The NIST Cybersecurity Framework (CSF) 2.0

Overview

CSWP 29, dated 26 February 2024, offers a taxonomy of high-level cybersecurity outcomes but does not say how to achieve them. It points instead to online resources: Informative References, Implementation Examples, Quick-Start Guides and Community Profiles. The earlier version was titled 'Framework for Improving Critical Infrastructure Cybersecurity'; version 2.0 gives greater weight to governance and supply chains. The framework applies to IT, the Internet of Things (IoT) and operational technology (OT), and to cloud, mobile and AI systems.

The Core is organised in six Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER. These divide into 22 Categories and then Subcategories; GOVERN includes Organizational Context, Risk Management Strategy, Roles, Policy, Oversight and Cybersecurity Supply Chain Risk Management, while PROTECT includes identity and access control, data security, platform security and technology infrastructure resilience. The order or size of items in the Core implies neither sequence nor importance.

Organizational Profiles describe current and/or target posture in terms of Core outcomes. Five steps are suggested: scope the Profile, gather information, create it, analyse gaps between Current and Target Profiles and make an action plan, then implement the plan and update the Profile. A Community Profile is a shared baseline for a sector, technology or threat type and can serve as the basis for a Target Profile. Tiers characterise the rigor of risk governance and management as Partial (1), Risk Informed (2), Repeatable (3) and Adaptive (4).

Section 5 describes how the framework supports two-way communication among executives, managers and practitioners, and how it integrates with enterprise risk management (ERM) and programmes such as the NIST RMF, privacy and supply chain risk. The appendices contain the full Core, a notional illustration of Tiers and a glossary.

Key points

1. The framework is meant for organizations of every size, sector and maturity, and its outcomes are sector-, country- and technology-neutral.
2. The Core has six Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER.
3. GOVERN is new in 2.0 and informs prioritisation of the other five Functions; cybersecurity supply chain risk management is one of its Categories.
4. The Core has 22 Categories with Subcategories; the outcomes are not a checklist.
5. It covers IT, IoT and OT and cloud, mobile and AI systems.
6. An Organizational Profile (current and/or target) drives a gap analysis and action plan in a repeatable cycle.
7. Four Tiers: Partial (1), Risk Informed (2), Repeatable (3), Adaptive (4); moving up is encouraged when risks or mandates are greater or cost-benefit supports it.
8. Informative References map Core outcomes to standards such as SP 800-53; Implementation Examples suggest action-oriented steps.
9. A Target Profile can express requirements to suppliers, partners and other third parties.

Using it in design

• Create separate Organizational Profiles for a facility's IT, OT and building management systems (for example electrical and cooling SCADA/BMS) and state each Profile's scope.
• Translate gaps between Current and Target Profiles into design requirements such as access control, network segmentation and redundant power and communications.
• Pass the Target Profile to suppliers and integrators as a contract requirement (GV.SC).
• Use Informative References to map the framework's outcomes to a detailed control catalogue such as SP 800-53.
• Set a Tier as the security maturity goal when reporting implementation decisions to management.

Who should read it

People who develop and lead cybersecurity programmes, plus executives, risk managers, acquisition professionals, auditors and policy makers.

Document contents

1. Preface
2. 1. Cybersecurity Framework (CSF) Overview
3. 2. Introduction to the CSF Core
4. 3. Introduction to CSF Profiles and Tiers
5. 3.1 CSF Profiles
6. 3.2 CSF Tiers
7. 4. Introduction to Online Resources That Supplement the CSF
8. 5. Improving Cybersecurity Risk Communication and Integration
9. 5.1 Improving Risk Management Communication
10. 5.2 Improving Integration with Other Risk Management Programs
11. Appendix A. CSF Core
12. Appendix B. CSF Tiers
13. Appendix C. Glossary

Related standards

• NIST SP 800-53 Rev. 5
• ISO/IEC 27001

Read the document

Publication details

Authors

National Institute of Standards and Technology

Publisher

National Institute of Standards and Technology

Year

2024

Document number

NIST CSWP 29

Document language

English

Source type

Expert / community

Access

Open licence — downloadable

DOI

10.6028/NIST.CSWP.29

Licence

U.S. public domain — U.S. Government work; free to reuse

Licence evidence

www.copyright.gov

Citation