The NIST Cybersecurity Framework 2.0 is a flexible way to organise and communicate cybersecurity risk-management outcomes. It is designed for organisations of different sizes and sectors. It does not provide a NIST-issued certificate or a universal list of products to buy.
Start with a bounded service or business area, the people accountable for it and the decisions they need to make. This guide explains how to use the framework’s six Functions, organisational Profiles and Tiers without turning them into an unsupported compliance badge or a score detached from evidence.
Use all six Functions together
CSF 2.0 includes Govern, Identify, Protect, Detect, Respond and Recover. Govern makes the direction, expectations and accountability for cybersecurity explicit. The Functions describe connected areas of risk management; they are not six one-time project stages that can be completed and forgotten.
Use them to test the balance of your programme. An organisation may spend heavily on protective technology while leaving incident decisions or recovery responsibilities unclear. A discussion across the Functions can reveal that imbalance before another purchase reinforces it.
Keep the language tied to business needs. For an essential customer service, ask who decides acceptable disruption, what dependencies are known, how problems are detected, who responds and how useful operation is restored. The framework provides a common structure for that conversation.
Choose a useful scope for the first Profile
An organisational Profile describes the current or target position using CSF outcomes. Begin with a scope that people can explain and support with evidence. It may cover the whole organisation or a defined service, depending on the decision. Record important exclusions and dependencies.
Bring in the service owner, technology and security staff, and relevant privacy, supplier or business-continuity owners. Agree the objective of the exercise before collecting evidence. A Profile intended to prioritise internal work is different from an externally shared claim about an entire business.
Hypothetical example: a regional distributor starts with its online ordering service. It includes the outsourced warehouse connection and identity provider because service delivery depends on them. The team records those dependencies instead of describing only the website as its complete security scope.
Describe the current position honestly
For relevant outcomes, record what is achieved, how it is achieved and what evidence supports the conclusion. Distinguish operating practice from intention. A policy, purchased tool or assigned project can be useful evidence, but may not demonstrate the outcome on its own.
If responsibility or evidence is unclear, record that uncertainty. Ask a focused follow-up question rather than choosing a favourable rating to complete the worksheet. Identify the source and date of the evidence so someone else can understand why the conclusion was reached.
For the distributor, the team might find a recovery procedure but no verified restoration of the warehouse integration. The Current Profile can describe that limitation accurately. It should not imply that Recover is fully achieved simply because a backup product is installed.
Choose a Target Profile from real priorities
A Target Profile sets the desired outcomes and priorities. Connect those choices to the service’s risks, obligations, customer commitments and available resources. It should explain what needs to improve and why, rather than marking every outcome as an immediate top priority.
Compare the Current and Target Profiles to identify gaps. Translate the important gaps into actions with owners, dependencies and completion evidence. Some actions will need technical work; others may involve deciding authority, resolving a supplier responsibility or improving a handover.
For the distributor, an early priority could be a recovery exercise covering the whole order-to-warehouse sequence. A separate action might clarify who can suspend processing when data integrity is uncertain. These are specific decisions and tests, not an instruction to buy something labelled CSF compliant.
Use Tiers to discuss how risk is managed
The four CSF Tiers are Partial, Risk Informed, Repeatable and Adaptive. They help describe the rigour of cybersecurity risk governance and management and can inform Profiles. They should not be treated as NIST certification levels or a substitute for examining outcomes.
Discuss what the desired approach means for the business: how decisions are made, how evidence informs priorities and how changes feed back into the programme. Avoid forcing a single impressive label onto practices that vary substantially across the assessed scope.
NIST states that it does not certify or endorse CSF implementations, products or services. If a supplier offers a CSF assessment, ask about its scope, method and evidence. Evaluate the usefulness of the assessment rather than treating the provider’s badge as a NIST approval.
Use the Profile in the next management decision
Bring the Profile and action plan into a regular management discussion. Review the changes since the last assessment, the evidence of completed work and the risks or dependencies still requiring a decision. Update the Profile when material service changes make earlier assumptions unreliable.
Other frameworks and standards can provide useful implementation references. A mapping can identify related requirements, but it does not prove that every legal or contractual obligation has been met. Preserve the separate scope and evidence requirements of those arrangements.
Our NIST CSF assessment and implementation support can help define a focused starting point. If your organisation also maintains an ISMS, use the ISO 27001 risk-assessment guide to understand that programme’s method and the incident and continuity guide for relevant operating work.
Reference basis
- NIST Cybersecurity Framework 2.0 and official frequently asked questions.
- NIST, CSF 2.0 Profiles.
- NIST SP 1302, Quick-Start Guide for Using the CSF Tiers.
Questions and answers
Does CSF 2.0 still have five Functions?
No. CSF 2.0 has six: Govern, Identify, Protect, Detect, Respond and Recover. The added Govern Function gives explicit visibility to cybersecurity direction, expectations and accountability.
Is the framework only for US government organisations?
No. NIST designed CSF 2.0 for organisations of different sizes and sectors. Specific laws or contracts may establish their own requirements, so assess those separately from choosing to use the framework.
What is the difference between a Current and Target Profile?
A Current Profile describes the present position against relevant outcomes. A Target Profile describes selected desired outcomes and priorities. Comparing them helps identify work, but the underlying claims still need evidence.
Does reaching a Tier mean we are NIST certified?
No. Tiers describe approaches to risk governance and management. NIST does not certify CSF implementations or services, and a Tier label does not replace assessment of the actual outcomes.
What should a first CSF engagement deliver?
A clear scope, an evidence-based Current Profile, agreed target priorities and an action plan with owners and completion evidence. The level of detail should fit the decision and be explicit about exclusions and uncertainty.
Start with a Profile that supports a decision
Bring one service, its critical dependencies and the priorities you need to agree. Discuss a focused NIST CSF 2.0 assessment with usable evidence and a practical improvement plan.