NIST CSF 2.0

Version 2.0, released in February 2024, added a sixth function, Govern, covering strategy, roles and oversight. It also expanded the framework's intended audience from critical infrastructure to organizations of every size and gave more weight to supply chain risk.

NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in version 2.0, published February 26, 2024, and sits at the center because it informs how a firm carries out the other five. Identify, Protect, Detect, Respond and Recover describe what the security program does day to day.

The biggest change is the new Govern function. CSF 1.1 had five functions: Identify, Protect, Detect, Respond and Recover. CSF 2.0, published February 26, 2024, keeps those and adds Govern at the center, covering risk strategy, leadership accountability, policy, oversight and supply chain risk management. It is written for organizations of every size and sector.

A Community Profile is a baseline of CSF outcomes published for organizations with shared interests, such as a sector or a threat type. Examples on NIST's site include the Ransomware Risk Management Profile and the Cyber Risk Institute's Financial Sector Profile. A firm can copy one into its own Target Profile and adjust the priorities.

Govern has six categories: Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles, Responsibilities, and Authorities (GV.RR), Policy (GV.PO), Oversight (GV.OV), and Cybersecurity Supply Chain Risk Management (GV.SC). Together they cover how leadership sets risk tolerance, assigns accountability, approves policy, reviews results and manages vendor risk.

No. The NIST Cybersecurity Framework is voluntary guidance, and no regulator requires a private professional firm to adopt it by name. Firms use it as a common structure for their security program because its six functions map well to rules such as the FTC Safeguards Rule, Regulation S-P and state reasonable security laws.

Yes. NIST publishes a free CSF 2.0 Organizational Profile template as a spreadsheet that places Current and Target Profiles side by side so gaps are easy to see. NIST Special Publication 1301, the quick-start guide for Organizational Profiles, explains how to scope, complete and use it.

NIST CSF 2.0 organizes cybersecurity outcomes into six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in version 2.0 and covers how leadership sets risk strategy, roles, policy and oversight. Earlier versions of the framework had five Functions, which is why some sources still describe five pillars.

NIST CSF 2.0 defines four Tiers: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). They describe how rigorous a firm's cybersecurity risk governance and management practices are, moving from ad hoc, case-by-case decisions toward formal, firm-wide policy and, at Tier 4, risk management that adapts continuously and is monitored alongside financial risk.

No. NIST says Tiers should complement a firm's risk management method, and that moving to a higher Tier is encouraged when risks or mandates are greater or when a cost-benefit analysis shows a feasible, cost-effective risk reduction. A firm can set different target Tiers for different Functions, based on its risks, obligations and budget, and revisit them each year.

Leadership. NIST SP 1302, the quick-start guide for using the CSF Tiers, says Tier selection is generally performed by organization leadership. It suggests choosing Tiers at the Function or Category level and weighing current practices, threats, legal and regulatory requirements, business objectives, supply chain needs and resource constraints. The IT provider supplies evidence; the partners or board make the call.