The Framework in Plain Terms
The NIST Cybersecurity Framework is a voluntary set of cybersecurity outcomes published by the US National Institute of Standards and Technology. It gives any organisation a common language to assess, prioritise and communicate cyber risk. The current version, CSF 2.0, is built around six core Functions and applies to organisations of any size or sector.
The framework is neither a product nor a certification. It is a reference that helps a board and a security team describe where they stand and where they need to be. First published in 2014 for critical infrastructure, it has become the common vocabulary that insurers, regulators and buyers expect you to speak.
The pressure behind it is real. In the US alone the FBI’s Internet Crime Complaint Center logged 16.6 billion dollars in reported cybercrime losses in 2024, a 33% rise on the year. A framework gives that risk a structure so spending follows priorities instead of headlines.
How the Framework Is Built
The framework has three parts that work together. Learn the Core, the Profiles and the Tiers and you understand the whole model.
The Core
The Core is the heart of it. It is a hierarchy of Functions, Categories and Subcategories that describe cybersecurity outcomes rather than products. CSF 2.0 holds six Functions, 22 Categories and 106 Subcategories with hundreds of worked implementation examples, maintained and updated online by NIST, that show what each outcome looks like in practice.
Profiles
Profiles turn the Core into a plan. A Current Profile records the outcomes you achieve today. A Target Profile records the outcomes you need. The gap between the two is your roadmap and it tells you what to fix first.
NIST and industry groups also publish Community Profiles, pre-built target profiles for a sector or a common use case. Checking for one before writing your own saves time when your situation is not unusual.
Tiers
Tiers describe how rigorously you manage cyber risk, across four levels from Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive. They measure discipline and consistency. Tier 4 is not the automatic goal and a small organisation may be right to aim for Tier 2 or 3.
The Six Functions of CSF 2.0
CSF 2.0 organises every outcome under six Functions. Five describe the lifecycle of handling an incident. The sixth, Govern, sits above them and steers the rest.
- Govern: Sets strategy, roles, policy and risk decisions, and now holds supply-chain risk management. Govern was added in CSF 2.0 and informs the other five.
- Identify: Builds an understanding of your assets, data, suppliers and risks so you know what you are protecting.
- Protect: Puts safeguards in place, including access control, multi-factor authentication, training and data security.
- Detect: Finds and analyses suspicious activity through monitoring, so an incident is seen early.
- Respond: Contains and manages a confirmed incident, including analysis, communication and mitigation.
- Recover: Restores systems and operations after an incident and feeds the lessons back in.
The headline change in 2024 was Govern. CSF 1.1 had five Functions, 23 Categories and 108 Subcategories. CSF 2.0 lifts governance to the top table, moves supply-chain risk into Govern as GV.SC and trims the Core to 106 Subcategories.
Why the Framework Matters for Business
A framework earns its place by changing how money and attention are spent. Three benefits do most of that work.
It gives one language across the business. A CISO, a board member and an auditor can all point at the same Function and agree what good looks like. That shared view is what Govern is for and it is the difference between a security plan and a security conversation the board actually has.
It turns a long control list into priorities. By comparing a Current Profile with a Target Profile, you spend on the gaps that matter rather than the newest tool. The same mapping supports budgeting, because planned projects line up against specific Functions and Categories.
It travels. The framework maps cleanly to ISO 27001 and to the controls behind NIS2 and DORA, so one body of evidence can serve several obligations. Without a framework, teams rebuild the same risk case for every auditor, every insurer and every customer questionnaire.
Adoption reflects this. NIST, citing Gartner, reported the framework was already used by 30% of US organisations by 2015 and its structure has since been echoed by regulators well beyond its original critical-infrastructure remit.
The Framework Against Real Incidents
The value of the Functions is clearest in incidents where one of them was missing. Each case below is public and documented and each points to the outcome that would have changed it.
Change Healthcare, 2024 (Protect)
In February 2024 the ALPHV/BlackCat group reached Change Healthcare through a Citrix remote-access portal that had no multi-factor authentication. Stolen credentials were enough to get in.
UnitedHealth Group’s chief executive confirmed the missing MFA in congressional testimony. The company paid a 22 million dollar ransom, yet the stolen data was never safe and a second group tried to extort it again.
By mid-2025 the breach reached 192.7 million people, the largest healthcare data breach in US history. MFA on remote access is a Protect outcome, PR.AA and it is the single control that would have blunted this.
The MOVEit Campaign, 2023 (Govern)
In May 2023 the Cl0p group mass-exploited a critical zero-day in Progress MOVEit Transfer, a file-transfer product used across thousands of organisations. CISA and the FBI issued a joint advisory within days.
Many victims never ran MOVEit themselves. They were exposed because a payroll provider, a benefits administrator or another supplier did and their data sat in that supplier’s system.
This is what Govern’s supply-chain category, GV.SC, exists to cover. You inherit the risk of every vendor that touches your data and the framework asks you to manage it on purpose rather than discover it in a breach notice.
Colonial Pipeline, 2021 (Recover)
In May 2021 the DarkSide group entered Colonial Pipeline through a dormant VPN account that was still enabled and had no MFA using a leaked password. The company shut its pipeline for roughly a week.
Colonial paid about 4.4 million dollars, but the attacker’s decryption tool was so slow that the firm restored from its own backups anyway. The US Department of Justice later clawed back around 2.3 million dollars of the payment.
The lesson sits in Recover. A tested recovery plan and clean backups, RC.RP, are what bring operations back. A ransom is a cost, not a recovery strategy.
The NIST CSF, NIS2 and EU Compliance
The framework is voluntary and American, but it does real work inside European compliance. It is a control structure so it can carry the evidence that EU rules demand.
NIS2 and its Swedish transposition, Cybersäkerhetslagen (SFS 2025:1506, in force 15 January 2026), require risk management, incident handling and supply-chain security under Article 21. Each maps onto a CSF Function and Govern lines up with the Article 20 duty that makes the board accountable. See our NIS2 compliance guide for the detail.
ISO 27001 is the closest fit. NIST publishes a crosswalk between CSF 2.0 and ISO 27001:2022, so a control assessed once can satisfy both. Teams pursuing certification often use the CSF Functions as the plain-language layer above the ISO controls.
For financial entities, DORA and its ICT risk-management and incident-reporting duties (Article 17, supervised by Finansinspektionen) map to the Identify, Protect, Detect and Respond Functions. The 72-hour breach-notification duty under GDPR Article 33 sits inside Respond.
One caveat matters. Using the framework is not the same as meeting a legal obligation. The CSF organises your controls and your evidence but each regime keeps its own thresholds, deadlines and reporting lines that you still have to meet.
NIST CSF vs the NIST Risk Management Framework
Two NIST frameworks are often confused. The Cybersecurity Framework (CSF) and the Risk Management Framework (RMF) are different tools for different jobs.
The CSF is voluntary and outcome-based. It describes what good cybersecurity looks like in plain terms and suits any organisation that wants to assess and improve its posture.
The RMF, set out in NIST SP 800-37, is a formal process built for US federal information systems under the FISMA law. It runs seven steps, Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor and it draws on the detailed control catalogue in SP 800-53.
Put simply, the CSF helps you decide which outcomes you want and talk about them with a board. The RMF is the rigorous, mandatory machinery a federal system uses to authorise and operate. They are complementary, and an organisation can use the CSF for strategy and the RMF where federal rules apply.
How to Adopt the NIST CSF
Adopting the framework is a project rather than a purchase. A first pass can be done in weeks and improved every year after.
- Scope it: Decide whether you are mapping the whole organisation or one critical system first. Start narrow if you are new to this.
- Build a Current Profile: Walk the six Functions and record, honestly, which outcomes you already achieve. Honesty about the gap is the engine of the method.
- Set a Target Profile: Choose the outcomes you need, guided by your risk, your sector and any Community Profile that fits.
- Prioritise the gap: Rank the differences by risk and cost, then turn the top items into funded actions with owners and dates.
- Start with Govern and Protect: Name an accountable owner, write the core policies and close obvious Protect gaps such as MFA on every remote-access path.
- Reassess on a cycle: Treat the profiles as living documents and review them at least yearly and after any major change or incident.
The people, process and technology all matter but the order is fixed. Decide the outcomes first, assign an owner, then buy the tools that close the named gaps.
