Key Facts
- Regulator
- National Institute of Standards and Technology (NIST), U.S. Department of Commerce
- Latest version
- NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)
- Effective
- 26 February 2024
- Official text
- www.nist.gov ↗
What is NIST CSF?
The NIST CSF is the Cybersecurity Framework published by the US National Institute of Standards and Technology to help organisations understand, assess, prioritise and communicate their cybersecurity risk. Version 2.0 is the current edition. It is voluntary guidance, designed for organisations of any size, sector or maturity, in the United States and elsewhere.
The current version is the NIST Cybersecurity Framework (CSF) 2.0, published as NIST CSWP 29 on 26 February 2024. NIST is part of the US Department of Commerce. The framework sets out high-level outcomes and does not prescribe how to achieve them. NIST's Cybersecurity Framework page is the official home.
Why it matters
A prospect's security questionnaire asks how you align to the NIST CSF. Your evidence is organised around another framework, and the deal is waiting.
The CSF gives you a common language for cybersecurity risk. It lets you understand, assess, prioritise and communicate your cybersecurity efforts in terms that a customer, a board or a regulator already recognises. Version 2.0 added a Govern Function, which covers the cyber risk management strategy.
It also connects to the rest of the NIST catalogue. NIST's catalogue lists informative-reference mappings between CSF 2.0 and other frameworks, including ISO/IEC 27001:2022, SP 800-53 Rev 5 and PCI DSS. The CSF 2.0 to 800-53 mapping matters because, in NIST's words, the CSF can complement the Risk Management Framework's approach to selecting and prioritising controls from SP 800-53.
A mapping tells you where two frameworks overlap. It does not tell you that you meet either.
Who it applies to
The NIST CSF applies to any organisation, regardless of size, sector or maturity. Technology, insurance and financial services firms use it as readily as any other. Few organisations are excluded by profile; the practical question is whether anyone asks you for it.
The obligation is voluntary for most organisations. NIST is not a regulator, so the CSF becomes mandatory only where a government policy or mandate adopts it, as Executive Order 13800 did for US federal agencies. Where a customer or tender names the CSF, the request is contractual in practice, so ask what evidence they expect.
The CSF and ISO 27001 overlap rather than compete. NIST's catalogue includes an ISO/IEC 27001:2022 to CSF 2.0 mapping, so a firm with an ISMS can read its existing evidence against CSF outcomes. For the standard itself, see our ISO 27001 guide.
The UK position
No UK statute requires the NIST CSF. A UK organisation meets it by choice, or when a customer or contract asks for it. Two UK sources sit close to it:
| UK source | Who it affects | Link to the CSF |
|---|---|---|
| NCSC Cyber Assessment Framework, under the NIS Regulations 2018 | Operators of essential services | The UK's own outcome-based framework, published by the NCSC |
| Cyber Governance Code of Practice, published by DSIT in April 2025 | Boards and directors of medium and large organisations | NIST's catalogue lists a mapping from the Code to CSF 2.0, so Code expectations can be read against CSF outcomes |
Key requirements
The NIST CSF has no pass mark. NIST says its outcomes are not a checklist of actions to perform. The framework has three parts:
- The Core. A hierarchy of Functions, Categories and Subcategories that detail each outcome.
- Organizational Profiles. An organisation's current and target cybersecurity posture, described in Core outcomes, so the gaps between them show.
- Tiers. Optional. Four levels describing how rigorous an organisation's cyber risk governance and management practices are: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4).
The Core has six Functions:
- Govern. New in version 2.0. The cybersecurity risk management strategy and its place in enterprise risk management.
- Identify. Understanding the assets and risks the organisation has to manage.
- Protect. Safeguards that reduce the likelihood and impact of cybersecurity events.
- Detect. Finding and analysing possible cybersecurity attacks and compromises.
- Respond. Acting on a detected cybersecurity incident.
- Recover. Restoring normal operations after an incident.
A spreadsheet with every row ticked is not a risk picture.
Why there is no NIST CSF 2.0 controls list
Searches for a NIST CSF 2.0 controls list or spreadsheet ask for something NIST does not frame that way. Table 1 of the CSF 2.0 document lists the Categories, and the Subcategories beneath them state outcomes. Controls live in other catalogues, such as SP 800-53, and connect to the Core through the mappings above.
Frequently asked questions
The NIST CSF 2.0 Core has six Functions, not five: Govern, Identify, Protect, Detect, Respond and Recover. The five that searchers remember come from NIST CSF 1.1; Govern is the sixth. Each Function breaks down into Categories and Subcategories that describe outcomes, so the Functions are the top level of the structure rather than a list of tasks.
No. NIST says the NIST CSF is not country-specific, and that governments and other organisations inside and outside the United States used earlier versions successfully. NIST also lists translations of CSF 2.0, including Arabic. A UK or EU firm can adopt the NIST CSF as its main framework, or read it alongside ISO 27001 or the NCSC Cyber Assessment Framework.
No. NIST says it does not offer certifications or endorsements of CSF-related products, implementations or services, and has no plans to develop a conformity assessment programme for the NIST CSF. Treat a claim of "NIST CSF certified" with care and ask what was assessed, against which Profile, and by whom.
Both describe outcomes rather than prescribe controls. The NCSC Cyber Assessment Framework is built from objectives, principles, contributing outcomes and indicators of good practice, and is aimed mainly at organisations running essential services under the NIS Regulations. The NIST CSF uses Functions, Categories and Subcategories instead, and no UK rule requires it.
The main change is the Govern Function. NIST says governance activities used to sit inside the Identify Function, and Govern was added to make them visible. Some NIST CSF 1.1 Subcategories moved, which is why the 2.0 numbering has gaps, and NIST provides a resource showing where each withdrawn 1.1 identifier now sits.