Home / Knowledge hub / NIST Cybersecurity Framework
Knowledge hub
NIST Cybersecurity Framework
A voluntary framework that organises security work into six core functions.
What it means
The NIST Cybersecurity Framework, or CSF, is a voluntary guide from the US National Institute of Standards and Technology. Version 2.0, published in 2024, organises security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Earlier versions had five, without Govern.
It does not tell you which tools to buy. It describes outcomes, such as knowing what assets you have or being able to recover from an incident, and lets you decide how to reach them. That is why companies of any size can use it.
Why it matters
It gives a founder or board a shared way to talk about security without jargon. You can say where you are strong, where you are thin, and what you plan to improve next, in a form customers and insurers recognise.
It is also a common reference point in questionnaires. Many buyers ask whether you align with it, and it maps neatly onto other standards such as ISO 27001 and SOC 2. Aligning is not a certificate. Nobody issues one for the CSF.
How it shows up
Teams use it in three ways. A current profile records where you are today. A target profile records where you want to be. The gap between them becomes the plan. Implementation tiers describe how mature and repeatable your practices are.
In day-to-day terms, Identify covers asset lists and risk, Protect covers controls such as access control and patching, Detect covers monitoring, Respond covers your incident response plan, and Recover covers backups and restoring service. Testing your own applications fits under Identify and Protect.
Questions people ask
NIST Cybersecurity Framework, answered
Is the NIST CSF mandatory?
No. It is voluntary for most private organisations. Some US federal agencies and contracts require it or something based on it.
Regulators and customers elsewhere often use it as a reference.
Can we be certified against the CSF?
No. NIST does not certify anyone. You can assess yourself, or have a third party assess you, and describe your alignment.
Be careful with any vendor that claims to sell a CSF certificate.
What are the six functions?
Govern, Identify, Protect, Detect, Respond and Recover. Govern sets strategy, roles and policy. The other five cover what you do before, during and after an event.
Govern was added in version 2.0.
How is the CSF different from ISO 27001?
ISO 27001 is a certifiable standard for an information security management system. The CSF is a flexible set of outcomes with no certification.
Many organisations use the CSF to plan and ISO 27001 to prove.
Is the CSF only for large companies?
No. NIST publishes quick-start guides for smaller organisations. You can start with a short current profile and a short list of gaps.
Pick the outcomes that match your real risks.
Sources
Where this comes from
Related
Terms that sit next to this one
ISO 27001
The international standard for running an information security management system.
SOC 2
An audit report on how well a service provider protects customer data.
CIS Controls
A prioritised list of safeguards that stop the most common cyber attacks.
Risk register
A running list of risks, their owners, ratings and chosen responses.
Incident response plan
A written plan for who does what in the first hours after a security incident.
Where do your gaps really sit?
A framework tells you what to cover. Our proof-backed findings show whether your web apps and APIs hold up in practice, and a retest proves each fix. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.