NIST CSF v2.0 is a voluntary framework for organizing cybersecurity risk management. Released in February 2024, it helps organizations assess their practices, choose priorities, and improve security in ways that fit their needs. It has no official certification. section 1.5.3
Six functions give leaders and security teams a shared view of the work:
- Govern: Set the risk strategy, expectations, policies, responsibilities, and oversight. section 1.5.3
- Identify: Understand the assets, systems, data, and capabilities exposed to risk. section 1.5.3
- Protect: Put safeguards around critical services. section 1.5.3
- Detect: Recognize events that need attention. section 1.5.3
- Respond: Act on cybersecurity incidents. section 1.5.3
- Recover: Restore capabilities or services impaired by an event. section 1.5.3
Table 1.3 NIST CSF v2.0 with six main functions and categories
| Category |
Function |
| Govern |
Organizational context Risk management Supply-chain risk Roles and responsibilities Policies and procedures Oversight |
| Identify |
Asset management Risk management Improvement |
| Protect |
Access control Awareness and training Data security Platform security Infrastructure resilience |
| Detect |
Continuous monitoring Adverse event analysis |
| Respond |
Incident response Incident analysis Incident reporting Incident mitigation |
| Recover |
Incident recovery Incident communication |
The function-and-category table turns these broad headings into areas to assess, such as asset management, continuous monitoring, and incident recovery. section 1.5.3
Turn a gap assessment into priorities
Suppose a team lacks a reliable asset inventory and has uncertain incident-response responsibilities. It can place those gaps under Identify and Govern, assess the risks they create, and prioritize improvements against business needs. Metrics can then track whether the chosen security measures improve over time; a count alone does not establish their business value. section 1.5.3 section 5.0 section 6.0
Use the framework as a guide, not a substitute for organizational judgment. Its categories help connect security work to risk and goals; the choice of controls and measures still needs to reflect the organization’s assets, threats, and circumstances. section 1.5.3 section 6.0
