NIST CSF

The NIST Cybersecurity Framework (CSF) 2.0, released February 26, 2024, is a voluntary framework of cybersecurity outcomes that any organization can use to understand, assess, prioritize and communicate its cybersecurity risk. It is organized into six functions: Govern (new in 2.0), Identify, Protect, Detect, Respond and Recover, broken into 22 categories and 106 subcategories.

Version 2.0 widened the audience from critical infrastructure to all organizations, added quick-start guides and implementation examples, and expanded the informative references that map its outcomes to other documents such as NIST SP 800-53 and SP 800-171.

The mappings to ISO/IEC 27001 listed in NIST's catalog were written by outside parties; NIST does not test or endorse outside mappings.

The CSF does not prescribe controls or require certification, and NIST offers no certification or conformity assessment.

Organizations that use it typically write down a Current Profile (where they are), a Target Profile (where they want to be), a prioritized action plan, and the governance records the Govern function describes: risk management strategy, roles and responsibilities, policies, and supply chain risk management expectations.

Ohio, Iowa, Connecticut and Texas name the framework, under its original title (Framework for Improving Critical Infrastructure Cybersecurity), in laws that give a business with a qualifying written security program either a defense to certain data breach claims or protection from punitive damages. Utah's similar law does not list the CSF.