Back to Glossary

NIST CSF (Cybersecurity Framework)

A widely used U.S. framework that provides voluntary guidelines to help organizations of any size manage and reduce cybersecurity risk, organized around six core functions.

What is the NIST CSF?

The NIST Cybersecurity Framework (CSF) is a widely used set of guidelines that helps organizations manage and reduce cybersecurity risk. It was developed by the U.S. National Institute of Standards and Technology and describes high-level outcomes rather than prescribing specific technologies, so each organization decides how to achieve them. The current version, CSF 2.0, was published in February 2024 and is voluntary for most private-sector organizations.

What are the six core functions?

The framework organizes cybersecurity outcomes into six functions:

Govern: Establishes the cybersecurity risk strategy, roles, policies, and oversight. This is the newest function, added in 2.0, and it sits at the center because it informs all the others.
Identify: Builds an understanding of assets, risks, and the broader environment.
Protect: Puts safeguards in place, such as access control, training, and data security.
Detect: Finds and analyzes possible attacks and anomalies in a timely way.
Respond: Takes action to contain and manage a detected incident.
Recover: Restores affected assets and operations to return to normal.

What changed in CSF 2.0?

Added Govern: The original framework had five functions; 2.0 added Govern as a sixth to put cybersecurity firmly on the leadership agenda.
Broader scope: It now applies to organizations of all sizes and sectors, not just critical infrastructure.
Supply chain focus: Greater emphasis on managing risk from third-party partners.

How do organizations use it?

Profiles: Teams create a Current Profile to see where they stand, then a Target Profile to define where they want to be, and close the gaps in between.
Tiers: Four implementation Tiers (Partial, Risk Informed, Repeatable, and Adaptive) describe how mature and consistent the organization’s risk practices are.
A common language: Many use the CSF to assess, prioritize, and communicate cybersecurity risk across technical teams, executives, and external partners.

Why does the NIST CSF matter?

Flexible and scalable: It adapts to any size or sector and any level of cybersecurity maturity.
Improves resilience: It supports a proactive, risk-based posture across the full lifecycle of an incident.
Supports compliance: It helps align with regulatory expectations and is sometimes required in U.S. federal and supply chain contracts.