NIST CSF 2.0: the six functions, profiles and tiers

NIST CSF (Cybersecurity Framework) is the framework published by the US National Institute of Standards and Technology to describe, in six functions, the outcomes an organisation needs to achieve to manage its cybersecurity risks. Version 2.0, released in February 2024, now applies to every organisation, whatever its size or sector, and adds a function dedicated to governance. This guide covers the functions, profiles, tiers, NIST's resources and how to align the framework with ISO 27001 and NIS 2.

The CSF was born in 2014 from a US executive order on critical infrastructure protection; version 1.1 followed in 2018. Version 2.0, released on 26 February 2024 after two years of consultation, changes three things:

• its audience: the framework no longer targets critical infrastructure only but any organisation, from small businesses to government bodies;
• governance: a sixth function, Govern, groups strategy, roles, policy and oversight, previously scattered across Identify, and now also hosts cybersecurity supply chain risk management;
• its tooling: NIST now provides quick start guides, implementation examples and an online reference tool alongside the framework.

The principle stays the same: the CSF describes outcomes without prescribing how to achieve them. It does not replace a risk analysis; it helps organise and report on it. It is free and voluntary, and NIST publishes official translations. To see how it compares with ISO 27001, COBIT and the CIS Controls, read our overview of cybersecurity frameworks.

The heart of the framework (the Core) is a list of outcomes on three levels: 6 functions, 22 categories and 106 subcategories. The functions are not steps to run one after the other: they operate concurrently, and Govern informs them all.

Each subcategory is a concrete outcome, for instance “inventories of hardware managed by the organisation are maintained” or “incidents are categorised and prioritised”. Govern alone has six categories, including the supply chain, which connects with our article on third-party risk management. Respond and Recover follow the same logic as ISO 27035 and the business continuity plan.

The CSF becomes really useful with Organizational Profiles. A current profile describes the outcomes the organisation achieves today; a target profile, those it sets out to reach given its risks, obligations and resources. The gap becomes the action plan. The quick start guide on profiles suggests five steps:

1. Scope the profile: the whole organisation, a subsidiary, a system or a product, with the assumptions made.
2. Gather information: policies, audit results, risk analysis, business priorities, regulatory obligations.
3. Create the profile: for each selected subcategory, record what is in place and what is targeted.
4. Analyse the gaps and build a prioritised action plan.
5. Implement the plan and keep the profile up to date to measure progress.

NIST also describes Community Profiles, written by a sector or community for a shared context, which can serve as a starting point for a target profile. This gap-based reasoning is the same as a cybersecurity roadmap: the target profile sets the destination, the plan breaks down the journey.

Tiers describe the rigour of cybersecurity risk governance and management, not the quality of each technical control. NIST defines four, detailed in its quick start guide on tiers:

The target tier is a choice: a small business may aim for Tier 2 or 3 on most topics, a bank for Tier 4 on detection. It is not a compliance score. For the board, tiers fit well in a security dashboard, next to action plan progress.

• Quick start guides. A series of short guides, including one for small businesses, one for creating profiles, one for using tiers and others for enterprise risk managers or the supply chain, all listed on NIST's quick start guide page. The Resource & Overview Guide (SP 1299) is the entry point.
• Implementation examples. For each subcategory, indicative examples of concrete actions that help understand what is expected.
• Informative references. Mappings between subcategories and other documents, published on the informative references page. NIST notes it does not check the correctness of mappings submitted by third parties.
• Translations. Official translations, including French, help roll the framework out in multilingual organisations.

A European organisation does not adopt the CSF instead of ISO 27001 or NIS 2, but alongside them. The mapping below is indicative and our own: it shows where to look, it does not replace a detailed mapping table. In its technical guidance on NIS 2 measures, ENISA publishes mappings between these requirements and international standards.

In practice, ISO 27001 remains the best anchor to structure an ISMS and get certified. For NIS 2, national authorities set the expected reference; in France, that is ANSSI's ReCyF, which breaks down the ten Article 21 measures. The CSF sits on top: six headings the board understands, and a common grid to track several frameworks. Since version 8.1, the CIS Controls also use the CSF functions, governance included.