NIST Cybersecurity Framework 2.0

A voluntary framework of cybersecurity standards and best practices developed by the National Institute of Standards and Technology. It provides organizations with a structure for assessing and improving their ability to prevent, detect, and respond to cyber incidents through five core functions: Identify, Protect, Detect, Respond, and Recover.

JurisdictionTechnical Standards
CategoryTechnical Standards
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The NIST Cybersecurity Framework consists of five core functions:

  • Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident.
  • Recovery Planning
  • Improvements
  • Communications

Each function is further divided into categories and subcategories, providing a comprehensive set of cybersecurity outcomes and references to specific sections of standards, guidelines, and practices. NIST CSF Core Structure

Compliance Challenges

Organizations often face several challenges when implementing the NIST Cybersecurity Framework:

  • Complexity: The framework's extensive nature can be overwhelming, especially for organizations new to structured cybersecurity practices. NIST CSF Implementation Tiers
  • Integration with existing processes: Aligning the framework with current business processes and other regulatory requirements can be challenging. NIST CSF and Existing Efforts

A 2020 study by Tenable found that only 5% of organizations had implemented all critical security controls recommended by frameworks like NIST CSF.

Implementation Best Practices

To effectively implement the NIST Cybersecurity Framework:

  1. Conduct a risk assessment: Identify and prioritize your organization's critical assets and potential threats. NIST Risk Assessment Guide
  1. Create a current profile: Assess your organization's current cybersecurity practices against the framework. NIST CSF Quick Start Guide
  1. Develop a target profile: Define your desired cybersecurity state based on business objectives and risk tolerance. NIST CSF Profile Development
  1. Identify and prioritize gaps: Compare your current and target profiles to determine areas for improvement. NIST CSF Gap Analysis
  1. Implement action plan: Develop and execute a plan to address identified gaps. NIST CSF Implementation Guidance
  1. Continuously monitor and improve: Regularly assess and update your cybersecurity practices. NIST CSF Program Review

Tools and resources:

Recent Updates

NIST released Version 2.0 of the Cybersecurity Framework on February 26, 2024. Key updates include:

  • New Govern function: Added to emphasize the importance of cybersecurity governance. NIST CSF 2.0 Overview
  • Improved alignment with other frameworks: Better integration with other NIST and international standards. NIST CSF 2.0 Crosswalks

The official announcement was made on February 26, 2024. Organizations are encouraged to begin adopting CSF 2.0, though no specific compliance deadline has been set.

Related Regulations

The NIST Cybersecurity Framework aligns with and complements several other standards and regulations:

  • ISO/IEC 27001: International standard for information security management systems. ISO 27001 Overview

NIST provides crosswalks to show how the CSF aligns with these and other standards, facilitating integrated compliance efforts.

Industry Impact

The NIST Cybersecurity Framework has had significant impacts across various industries:

A 2020 study by Gartner found that 70% of organizations will use the NIST Cybersecurity Framework by 2025, up from about 50% in 2020.

Sources

Recent developments

  • — NIST IR 8374 Revision 1, "Ransomware Risk Management: A Cybersecurity Framework (CSF) 2.0 Community Profile," was finalized, providing detailed mappings of CSF 2.0 outcomes to ransomware-specific risk management practices for organizations of varying sizes and sectors.[5][2] (source)
  • — NIST announces NIST IR 8374 Revision 1, "Ransomware Risk Management: A Cybersecurity Framework (CSF) 2.0 Community Profile," providing practical, CSF 2.0‑aligned guidance for proactively managing and mitigating ransomware risk across diverse organizations.[6][1] (source)
  • — NIST released a second public draft of SP 1308, "NIST CSF 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide," to help organizations quickly operationalize CSF 2.0 in ERM and workforce programs, seeking public comments through January 7, 2026.[7] (source)
  • — NIST releases two new CSF 2.0 Quick‑Start Guides, including the final SP 1308 "Cybersecurity, Enterprise Risk Management, and Workforce Management Quick‑Start Guide" and the initial public draft SP 1347 on Informative References, expanding tailored implementation resources for different stakeholder groups.[7][1] (source)
  • — NIST highlights the final version of SP 1308, the CSF 2.0 Quick‑Start Guide for cybersecurity, ERM, and workforce management, aimed at helping organizations integrate CSF 2.0 outcomes into enterprise risk and workforce practices.[1][7] (source)
  • — NIST opens a 45‑day public comment period (closing May 6, 2026) on SP 1347, the CSF 2.0 Informative References Quick‑Start Guide, which explains how mappings to other standards support achieving CSF 2.0 outcomes.[7] (source)
  • — NIST finalizes SP 800‑70 Revision 5, updating National Checklist Program guidance and adding an appendix that enhances mapping between checklist settings, CSF 2.0 outcomes, SP 800‑53 controls, and CCE identifiers to support automated, evidence‑ready reporting.[2][6] (source)
  • — NIST NCCoE issued the draft NIST IR 8323 Revision 2, "Foundational PNT Profile: Applying the Cybersecurity Framework (CSF) for the Responsible Use of PNT Services," updating how CSF 2.0 is applied to positioning, navigation, and timing systems and inviting public comment through September 11, 2025.[2] (source)
  • — NIST publishes a mapping of CSF 2.0 to SP 800‑171 Revision 3 (Protecting Controlled Unclassified Information) in the OLIR catalog, helping organizations align CSF 2.0 implementation with federal CUI protection requirements.[2] (source)
  • — NIST published a mapping of CSF 2.0 to SP 800-171 Revision 3 for protecting controlled unclassified information in nonfederal systems, integrating CSF 2.0 outcomes into the Online Informative References (OLIR) catalog to support compliance and risk management alignment.[2] (source)
  • — NIST updates its CSF 2.0 release communication, emphasizing that the framework’s first major revision since 2014 broadens applicability beyond critical infrastructure and strengthens governance, supply‑chain risk management, and outcome‑based cybersecurity practices.[5][8] (source)
  • — NIST received a cyber policy award recognizing the development and deployment of CSF 2.0, highlighting strong policy and industry support for the framework’s expanded governance and risk management focus.[8] (source)

Read the full guide to NIST Cybersecurity Framework 2.0

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates