The NIST Cybersecurity Framework is a voluntary, widely adopted framework for managing and reducing cybersecurity risk — built around six core Functions that give any organisation a common language for security.
The six Functions are Govern, Identify, Protect, Detect, Respond, and Recover. The 2024 update — CSF 2.0 — added Govern and widened the scope from critical infrastructure to organisations of every size.
Plain-English explainer · CSF 2.0 · Maps to ISO 27001 / SOC 2 · Last reviewed June 2026
The NIST Cybersecurity Framework (CSF) is a voluntary framework that helps organisations understand, manage, and reduce their cybersecurity risk. Created by the US National Institute of Standards and Technology, it’s used worldwide as a common language for security — by organisations of every size and sector, not just US ones. Its heart is the Core: six high-level Functions — Govern, Identify, Protect, Detect, Respond, Recover — broken into Categories and Subcategories of outcomes. The 2024 release, CSF 2.0, added the Govern Function and broadened the framework’s audience. CSF is outcome-based and flexible: it tells you what good security looks like, not exactly how to implement it — which is why it pairs naturally with a certifiable standard like ISO 27001 and sits alongside other risk management frameworks.
Key Takeaways
- NIST CSF is a voluntary, outcome-based framework for managing cybersecurity risk — used globally as a common security language.
- It has six Functions: Govern, Identify, Protect, Detect, Respond, and Recover (Govern was added in CSF 2.0, released 2024).
- Three components: the Core (Functions → Categories → Subcategories), Tiers (maturity, 1–4), and Profiles (current vs target state).
- CSF says what to achieve, not how — so it complements certifiable standards like ISO 27001 and SOC 2 rather than replacing them.
The Six Functions
Each Function answers a different question about your security programme. Together they cover the full lifecycle — from setting strategy to recovering from an incident.
Govern (GV)
Establish and monitor the organisation’s cybersecurity risk management strategy, expectations, roles, and policy. CSF 2.0 added Govern to put leadership accountability at the centre.
Identify (ID)
Understand your assets, data, suppliers, and the risks to them — you can’t protect what you haven’t mapped.
Protect (PR)
Safeguards that limit or contain the impact of an incident — access control, awareness training, data security, and maintenance.
Detect (DE)
Find cybersecurity events quickly through continuous monitoring and detection processes.
Respond (RS)
Take action once an incident is detected — containment, analysis, communication, and mitigation.
Recover (RC)
Restore the capabilities and services that an incident impaired, and learn from it to improve.
Measuring & Targeting Maturity
Implementation Tiers
Four tiers describe how rigorous and risk-informed your practices are:
- Tier 1 — Partial: ad-hoc, reactive.
- Tier 2 — Risk Informed: aware, but inconsistent.
- Tier 3 — Repeatable: formal, organisation-wide.
- Tier 4 — Adaptive: continuously improving.
Profiles
A Profile is your selection of Functions, Categories, and Subcategories tailored to your business. Compare a Current Profile (where you are) with a Target Profile (where you want to be) — the gap between them becomes your prioritised security roadmap.
NIST CSF — Common Questions
The questions people ask most about the NIST Cybersecurity Framework.
What is the NIST Cybersecurity Framework?
What are the functions of the NIST CSF?
What changed in CSF 2.0?
What is the difference between NIST CSF and ISO 27001?
Is the NIST Cybersecurity Framework mandatory?
Related reading: the Learn hub, risk management frameworks, what an ISMS is, and GRC. More terms in the compliance glossary.
Related Reading
ISO 27001 Knowledge Hub
All 93 Annex A controls, all clauses, every guide in the cluster.
Read moreISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read moreAnnex A Controls Overview
All 93 controls across organizational, people, physical and tech domains.
Read moreSOC 2 vs ISO 27001
The decision guide for US-bound vs global-bound trust evidence.
Read moreWhat Is SOC 2?
The AICPA attestation explained — five categories, Type 1 vs Type 2, report not certificate.
Read moreFramework Selector
Answer a few questions to find which standard you actually need.
Read more