What is the NIST Cybersecurity Framework (CSF 2.0)? Explained simply

The problem the CSF solves

Most organizations know they should manage cybersecurity risk. The hard part is describing where they stand in words that executives, staff, customers and suppliers all understand.

The NIST Cybersecurity Framework (CSF) gives them that shared vocabulary: a list of security outcomes, grouped under plain headings, that any organization can use to say what it does today and what it wants to reach.

NIST is the National Institute of Standards and Technology, part of the US Department of Commerce. It first released the framework in 2014, after a presidential executive order on critical infrastructure. The current version is CSF 2.0, published on February 26, 2024 as NIST Cybersecurity White Paper (CSWP) 29.

As of September 29, 2026, NIST has not published a newer version. Version 2.0 is written for organizations of every size and sector, not only for operators of critical infrastructure.

The framework is free. NIST publishes the document, the Profile template, the quick-start guides and an online reference tool at no charge.

What CSF 2.0 actually contains

The CSF has three parts. The Core is the list of outcomes. Organizational Profiles are how you describe your current and target state using those outcomes.

Tiers are an optional way to describe how rigorous your risk governance and risk management practices are.

The Core has six Functions, 22 Categories and 106 Subcategories. Each Subcategory is one outcome, for example that backups are created, protected, maintained and tested. The outcomes say what good looks like, not how to get there.

NIST states that they are not a checklist of actions, and that the order of the Functions implies neither a sequence nor a ranking of importance.

Govern is the big change in 2.0. In version 1.1, governance and supply chain outcomes sat inside Identify. NIST gave them their own Function and put it at the center of its diagram, because it shapes how you carry out the other five.

Gaps in the Subcategory numbers are deliberate: they mark outcomes that moved during the update. NIST says no content from version 1.1 was removed; it was relocated.

Around the Core, NIST keeps online resources that it updates more often than the framework itself: Implementation Examples (short, notional actions for each outcome), Informative References (mappings to other standards), Quick-Start Guides (short guides for particular readers, including one for small businesses) and Community Profiles (shared targets for a sector or a threat).

None of these are required. NIST says the examples are not a baseline of required actions.

What the CSF is not

It is not a certification. NIST says it does not offer certifications or endorsements of CSF implementations, products or services, and has no plans to create a conformity assessment program. There is no accredited CSF auditor and no official CSF certificate.

A "NIST CSF certificate" was issued by whoever sold it, not by NIST.

It is not a control catalog. The CSF lists outcomes. Detailed controls live in other documents, such as NIST Special Publication (SP) 800-53, and the CSF points to them through Informative References.

It is not a maturity score. The four Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how formal and risk informed your governance and management practices are across the organization.

NIST calls its Tier table a notional illustration, says Tiers should complement your own risk method rather than replace it, and encourages moving up when risks or mandates are greater or when a cost-benefit analysis supports it. A Tier is not a grade for each Subcategory.

It is not a regulation. NIST is not a regulatory agency. The federal law behind its framework work says information shared with NIST for that work may not be used by any federal, state, tribal or local agency to regulate an entity.

Who has to use it

US federal executive agencies do. Executive Order 13800 (May 11, 2017) directs each agency head to use the NIST framework "or any successor document" to manage the agency's cybersecurity risk, so the duty carries forward to CSF 2.0.

The same order ties agency risk management to the federal information security law known as FISMA (the Federal Information Security Modernization Act).

For everyone else it is voluntary. NIST says most organizations use the CSF on a voluntary basis, and that some companies require it of their customers or suppliers. In practice it becomes a requirement when a contract or a business partner makes it one.

That obligation comes from the contract, not from a statute or regulation.

A common claim is that any company selling to the federal government must comply with the CSF. Contractors' federal security duties come from the clauses in their contracts instead. The clause for defense contractors that handle covered defense information (DFARS 252.204-7012) points to a different NIST document, SP 800-171, and does not mention the CSF.

How it works, end to end

NIST describes one way to use the CSF as a five-step loop built around Organizational Profiles. You can keep several Profiles, each with its own scope: the whole company, one set of systems, or one threat such as ransomware.

Tiers can inform steps 3 and 4: you might describe current practices as Risk Informed and set Repeatable as the target. NIST offers a free Organizational Profile template as a spreadsheet, and its CSF 2.0 Reference Tool exports the whole Core, with Implementation Examples and Informative References, as a spreadsheet file or JSON.

A worked example

This is an illustrative case, not a real company. A 35-person accounting practice receives a security questionnaire from a larger client that asks it to describe its program in CSF terms.

The office manager and the firm's outside IT provider scope one Profile to the systems that hold client financial data. They start from NIST's Small Business Quick-Start Guide and the Profile template. For the Current Profile they go through the Subcategories and write a sentence on what is true today for each.

Three gaps stand out: nobody has written down security expectations for the firm's software suppliers (GV.SC), backups run nightly but have never been test-restored (PR.DS-11), and there is no agreed rule for when a problem becomes a declared incident (DE.AE-08).

The Target Profile marks those three as priorities for the next two quarters. The action plan gives each an owner, a date and a check that shows it is done. The firm describes its current practices as Tier 2, Risk Informed, and sets Tier 3, Repeatable, as its target.

When the questionnaire asks "Are you NIST CSF certified?", the accurate answer is that no such certification exists, followed by a summary of the Current Profile and the action plan.

Who does what, and how a buyer checks a CSF claim

The CSF has an author and users, but no certifier and no accreditor.

Because there is no certificate, a CSF claim is only as good as the evidence behind it. NIST notes that a Current Profile can be shared with business partners or prospective customers to show capabilities and known areas for improvement, and that a Target Profile can tell suppliers what you expect of them.

If you are the buyer, ask for the Current Profile or a summary of it, the date it was last updated, which part of the company it covers, which CSF version it uses, and the action plan for known gaps. If the vendor offers an outside assessment, read it as the private opinion of the firm that wrote it; NIST does not endorse assessors.

A claim of "NIST CSF certification" is a reason to ask more questions, not a credential.

State laws that name the framework

Several states give a business a benefit in court if it kept a written security program that conforms to a recognized framework. These laws do not require anyone to use the CSF. They describe what a business may raise after a data breach lawsuit is filed.

The table summarizes each statute's text; how a court applies it is a question for a lawyer licensed in that state.

Two details matter. First, each statute that lists the CSF names it by its old title, "Framework for Improving Critical Infrastructure Cybersecurity," which CSF 2.0 no longer uses. Whether 2.0 counts as the current version of that document is for a court to decide.

Second, if it does, the update windows counted from February 26, 2024 have all passed.

What it costs and how long it takes

NIST charges nothing for the framework, the Profile template, the quick-start guides or the Reference Tool. There is no certification or registration fee, because there is no certification. NIST publishes no price and no timeline for adopting the CSF: how long it takes depends on the scope and targets you choose.

Your real costs are staff time, any tools you pick, the security improvements your action plan calls for, and any outside help you hire.

If you ask a firm for a quote, the price will depend on the scope of the Profile, how many Subcategories you target, how much documentation already exists, whether you want an independent assessment written up for customers, and how often you want it repeated.

How it fits with SP 800-53, ISO 27001 and privacy, and where it leads

SP 800-53 is NIST's catalog of security and privacy controls. The CSF sits above it: one Subcategory may need several SP 800-53 controls. For organizations using NIST's Risk Management Framework, NIST says the CSF complements the way controls are selected from SP 800-53.

A final mapping from CSF 2.0 to SP 800-53 (release 5.2.0) was posted on November 17, 2025.

ISO/IEC 27001 is an international standard for an information security management system and, unlike the CSF, can be certified by an accredited certification body. NIST's catalog lists final ISO/IEC 27001:2022 to CSF 2.0 mappings, but outside parties wrote them (one posted in 2025, a second on July 9, 2026).

NIST says it does not test outside mappings for correctness and that listing them does not imply endorsement. If a customer needs independent proof, it will come from a certifiable standard or an audit report, not from the CSF itself.

Privacy is a separate discipline in NIST's view. CSWP 29 says cybersecurity and privacy overlap but are independent, and points to the NIST Privacy Framework for privacy risks that do not come from security incidents. A version 1.1 draft of that framework, realigned to CSF 2.0, closed for comment on June 13, 2025; NIST's page still lists the final as coming soon.

Where it leads depends on who is asking. A Current Profile can be the starting point for ISO 27001 certification or, for defense contractors, for the SP 800-171 requirements behind CMMC, and the mappings in NIST's catalog (NIST's own for SP 800-171 Revision 3, outside submitters' for ISO/IEC 27001) show where the outcomes overlap.

If your customers want an independent audit report instead, that is usually a SOC 2.

What changed in 2025 and 2026

The framework document has not changed since February 2024. The work around it has.

There is no CSF 2.1 or 3.0. NIST's FAQ says there are no immediate plans to change the Core to address AI; its AI work runs through profiles and guides instead.

What we could not verify

Whether courts treat CSF 2.0 as the "current version" of the framework that the Ohio, Iowa, Connecticut and Texas statutes name by its old title. We read the statutes, not case law.

Whether any state text has changed since the editions we read: the 2025 publication of the Connecticut General Statutes, the 2026 Iowa Code, the Ohio and Utah codes as published on September 29, 2026, and the Texas enrolled bill with its September 1, 2025 effective date.

Whether Executive Order 13800 still stands unamended. We found no order revoking it, and the June 6, 2025 order on cybersecurity (EO 14306) amends two other orders, but we did not find an official consolidated status list for 13800.

When NIST will publish Privacy Framework 1.1 in final form. NIST's page lists it as coming soon with no date.

The exact date the first ISO/IEC 27001:2022 to CSF 2.0 mapping became final. NIST's CSF updates page says May 30, 2025; the catalog record shows July 18, 2025.