The NIST CSF, the NIST Cybersecurity Framework, is a voluntary, risk-based framework published by the US National Institute of Standards and Technology that describes cybersecurity outcomes an organization should achieve, organized into functions, categories and subcategories. Among security standards in cybersecurity, it serves as a common language for executives, security teams, auditors and suppliers to discuss where an organization stands and where it needs to go.
Unlike a certification standard, the CSF does not prescribe specific controls or award a certificate. It states what to achieve, not how to achieve it, and points to detailed control catalogs for implementation. First released in 2014 for critical infrastructure, it was revised as version 1.1 in 2018 and as version 2.0 in 2024, which broadened its scope to organizations of every size and sector.
The structure of the NIST CSF
The NIST CSF consists of three main components: the Core, Organizational Profiles and Tiers. Together they describe desired outcomes, compare current and target states, and characterize how rigorous the organization’s risk management practices are.
| Component | What it contains | How it is used |
|---|---|---|
| CSF Core | Functions, categories and subcategories of outcomes | Shared catalog of security outcomes |
| Organizational Profiles | Current and target selections of outcomes | Gap analysis and roadmap planning |
| Tiers | Four levels of risk management rigor | Describe maturity of governance and practice |
| Informative references | Mappings to other standards and controls | Guide implementation of each outcome |
In version 2.0, the Core contains 6 functions, 22 categories and 106 subcategories. Each subcategory is a concrete outcome statement, for example that vulnerabilities in assets are identified, validated and recorded. NIST also publishes implementation examples and quick start guides to help smaller organizations apply the outcomes.
The six functions of the CSF Core
The six functions organize cybersecurity outcomes at the highest level of abstraction. They are not sequential steps but concurrent areas of activity that together cover the full risk management lifecycle.
| Function | Focus | Example outcomes |
|---|---|---|
| Govern | Strategy, roles, policy and oversight | Risk strategy set, supply chain risk managed |
| Identify | Understanding assets and risks | Asset inventory, risk assessment, improvement |
| Protect | Safeguards to manage risk | Identity management, training, data security |
| Detect | Finding attacks and anomalies | Continuous monitoring, event analysis |
| Respond | Actions on detected incidents | Incident management, analysis, reporting |
| Recover | Restoring assets and operations | Recovery plan execution, communication |
Govern was added in version 2.0 and sits at the center of the framework. It moves cybersecurity governance, including risk appetite, accountability and cybersecurity supply chain risk management, from an implicit assumption into explicit outcomes that boards and executives own.
Tiers and organizational profiles
Tiers describe how rigorously an organization governs and manages cybersecurity risk, not how many controls it has. They help leadership decide what level of rigor is appropriate given the organization’s threats, obligations and resources.
| Tier | Name | Characteristic practice |
|---|---|---|
| Tier 1 | Partial | Ad hoc, reactive and inconsistently applied |
| Tier 2 | Risk informed | Approved by management but not organization-wide |
| Tier 3 | Repeatable | Formal policy, consistently applied and updated |
| Tier 4 | Adaptive | Continuously improved from lessons and threat intelligence |
Tier 4 is not a universal target. A small organization with modest risk may reasonably aim for Tier 2 or 3. The real planning tool is the profile: a current profile records which outcomes are achieved today, a target profile records the desired state, and the gap between them becomes a prioritized action plan. Sector groups also publish community profiles as shared starting points.
NIST CSF compared with other security standards
The NIST CSF is a framework of outcomes, while many neighboring standards are certifiable management systems or attestation reports. Organizations frequently use several of them together, with the CSF acting as the organizing layer.
| Standard | Nature | Certification or report | Typical use |
|---|---|---|---|
| NIST CSF | Voluntary outcome framework | None | Strategy, gap analysis, board reporting |
| ISO 27001 | Information security management system | Accredited certification | Formal assurance to customers |
| SOC 2 | Attestation against trust services criteria | Auditor report | Assurance for service providers |
| NIST SP 800-53 | Detailed control catalog | Used in authorization processes | Implementing specific controls |
| CIS Controls | Prioritized technical safeguards | None | Practical hardening priorities |
Because the CSF provides mappings to ISO 27001 and SP 800-53, many organizations run one control program and report it in CSF terms to leadership while also maintaining certification or audit evidence for customers. A security audit can therefore assess the same controls against several frameworks at once.
Applying the framework in practice
Applying the NIST CSF typically follows a repeating cycle of scoping, assessment, prioritization and improvement. The framework itself is deliberately flexible, so its value depends on honest assessment and clear ownership.
- Define the scope and risk context, including business priorities, regulations and critical services.
- Build a current profile by assessing each relevant subcategory with evidence rather than opinion.
- Set a target profile that reflects risk appetite and available resources.
- Analyze gaps and prioritize actions by risk reduction, cost and dependencies.
- Implement, measure and reassess on a regular cycle, often annually.
Common pitfalls include treating the CSF as a checklist, scoring every subcategory without supporting evidence, and setting uniform targets regardless of risk. Another frequent error is claiming compliance with the CSF, although the framework defines no compliance or certification scheme of its own.
In everyday language
The NIST CSF is like a well-organized checklist of goals for keeping an organization safe from cyber attacks. It does not tell you which lock or alarm to buy. Instead, it describes what good protection should achieve, such as knowing what equipment you own, spotting attacks quickly and recovering after a problem.
Organizations use it to compare where they are today with where they want to be, and then decide what to fix first. Because many companies and governments use the same framework, it also gives everyone a shared vocabulary for talking about security.
Seen in the real world
A regional water utility with about 300 employees needs to explain its cybersecurity position to its board and to a state regulator. The security manager uses the NIST CSF 2.0 to build a current profile, assessing each relevant subcategory with evidence such as asset inventories, access reviews and incident response test results.
The assessment shows strong protective controls but weak detection on the operational technology network and no formal supplier risk process under the Govern function. The board approves a target profile at Tier 3 and a two-year roadmap that adds network monitoring for control systems and security requirements in supplier contracts. A year later, the utility reports measurable progress against the same profile, giving the board and the regulator a clear and comparable view of improvement.