NIST CSF Compliance

Overview

NIST CSF 2.0 is organised around six core functions that represent the high-level cybersecurity outcomes every organisation should pursue. Govern establishes the strategic context and oversight. Identify focuses on understanding assets and risks. Protect implements safeguards. Detect enables timely identification of events. Respond addresses incident management. Recover ensures restoration of services and capabilities.

The framework uses a profile-based approach where organisations define their current cybersecurity posture and a target state across CSF categories and subcategories. The gap between current and target profiles drives a prioritised improvement roadmap. Four maturity tiers help organisations assess the sophistication of their risk management practices.

Version 2.0 significantly enhanced the framework's treatment of governance and supply chain risk management. The Govern function ensures that cybersecurity is integrated into enterprise risk management with appropriate executive oversight, policies, and accountability structures.

NIST CSF maps to other frameworks including NIST 800-53, ISO 27001, CIS Controls, and sector-specific standards. These mappings help organisations use CSF as a strategic overlay while implementing specific controls from other frameworks, reducing the burden of managing multiple compliance requirements.

Key Areas

• Govern (GV) - establishing cybersecurity risk management strategy, expectations, and policy
• Identify (ID) - understanding the organisation's assets, risks, and cybersecurity posture
• Protect (PR) - implementing safeguards to ensure delivery of critical services
• Detect (DE) - identifying the occurrence of cybersecurity events in a timely manner
• Respond (RS) - taking action regarding detected cybersecurity incidents
• Recover (RC) - maintaining plans for resilience and restoring capabilities after incidents
• Supply Chain Risk Management - managing cybersecurity risks across the supply chain
• Cybersecurity Profiles - defining current and target cybersecurity postures for gap analysis

Who It's For

• Organisations of all sizes and sectors seeking a flexible, outcome-based approach to cybersecurity risk management
• Security leaders who need a common language to communicate cybersecurity risk to executives, boards, and regulators
• Critical infrastructure operators aligning with US federal cybersecurity expectations
• Companies managing cybersecurity programs that span multiple regulatory and industry requirements

Core Requirements

Policies and Governance

Organisations must establish cybersecurity risk management policies, define governance structures with clear roles and responsibilities, and integrate cybersecurity into broader enterprise risk management. The Govern function requires executive oversight and strategic alignment of cybersecurity with business objectives.

Risk Management

A risk assessment process must identify threats, vulnerabilities, and potential impacts to the organisation's assets and operations. Risk tolerances must be defined, and risk management decisions must be informed by the organisation's mission, stakeholder expectations, and regulatory requirements.

Security Controls

Protective safeguards must be implemented across identity management, access control, data security, platform security, and technology infrastructure. Controls should be selected based on the organisation's risk assessment and aligned with the target cybersecurity profile.

Incident Response

Incident response and recovery capabilities must be established, including detection processes, response planning, communication procedures, analysis capabilities, and recovery plans. The framework emphasises both the ability to respond effectively and to recover and restore normal operations.

Evidence and Reporting

Organisations should document their current and target CSF profiles, risk assessments, and improvement roadmaps. Performance metrics should track progress against the target profile. Regular reviews should assess the effectiveness of the cybersecurity program and inform updates to strategy and priorities.

Implementation Steps

1. Scope and objectives - Define the scope of your cybersecurity program, establish the organisational context including mission priorities and stakeholder expectations, and identify applicable regulatory and contractual requirements. Secure executive sponsorship for the cybersecurity program.
2. Gap assessment - Develop a current profile by assessing your cybersecurity posture against CSF categories and subcategories. Define a target profile reflecting desired outcomes. Identify gaps between current and target states and prioritise improvements based on risk and business impact.
3. Control implementation - Implement controls and processes to close identified gaps, addressing governance, asset management, access control, data protection, detection capabilities, incident response, and recovery planning. Select implementation approaches appropriate to the organisation's size and complexity.
4. Evidence and documentation - Document current and target profiles, risk assessments, and implementation roadmaps. Establish metrics to track progress against the target profile. Maintain evidence of control operation and governance activities to support internal reviews and external reporting.
5. Review and continuous improvement - Regularly review and update CSF profiles as the threat landscape, business environment, and regulatory requirements evolve. Conduct periodic assessments to measure progress. Use the framework's governance function to ensure cybersecurity remains aligned with organisational strategy.

Frequently Asked Questions

What is new in NIST CSF 2.0?

Version 2.0 adds the Govern function as a sixth core function, broadens applicability beyond critical infrastructure to all organisations, enhances supply chain risk management guidance, introduces improved implementation examples, and provides better integration with other NIST frameworks.

Is NIST CSF mandatory?

NIST CSF is voluntary for most organisations. However, it is required for US federal agencies under Executive Order 13800, and many regulatory frameworks reference it. Some industries and contracts effectively mandate its adoption.

What are CSF profiles?

A profile describes the cybersecurity outcomes an organisation has selected from the CSF categories and subcategories. A current profile represents the current state; a target profile represents the desired state. Comparing them identifies gaps and drives improvement planning.

What are CSF tiers?

The four tiers (Partial, Risk Informed, Repeatable, Adaptive) describe the degree to which an organisation's cybersecurity risk management practices exhibit the characteristics defined in the framework. Tiers help organisations understand their maturity and set improvement goals.

How does NIST CSF relate to NIST 800-53?

NIST CSF provides a high-level strategic framework for managing cybersecurity risk. NIST 800-53 provides the detailed, specific controls that can be implemented to achieve CSF outcomes. Organisations often use CSF for strategic planning and 800-53 for operational control selection.

Can small organisations use NIST CSF?

Yes. NIST CSF 2.0 was explicitly designed for organisations of all sizes. NIST provides quick-start guides and simplified resources for small businesses. The framework's flexibility allows organisations to focus on the categories and subcategories most relevant to their risk profile.

How does CSF 2.0 address supply chain risk?

CSF 2.0 significantly expands supply chain risk management guidance. The Govern function includes categories for supply chain risk management strategy and policy, and the framework provides subcategories for assessing and managing supplier cybersecurity practices.

How often should an organisation update its CSF profile?

Profiles should be reviewed and updated when significant changes occur in the threat landscape, business environment, technology infrastructure, or regulatory requirements. Annual reviews are a common practice, with more frequent updates in rapidly changing environments.

Why It Matters

• Cybersecurity risk is a business risk, yet many organisations lack a common language for communicating security posture to boards, executives, regulators, and partners. NIST CSF provides this shared vocabulary, enabling more effective risk communication across technical and non-technical stakeholders.
• The framework addresses the challenge of prioritising cybersecurity investments. By defining current and target profiles, organisations can identify their most significant gaps and allocate resources where they will have the greatest impact. The tiered maturity model helps organisations understand their current capabilities and set realistic improvement targets.
• NIST CSF 2.0's emphasis on governance reflects the recognition that cybersecurity must be integrated into broader enterprise risk management. The new Govern function ensures that cybersecurity risk management is not treated as a purely technical activity but as a strategic priority with appropriate oversight, policies, and accountability.

Common Challenges

• Translating the framework's outcome-based language into specific, actionable controls for the organisation's technology environment
• Achieving meaningful executive engagement with the Govern function rather than treating cybersecurity as a purely technical concern
• Developing current and target profiles that are sufficiently detailed to drive improvement without becoming unwieldy
• Integrating CSF implementation with existing compliance obligations to avoid creating parallel, duplicative programs
• Measuring cybersecurity maturity and progress in ways that are meaningful to both technical teams and business leadership
• Managing supply chain cybersecurity risks when visibility into supplier security practices is limited
• Sustaining momentum for continuous improvement after initial profile development and gap analysis