NIST Cybersecurity Framework 2.0 Explained: The Six Functions and How to Use Them

The NIST Cybersecurity Framework (CSF) is one of the most widely used ways to organise a security programme. Version 2.0, published by the US National Institute of Standards and Technology in February 2024, widened its audience from critical infrastructure to organisations of every size and sector, and added a new function focused on governance.

Unlike ISO 27001, the CSF is not a certifiable standard. It is a common language: a way to describe where your security is today, where it needs to be, and what to do first. That makes it especially useful for explaining security to boards and executives.

What changed in CSF 2.0

• A sixth function, Govern, which puts strategy, roles, policy and risk management at the centre of the framework.
• Broader scope: the framework is explicitly intended for all organisations, not only critical infrastructure.
• Supply chain risk management is now a first-class topic inside Govern.
• More implementation help: quick-start guides, implementation examples and an online reference tool.

The six core functions

The functions are not a sequence to finish once. They run continuously and in parallel.

1. Govern (GV): set the organisation's cybersecurity strategy, expectations and policy. Who owns risk? How much risk is acceptable? How are suppliers managed? Without this, every other function drifts.
2. Identify (ID): understand your assets, data, suppliers and risks. You cannot protect what you do not know you have.
3. Protect (PR): safeguards such as identity and access management, awareness training, data security, secure configuration and resilient platforms.
4. Detect (DE): find attacks and anomalies quickly through continuous monitoring, the work of a SOC and SIEM.
5. Respond (RS): contain and manage incidents, covered in my incident response plan guide.
6. Recover (RC): restore operations and communicate during and after an incident.

Each function is divided into categories and subcategories, which describe outcomes rather than prescribing specific tools. For example, the framework asks that identities are managed and access is limited; it does not tell you which identity product to buy.

Profiles and tiers

A profile describes security outcomes for a specific scope. You create a current profile (where you are) and a target profile (where you need to be), and the gap between them becomes your roadmap.

Tiers describe how rigorous your risk governance and management practices are, from Tier 1 (Partial) through Tier 2 (Risk Informed) and Tier 3 (Repeatable) to Tier 4 (Adaptive). Tiers are not a maturity score to maximise; many organisations rightly target Tier 3.

How to adopt CSF 2.0 in seven steps

1. Define scope: the whole organisation, a business unit or a critical service.
2. Get executive sponsorship and agree risk appetite under Govern.
3. Build an asset and data inventory for the scope.
4. Assess the current profile subcategory by subcategory, with evidence rather than opinion.
5. Set the target profile based on threats, regulation and business priorities.
6. Prioritise the gaps into a 12 to 18 month roadmap with owners and budgets.
7. Measure and report progress quarterly to leadership.

NIST CSF vs ISO 27001

They complement each other. ISO 27001 provides a certifiable management system and a defined control set; the CSF provides an outcome-based language that is excellent for planning and executive reporting. NIST publishes informative references that map CSF subcategories to other frameworks, so one programme can satisfy both.

Common mistakes

• Treating the CSF as a checklist and scoring every subcategory as "done" without evidence.
• Skipping Govern and jumping straight to buying Protect and Detect tools.
• Setting a target profile of "everything at maximum", which is unaffordable and unrealistic.
• Assessing once and never revisiting as the business and threats change.

Need a CSF gap assessment or a board-ready security roadmap? Contact me.

References and further reading

1. NIST: Cybersecurity Framework
2. NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0
3. ISO/IEC 27001 information security management
4. CIS Critical Security Controls