informs how you implement the other five.
In practice, Govern is where cybersecurity becomes a management responsibility rather than an IT task. That is exactly the direction European regulation has taken: NIS2 makes management bodies approve and oversee cybersecurity risk-management measures and requires them to follow training.
The functions work together
NIST says the functions should be addressed concurrently. Govern, Identify, Protect and Detect activities run continuously; Respond and Recover must be ready at all times. If your incident response plan has not been tested, your Respond outcomes are weaker than they look on paper — our guide to incident response phases covers the basics.
Tiers: how rigorous is your risk management?
Tiers describe the rigour of your cybersecurity risk governance and management practices. There are four:
- Tier 1 — Partial: risk management is ad hoc and reactive, with limited awareness of cybersecurity risk across the organisation.
- Tier 2 — Risk Informed: management approves risk practices, but they may not be applied consistently organisation-wide.
- Tier 3 — Repeatable: practices are formally approved as policy and updated regularly as risks and requirements change.
- Tier 4 — Adaptive: the organisation adapts its practices based on lessons learned and predictive indicators, and cybersecurity risk is part of the culture.
Tiers are not maturity levels you must climb. NIST encourages moving to a higher Tier when risks or mandates are greater, or when the cost-benefit case supports it. A ten-person accounting firm may reasonably target Tier 2 or 3; a bank will aim higher.
Profiles: where you are and where you want to be
An Organizational Profile describes your cybersecurity posture in terms of Core outcomes. It has two parts:
- a Current Profile: the outcomes you are achieving now, and how well;
- a Target Profile: the outcomes you have chosen and prioritised to meet your objectives, including anticipated changes such as new regulations or technologies.
The gap between the two becomes your action plan. NIST’s suggested steps are: scope the profile, gather information, create the profile, analyse gaps and build a prioritised action plan, then implement and update. You can have several profiles, for example one for the whole company and one focused on ransomware.
A Community Profile is a baseline of outcomes published for a sector, technology or threat type. You can use one as the starting point for your Target Profile instead of building from scratch. NIST hosts profile templates and a repository of Community Profiles on the CSF website.
The supporting resources
CSF 2.0 is deliberately short. Most of the practical help lives in online resources that NIST updates more often than the framework itself.
Informative References
Informative References map Core outcomes to other standards, guidelines and regulations — for example, specific controls in NIST SP 800-53. When NIST launched CSF 2.0, it said the searchable catalogue already covered more than 50 other documents. The CSF 2.0 Reference Tool lets you browse, search and export the Core in human- and machine-readable formats. In August 2026 NIST finalised the Informative References Quick-Start Guide (SP 1347), which explains how to find, filter and apply these references.
Implementation Examples
Implementation Examples are short, action-oriented illustrations of how to achieve a Subcategory, such as documenting, monitoring or exercising something. They are notional, not a required baseline — but they are often the most useful part for a team that asks “what do we actually do?”
Quick-Start Guides
NIST publishes Quick-Start Guides for specific audiences and tasks. The current set includes guides on:
- resources and overview;
- small business (SP 1300);
- creating Organizational Profiles (SP 1301) and using Community Profiles;
- using Tiers;
- cybersecurity supply chain risk management;
- enterprise risk management;
- cybersecurity, enterprise risk and workforce management (SP 1308, finalised March 2026);
- informative references (SP 1347).
How a small business can use the CSF
The Small Business Quick-Start Guide (SP 1300) is written for small and medium businesses with modest or no cybersecurity plans. It walks through each of the six functions with practical first actions and questions to ask. NIST has published translations in French, Portuguese and Spanish.
A realistic starter plan:
- Govern: name an owner, write down which risks worry you most (data loss, fraud, downtime) and which laws and contracts apply.
- Identify: list your hardware, software, cloud services, accounts and the data you hold.
- Protect: turn on multi-factor authentication for email, banking and admin accounts, patch regularly, back up and test restores, and train staff.
- Detect: enable alerts from your email, endpoint and cloud platforms and make sure someone reads them.
- Respond: write a one-page incident plan with contacts (IT support, insurer, lawyer, authorities).
- Recover: know how you would restore critical systems and who communicates with customers.
Then capture this as a simple Current Profile and set a Target Profile for the next 12 months.
Using CSF 2.0 alongside ISO 27001 and NIS2
For European organisations, the CSF is not a competitor to ISO 27001 or NIS2. It is a useful lens on both.
With ISO 27001
ISO/IEC 27001 gives you a certifiable management system: scope, risk assessment, Statement of Applicability, internal audit and management review. CSF 2.0 gives you an outcome-based way to describe and communicate your posture. The two fit well:
- ISO/IEC 27002:2022 assigns each control a “cybersecurity concept” attribute using Identify, Protect, Detect, Respond and Recover, so you can sort Annex A controls by CSF function.
- Many Govern outcomes correspond to ISO 27001 clauses 4–6 and 9 (context, leadership, planning, performance evaluation).
- CSF Profiles and Tiers are a clear way to report ISMS progress to the board.
If certification is your goal, see our ISO 27001:2022 implementation roadmap. Mappings between the two published by vendors vary, so check any mapping against the source documents before relying on it.
With NIS2
NIS2 (Directive (EU) 2022/2555) Article 21 lists minimum risk-management measures, from risk analysis and incident handling to supply chain security, training, cryptography and MFA. Article 25 asks Member States to encourage European and international standards without favouring a particular technology. A CSF Target Profile built around those Article 21 areas gives you a structured gap analysis; our NIS2 compliance checklist lists the obligations to map.
Italy is a particularly good fit. ACN’s Determination 164179 of 14 April 2025 sets baseline NIS security measures built on the 2025 edition of the Framework Nazionale per la Cybersecurity e la Data Protection, a national framework shaped by NIST CSF. ACN has also supported UNI/PdR 174:2025, a reference practice harmonised with ISO/IEC 27001 and NIST CSF 2.0, so ISO-certified organisations can extend their ISMS toward those measures. If you already think in CSF functions, the Italian requirements will look familiar.
Remember that NIS2 also brings obligations no framework covers on its own, such as registration and incident reporting to national authorities. This is general guidance, not legal advice.
AceFortis runs practical training on NIST CSF 2.0, ISO 27001 and NIS2 governance for teams and management — get in touch to plan a session.
FAQ
Is NIST CSF 2.0 mandatory?
Not for private organisations in general. It is voluntary, though some governments, regulators and customers reference it in their own requirements.
Can you be certified against NIST CSF?
No. NIST does not offer CSF certification. You can self-assess or have a third party assess you against your profiles, but if you need a certificate, ISO 27001 is the usual route.
Is CSF 2.0 useful outside the United States?
Yes. NIST designed its taxonomy to be country-neutral, and frameworks such as Italy’s national cybersecurity framework draw on it.
What is the quickest way to start?
Read the Small Business Quick-Start Guide, build a one-page Current Profile across the six functions, and pick the three biggest gaps to close first.
Sources
- NIST CSWP 29 — The NIST Cybersecurity Framework (CSF) 2.0
- NIST — NIST Releases Version 2.0 of Landmark Cybersecurity Framework
- NIST — CSF 2.0 Quick-Start Guides
- NIST SP 1300 — CSF 2.0 Small Business Quick-Start Guide
- ACN — UNI/PdR 174:2025 (ISO/IEC 27001 and NIST CSF 2.0)
- EUR-Lex — Directive (EU) 2022/2555 (NIS2)
