NIST CSF 2.0: What It Is and How Purplecop Helps

What is the NIST Cybersecurity Framework 2.0?

The NIST CSF 2.0 is a framework published by NIST as NIST CSWP 29. It gives a taxonomy of high-level cybersecurity outcomes that any organization can use to understand, assess, prioritize and communicate its cybersecurity efforts. NIST is clear that the CSF "does not prescribe how outcomes should be achieved."

The framework has three components:

• The Core: the outcomes themselves, arranged as Functions, Categories and Subcategories.
• Organizational Profiles: a way to describe an organization's current and target cybersecurity posture in terms of the Core's outcomes.
• Tiers: a way to characterize how rigorous an organization's cybersecurity risk governance and management practices are.

Is the NIST CSF mandatory, and can you be certified to it?

For most organizations the CSF is voluntary, and NIST does not offer a CSF certification. NIST's FAQ says "NIST is not a regulatory agency, and most organizations use the CSF on a voluntary basis." The same FAQ adds that Executive Order 13800 made the Framework mandatory for U.S. federal government agencies, and that some companies require the CSF for their customers or within their supply chain.

On certification, NIST says it "does not offer certifications or endorsements of CSF-related products, implementations, or services, and there are no plans to develop a conformity assessment program." A more accurate claim than "NIST CSF certified" is that an organization has aligned its program to CSF outcomes or assessed itself against a Profile.

What are the six Functions of NIST CSF 2.0?

The six Functions are Govern, Identify, Protect, Detect, Respond and Recover. NIST defines them as outcomes:

• Govern (GV): the organization's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored.
• Identify (ID): the organization's current cybersecurity risks are understood.
• Protect (PR): safeguards to manage cybersecurity risks are used.
• Detect (DE): possible attacks and compromises are found and analyzed.
• Respond (RS): actions regarding a detected incident are taken.
• Recover (RC): assets and operations affected by an incident are restored.

What changed between CSF 1.1 and CSF 2.0?

The biggest change is a new sixth Function, Govern. NIST's FAQ says it was added to emphasize the role of cybersecurity governance, which previously sat inside Identify, and to align CSF 2.0 with NIST's other frameworks.

Other changes NIST describes:

• Wider audience. Before version 2.0 the framework was titled "Framework for Improving Critical Infrastructure Cybersecurity." NIST says that title is not used for CSF 2.0, which is designed for organizations of all sizes and sectors.
• Supply chain focus. NIST says CSF 2.0 highlights the importance of governance and supply chains.
• Online resources. NIST now provides Implementation Examples and Informative References online, plus Quick Start Guides.
• No lost content. NIST says no content was removed from 1.1 to 2.0; the meaning of all 1.1 content is included.

What are CSF Profiles and Tiers?

A Profile describes where an organization is and where it wants to be. A Current Profile records the outcomes it is achieving now. A Target Profile records the outcomes it has selected and prioritized. Comparing the two is a gap analysis, followed by a prioritized action plan. A Community Profile is a baseline of outcomes published for a sector, technology or threat type, which an organization can use as the basis for its own Target Profile.

Tiers are Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). They describe a progression from informal, ad hoc responses to approaches that are agile, risk-informed and continuously improving. NIST says Tiers should complement an organization's risk management methodology rather than replace it.

How do you start using the NIST CSF?

NIST describes one way to start in five steps: scope the Organizational Profile, gather the information needed, create the Profile, analyze the gaps between Current and Target Profiles and make an action plan, then implement the plan and update the Profile. NIST adds that an organization can repeat these steps as often as needed.

NIST also publishes a CSF 2.0 Small Business Quick Start Guide for smaller organizations with modest or no cybersecurity plans. Outside help is optional: NIST's FAQ says organizations are not required to use a consultant and that NIST does not recommend consultants or assessors.

How is NIST CSF 2.0 different from ISO 27001 and SOC 2?

The three are different kinds of thing:

• NIST CSF 2.0 is a framework of outcomes from NIST that most organizations use voluntarily. NIST does not offer certification for it.
• ISO/IEC 27001 is a standard that defines the requirements an information security management system must meet. ISO does not issue certificates; external certification bodies do.
• SOC 2 is an assurance report. CPAs use AICPA's SOC offerings to provide assurance reports.

Does Purplecop help with NIST CSF 2.0?

Yes. Purplecop Security's GRC & Compliance Advisory service lists NIST CSF 2.0 in its framework adoption work, alongside ISO/IEC 27001, SOC 2, PCI DSS, HIPAA, DPDPA and GDPR. The service also includes a gap assessment against your target framework, with a prioritized remediation plan.

Purplecop GRC includes a CSAT module, which its product page describes as maturity benchmarking against NIST CSF 2.0, ISO 27001 and the regulator packs.

Because NIST does not certify CSF implementations, nothing Purplecop provides results in a NIST certificate or endorsement.

What is NIST CSF 2.0?

NIST CSF 2.0 is guidance from the US National Institute of Standards and Technology, published on February 26, 2024, that lists cybersecurity outcomes any organization can use to manage cybersecurity risk. It has six Functions: Govern, Identify, Protect, Detect, Respond and Recover.

Is NIST CSF 2.0 mandatory?

Most organizations use it voluntarily. NIST says Executive Order 13800 made the Framework mandatory for U.S. federal government agencies, and some companies require it of customers or suppliers.

Can a company be NIST CSF certified?

NIST does not offer a CSF certification. NIST says it does not offer certifications or endorsements of CSF-related products, implementations or services, and has no plans to develop a conformity assessment program.

What is new in CSF 2.0?

The main addition is the Govern Function, which covers cybersecurity strategy, policy, roles and oversight. NIST also widened the audience beyond critical infrastructure, emphasized supply chains and added online Implementation Examples and Informative References.

Does the CSF apply to small businesses?

Yes. NIST says the CSF was developed for organizations of any size, sector or maturity, and it publishes a Small Business Quick Start Guide.

Can Purplecop make my organization NIST CSF compliant?

NIST says it does not offer certifications or endorsements of CSF-related products, implementations or services, so no NIST CSF certification is available from NIST, and Purplecop does not promise one. Purplecop Security's GRC & Compliance Advisory service lists NIST CSF 2.0 in its framework adoption work and includes a gap assessment against your target framework, with a prioritized remediation plan.