What is the NIST Cybersecurity Framework?
The NIST Cybersecurity Framework (CSF) is a voluntary framework published by the U.S. National Institute of Standards and Technology for understanding, managing and communicating cybersecurity risk. It does not prescribe products or a pass-or-fail list of controls. Instead it gives a common structure of outcomes, grouped into functions, that any organization can use to describe its current program, set a target and plan the work between the two. It is free, sector-neutral and used well beyond the United States.
A short history
NIST released version 1.0 in February 2014, following a 2013 executive order on improving critical infrastructure cybersecurity, and version 1.1 in April 2018. Version 2.0, published in February 2024, is the current release. It widened the intended audience from critical infrastructure to organizations of every size and sector, added a sixth function, Govern, and expanded the guidance on supply chain risk.
The six functions of CSF 2.0
| Function | Covers | Example categories |
|---|---|---|
| Govern (GV) | Risk strategy, roles, policy and oversight | GV.RM risk management strategy; GV.SC supply chain risk management |
| Identify (ID) | Understanding assets and risks | ID.AM asset management; ID.RA risk assessment |
| Protect (PR) | Safeguards that lower the chance of an incident | PR.AA identity management, authentication and access control; PR.AT awareness and training |
| Detect (DE) | Finding attacks and anomalies | DE.CM continuous monitoring; DE.AE adverse event analysis |
| Respond (RS) | Acting on a detected incident | RS.MA incident management; RS.MI incident mitigation |
| Recover (RC) | Restoring operations afterward | RC.RP incident recovery plan execution |
Govern sits at the center of the model and informs the other five, which follow the life cycle of managing risk. Each function breaks down into categories and then subcategories, 22 and 106 of them respectively in version 2.0, and NIST publishes informative references that map subcategories to control catalogs such as NIST SP 800-53 and the CIS Controls.
Profiles and tiers
An organizational profile describes a program in terms of CSF outcomes. A current profile records what the organization achieves today and a target profile what it wants to achieve, so comparing the two is a gap analysis that produces a prioritized action plan. Community profiles, introduced in 2.0, are shared baselines for a sector or a use case. Tiers describe how rigorous the organization's risk governance and management practices are, from Tier 1 (Partial) through Tier 2 (Risk Informed) and Tier 3 (Repeatable) to Tier 4 (Adaptive). They are not a certification, and NIST does not expect every organization to reach Tier 4.
Example: reporting to the board
A new CISO scores the program against each function and presents one slide. Identify and Protect are at the target level. Detect is behind because only half of the servers send logs to the SIEM, Respond relies on a plan that has never been exercised, and Govern lacks a documented risk appetite. The board gets a picture it can follow without reading hundreds of controls, and the budget request maps directly to the weak functions. The same structure appears elsewhere at NIST: its 2025 incident response guidance, SP 800-61 Revision 3, is organized around the CSF 2.0 functions.
NIST CSF vs. ISO/IEC 27001 and NIST SP 800-53
- NIST CSF: a voluntary framework of outcomes for organizing and communicating a program. There is no CSF certification.
- ISO/IEC 27001: an international standard for an information security management system, which an accredited body can certify.
- NIST SP 800-53: a detailed catalog of security and privacy controls, required for U.S. federal information systems and often referenced from the CSF.
NIST Cybersecurity Framework on the CompTIA Security+ exam
SY0-801 covers frameworks and standards under objective 5.5, as reference points for audits and assessments, and the NIST CSF is the standard example of a voluntary framework there. A scenario that asks for a high-level, voluntary structure to organize a program or report maturity to leadership points to the CSF, and so does any question built around the six function names. A question about a certifiable management system points to ISO/IEC 27001 instead, and one about protecting cardholder data points to PCI DSS. Remember that Govern is the newest function, added in version 2.0.