NIST Cybersecurity Framework (NIST CSF)
A voluntary US framework organising cybersecurity activity into core functions, updated to version 2.0 in 2024 with an added Govern function.
Overview
NIST CSF 2.0 organises outcomes under Govern, Identify, Protect, Detect, Respond and Recover. It is widely referenced by regulators, used to structure security programmes and mapped to other frameworks.
As an industry standard it binds through regulation that cites it, contracts that require it or audits that test it. The authorities most closely connected to it are NIST. It is often read together with ISO 27001.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
It is the common language of cybersecurity programmes in North America.
Who it affects
Organisations of every size and sector.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to NIST CSF. Select one to open it.
What to do about it
- 1Decide whether it applies through regulation, contract, audit or certification.
- 2Run a gap assessment against your current controls.
- 3Crosswalk it to the regulations and contracts that reference it.
- 4Collect evidence continuously for the audit period.
From requirement to evidence.
NIST CSF is a hub in the standards crosswalk, mapped to ISO 27001, SOC 2, PCI DSS and cyber regulations.
Request early access →