NIST Cybersecurity Framework (CSF) 2.0 Guide: Functions, Profiles and Tiers

Who uses it

CSF 2.0 was written for industry, government, academia and nonprofits, "regardless of the maturity level and technical sophistication" of their cybersecurity programs (CSWP 29). It's widely used:

• as the reporting structure boards and executives expect
• as the "umbrella" that maps more prescriptive standards (ISO/IEC 27001, NIST SP 800-53, CIS Controls) to one set of outcomes
• by critical-infrastructure operators and their suppliers
• by smaller organizations through NIST's quick-start guides

It is voluntary for most private organizations. Contracts, sector regulators or customers may still require you to align with it.

The CSF Core: six Functions

NIST stresses that the Core is "not a checklist of actions to perform", and that the order of the Functions doesn't imply a sequence. GOVERN sits at the centre because it shapes how you prioritize all the other outcomes.

Organizational Profiles and Tiers

A Current Profile records the outcomes you're achieving now. A Target Profile records the outcomes you've prioritized for the future. You can base a Target Profile on a Community Profile, which is a sector or use-case baseline. NIST's five steps are:

1. Scope the Profile.
2. Gather information such as policies, risk priorities, BIAs and standards in use.
3. Create the Profile.
4. Analyze the gaps and create an action plan, such as a risk register or a POA&M.
5. Implement the plan and update the Profile.

Tiers describe how rigorous your cybersecurity risk governance and management are:

• Tier 1, Partial: limited awareness of risk at the organizational level
• Tier 2, Risk Informed: awareness, but not applied organization-wide
• Tier 3, Repeatable: formally approved, organization-wide practices
• Tier 4, Adaptive: practices adapt based on lessons learned and predictive indicators

Tiers aren't maturity scores you're required to climb. Choose the Tier that fits your risk and resources (CSWP 29).

Online resources and 2026 updates

CSF 2.0 moved its detailed material online. Implementation Examples and Informative References, which map each Subcategory to other standards, are updated regularly through the CSF 2.0 Reference Tool (NIST). In 2026 NIST:

• published the final SP 1347, Informative References Quick-Start Guide on 25 August 2026
• released draft SP 1353, Quick-Start Guide for Using AI for CSF Analysis and Reporting on 19 August 2026. Its comments closed on 15 October 2026, and it includes use cases for governance review and for drafting Current and Target Profiles
• opened comments until 7 December 2026 on SP 800-221r1 ipd, which covers aligning ICT risk management with CSF 2.0 (NIST)

Assessment, "certification" and timeline

There's no official CSF certification, accreditation scheme or NIST audit. Organizations usually:

• self-assess against Subcategories and record a Current Profile
• have internal audit or a third party validate it
• report progress to the board in Function and Category terms

There's no fixed timeline. A first Current/Target Profile cycle can be scoped narrowly, for example to ransomware readiness for one business unit, which is an example NIST gives itself.

Penalties

CSF has no penalties of its own. Consequences come from laws or contracts that reference it, or from regulators who judge your program against it after an incident.

Mapping to related frameworks

• ISO/IEC 27001: use CSF Functions to report ISMS controls to executives, and use ISO certification for third-party assurance.
• NIST SP 800-53 and SP 800-171: these are prescriptive control catalogues that map to CSF outcomes through Informative References.
• SOC 2: the common criteria overlap with GOVERN, PROTECT, DETECT and RESPOND outcomes.
• CMMC: it builds on NIST SP 800-171. CSF Profiles can frame a CMMC roadmap but don't replace the assessment.
• NIST Privacy Framework and NIST AI RMF: these share the Function and Profile approach, which helps integrated programs.

Readiness checklist

1. Get an executive sponsor and define scope: the whole enterprise, a business unit or a specific threat.
2. Record context (GV.OC): your mission, stakeholders, and legal and regulatory requirements.
3. Set your risk appetite and strategy (GV.RM), and define roles (GV.RR).
4. Build an asset and supplier inventory (ID.AM, GV.SC).
5. Score your Current Profile against each in-scope Subcategory, with evidence.
6. Define the Target Profile, using a Community Profile if one exists.
7. Choose your target Tier for governance and management practices.
8. Rank the gaps by risk and write an action plan or POA&M.
9. Map the CSF outcomes to the control frameworks you already run so you don't duplicate work.
10. Report progress by Function and refresh the Profiles at least once a year or after major change.

Common pitfalls

• Treating the Core as a checklist. It's a set of outcomes, and NIST says so explicitly.
• Skipping GOVERN and starting with tools.
• Using Tiers as a maturity target for every Subcategory. Tiers describe the program as a whole.
• Using CSF 1.1 mappings without updating them to the 2.0 identifiers.
• No evidence behind Profile scores, which makes it hard to defend progress claims.

How AssureCore helps

AssureCore lets you hold CSF outcomes alongside your other frameworks. You can track controls in the Controls Register, link evidence with expiry alerts, log gaps in the Risk Register and export Audit Reports. Cross-framework Mapping connects CSF work to ISO 27001, SOC 2 and NIST SP 800-171 controls.

Frequently asked questions

Official references

• NIST CSWP 29 – The NIST Cybersecurity Framework (CSF) 2.0 (PDF)
• NIST – Cybersecurity Framework home
• NIST CSRC – SP 1347 Informative References Quick-Start Guide (Aug 2026)
• NIST CSRC – SP 1353 ipd, AI for CSF Analysis and Reporting

Related frameworks

• ISO 27001 guide
• SOC 2 guide
• NIST 800-171 guide
• Essential Eight guide