NIST CSF 2.0: The NIST Cybersecurity Framework Explained (2026)

The 6 NIST CSF 2.0 functions, from NIST CSWP 29 (category and subcategory counts are ours):

The 6 NIST CSF functions

NIST CSF 2.0 has 6 functions: Govern, Identify, Protect, Detect, Respond and Recover. CSF 1.1 had five; version 2.0 added Govern and put it at the center, because it shapes how an organization carries out the other five.

• Govern (GV) sets the organization’s cybersecurity risk management strategy, expectations and policy, and checks they are followed. Supply chain risk lives here in CSF 2.0.
• Identify (ID) is understanding the organization’s current cybersecurity risks: what assets it has, what threatens them, and what to improve.
• Protect (PR) is the safeguards: identity and access control, awareness training, data security, platform security and resilient infrastructure.
• Detect (DE) is finding and analyzing possible attacks and compromises, through continuous monitoring and adverse event analysis.
• Respond (RS) is the action taken on a detected incident: managing it, analyzing it, reporting it and containing it.
• Recover (RC) is restoring affected assets and operations, and communicating while you do.

NIST CSF 2.0 categories

NIST CSF 2.0 has 22 categories, each with a two-letter function prefix and a two-letter code, listed in Appendix A of NIST CSWP 29.

Each category breaks into subcategories such as GV.OC-01. The full list of 106 is in the free CSF 2.0 PDF.

What changed from CSF 1.1 to 2.0

NIST CSF 2.0 added the Govern function, widened the audience from critical infrastructure to every organization, and trimmed the Core to 22 categories and 106 subcategories.

Counts are ours, from each version’s Appendix A. NIST first published the framework in 2014, and says CSF 2.0 is its most downloaded technical publication, with over 3 million views and downloads by February 2026.

Implementation tiers and profiles

NIST CSF has 4 implementation tiers (Partial, Risk Informed, Repeatable and Adaptive) that describe how rigorous an organization’s cybersecurity risk management is. Tiers are optional and nobody audits them: NIST says an organization “can choose to use the Tiers to inform its Current and Target Profiles.”

A profile describes outcomes for one organization. A Current Profile lists the outcomes you achieve now; a Target Profile lists the ones you want. The gap between them becomes your action plan. NIST and industry groups also publish Community Profiles, shared baselines for a sector or use case.

Is NIST CSF mandatory? Can you be certified?

NIST CSF is voluntary for most organizations and there is no NIST CSF certification. NIST’s FAQ says “most organizations use the CSF on a voluntary basis,” that Executive Order 13800 “made the Framework mandatory for U.S. Federal Government agencies,” and that NIST “does not offer certifications” of CSF implementations, with “no plans to develop a conformity assessment program.”

Two catches:

• Customers can require it. NIST notes that some companies require the CSF of their suppliers, so a contract or questionnaire can make it mandatory for you.
• “NIST CSF compliant” is a claim, not a certificate. If you need outside proof, get an ISO/IEC 27001 certificate from a certification body or a SOC 2 report from a CPA firm; how SOC 2 reports work explains that path. Defense contractors handling CUI face a different, contractual NIST standard, SP 800-171.

NIST CSF vs NIST 800-53 vs ISO 27001

NIST CSF is a voluntary list of outcomes, NIST SP 800-53 is a detailed federal control catalog, and ISO/IEC 27001 is a certifiable management-system standard.

Many teams use the CSF as the top-level map and 800-53 or ISO 27001 controls underneath it. NIST’s Informative References link each subcategory to those controls.

How to implement NIST CSF

To implement NIST CSF, write a Current Profile, choose a Target Profile, and work the gaps in priority order, starting with NIST’s free Quick Start Guides.

1. Scope it: decide which business units, systems or products the profile covers.
2. Write the Current Profile: for each subcategory, note what you achieve today.
3. Set the Target Profile: pick the outcomes you need, guided by your risks, contracts and the tier you aim for.
4. Plan the gaps: list actions, owners and dates; NIST’s Implementation Examples show what each outcome can look like.
5. Review on a schedule: update both profiles as risks change.

Start free: NIST publishes the CSF 2.0 Reference Tool (browse, search and export the Core) and Quick Start Guides for small businesses and other audiences. Paid platforms add evidence collection and control mapping. List prices on AWS Marketplace, checked October 24, 2026:

Both figures are list prices, not negotiated ones. For a ranked comparison of platforms, see our GRC software guide.