NIST Cybersecurity Framework (CSF)

The framework originated in Executive Order 13636 (February 2013), which directed NIST to develop a voluntary framework for critical infrastructure; version 1.0 followed on 12 February 2014, the Cybersecurity Enhancement Act of 2014 gave NIST a standing mandate to maintain it, version 1.1 appeared in April 2018, and Executive Order 13800 (2017) required US federal agencies to use it. Version 2.0, published as NIST CSWP 29 on 26 February 2024, dropped the critical-infrastructure framing in its title and addresses organisations of any size or sector.

It has three components. The Core is a hierarchy of Functions, Categories and Subcategories with stable identifiers: in 2.0 there are six functions, 22 categories and 106 subcategories, compared with five functions, 23 categories and 108 subcategories in 1.1. Govern (GV) is new and contains organisational context (GV.OC), risk management strategy (GV.RM), roles, responsibilities and authorities (GV.RR), policy (GV.PO), oversight (GV.OV) and cybersecurity supply chain risk management (GV.SC); the other functions are Identify (ID), Protect (PR, including PR.AA for identity management, authentication and access control), Detect (DE), Respond (RS) and Recover (RC). Profiles describe current or target outcomes selected from the Core, including Community Profiles shared by a sector. Tiers 1-4 (Partial, Risk Informed, Repeatable, Adaptive) characterise the rigour of an organisation's governance and management practices.

Version 2.0 moved informative references and implementation examples out of the PDF into online resources, notably the Cybersecurity and Privacy Reference Tool, where the subcategories are mapped to SP 800-53 Rev. 5, the CIS Controls, ISO/IEC 27001 and other sources through the OLIR programme, and added Quick-Start Guides for small businesses and other audiences. The framework itself contains no controls to implement; it points to catalogues that do.

Two misconceptions are common. Tiers are often read as maturity levels, but NIST presents them as describing the rigour of risk governance and management, and does not require an organisation to aim for Tier 4 across the board. And there is no official certification: "CSF assessments" by consultants are self-defined evaluations. That is the main contrast with ISO/IEC 27001, which requires a management system audited by accredited bodies; in practice many organisations use the CSF functions as a reporting language for boards and the 27001 ISMS as the operating machinery, and ISO/IEC 27002 borrowed the five original function names as attribute values for its controls.