--- id: CP-378 slug: nist-csf-2-cybersecurity-framework lang: en title: The NIST CSF 2.0 framework description: "The NIST Cybersecurity Framework 2.0, published in February 2024: its six functions and what it changes for employees and management." canonical_url: https://startbrain.io/cyberpedia/en/articles/nist-csf-2-cybersecurity-framework/ markdown_url: https://startbrain.io/cyberpedia/en/articles/nist-csf-2-cybersecurity-framework.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "The NIST CSF 2.0 framework", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/nist-csf-2-cybersecurity-framework/ (CC BY 4.0) wing: 6 theme: safeguard_data reflex: cr-033 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/nist-csf-2-cybersecurity-framework/ fr: https://startbrain.io/cyberpedia/fr/articles/nist-csf-2-cadre-cybersecurite/ de: https://startbrain.io/cyberpedia/de/articles/nist-csf-2-cybersicherheit-rahmenwerk/ es: https://startbrain.io/cyberpedia/es/articles/nist-csf-2-marco-ciberseguridad/ sources: - "n": 1 title: NIST Releases Version 2.0 of Landmark Cybersecurity Framework publisher: NIST url: https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework published: "2024-02-26" accessed: "2026-11-03" - "n": 2 title: The NIST Cybersecurity Framework (CSF) 2.0 publisher: NIST url: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf published: "2024-02-26" accessed: "2026-11-03" - "n": 3 title: Getting Started with CSF 1.1 publisher: NIST url: https://www.nist.gov/cyberframework/getting-started-csf-11 published: "2018-02-05" accessed: "2026-11-03" - "n": 4 title: Les 10 mesures essentielles pour votre cybersécurité publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/10-mesures-essentielles-assurer-securite-numerique published: "2021-01-06" accessed: "2026-11-03" - "n": 5 title: National Online Informative References Program OLIR publisher: NIST url: https://csrc.nist.gov/projects/olir accessed: "2026-11-03" - "n": 6 title: Cyber Assessment Framework publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/cyber-assessment-framework accessed: "2026-11-03" - "n": 7 title: Cybersecurity Framework publisher: NIST url: https://www.nist.gov/cyberframework accessed: "2026-11-03" --- # The NIST CSF 2.0 framework The NIST Cybersecurity Framework, often abbreviated CSF, is a reference document published by NIST, the US National Institute of Standards and Technology. It describes the outcomes an organization aims to reach to manage its cybersecurity risks. Version 2.0 was published on 26 February 2024 [1]. An employee does not have to read it in full. It mainly helps explain why a company sets rules on passwords, backups or reporting an incident: these rules match specific functions of the framework. This page presents its structure and what it changes, depending on whether you are an employee or a manager. ## In 30 seconds - What it is: a reference framework with six functions (Govern, Identify, Protect, Detect, Respond, Recover), published in version 2.0 on 26 February 2024 [1]. - Its status: version 1.1 is presented as a voluntary guide [3]; version 2.0 "may be adopted voluntarily and through governmental policies and mandates" [2]. The framework does not say how to achieve the outcomes [2]. - For management: the Govern function, added in version 2.0, places cybersecurity among the company's risks [1]. - The reflex: follow your company's security rules and report any unusual message or behavior to the security team. For its part, the framework provides for managing, reporting and communicating an incident, as well as triaging incident reports [2]. ## Straight answers ### Is CSF 2.0 a law? No, according to the sources cited here. NIST describes version 1.1 as a voluntary guide, based on existing standards and practices [3]. Version 2.0 "may be adopted voluntarily and through governmental policies and mandates": a state or an organization can therefore impose it through its own policy, but the document itself creates no obligation [2]. The sources cited here do not address French law: they do not allow us to say whether any French law refers to it. ### Who is concerned? All organizations. Version 2.0 targets organizations of every size and sector, from the smallest schools and nonprofits to the largest agencies and companies [1]. The first version, published in 2014, was aimed first at critical infrastructure [1]. ### What are the six functions? Govern, Identify, Protect, Detect, Respond and Recover. They are detailed below. NIST represents them as a wheel: Govern sits at the center, because this function guides how the other five are carried out [2]. ### Does the CSF say what to do, tool by tool? No. The document describes expected outcomes and prescribes neither the outcomes nor the means of achieving them [2]. The means are described in online resources: informative references, implementation examples, quick-start guides and profiles [2]. ### Does an employee have a role in the CSF? Yes, indirectly. The outcomes of the Protect function include awareness and training as well as data security, and those of the Respond function include reporting and communication [2]. The concrete actions vary from one organization to another, as does the person responsible for them [2]. ## What it changes for employees The framework is aimed first at the people who run a cybersecurity program [2]. The employee sees its effects in internal rules. Three functions concern them day to day. - Protect: the expected outcomes cover identity management, authentication and access control, awareness and training, and data security [2]. In everyday life, this matches the measures from Cybermalveillance.gouv.fr: long, different passwords, two-factor authentication, updates as soon as they are offered, backups with a copy kept off the device [4]. - Detect: the framework aims at the rapid discovery of anomalies and events that may indicate an attack [2]. Faced with an unexpected or alarming message, Cybermalveillance.gouv.fr advises asking the sender for confirmation through another channel [4]. - Respond and Recover: the Respond function covers incident management, analysis, limiting the effects, reporting and communication, and Recover covers restoring the affected assets and activities [2]. The actions to take and the people who take them depend on the organization [2]. In practice, the employee follows the internal procedure and informs the right person. The separation of personal and professional uses, another Cybermalveillance.gouv.fr measure, prevents the compromise of a personal account from harming the company, and the reverse [4]. ## What it changes for management CSF 2.0 adds the Govern function. It covers the cyber risk management strategy, expectations and policy, which must be established, communicated and monitored [2]. It covers the organizational context, strategy, supply chain risk management, roles, responsibilities and authorities, policy and oversight [2]. NIST stresses that cybersecurity is a major source of risk for the enterprise, which leaders must consider alongside other risks such as financial and reputational ones [1]. The framework also provides for profiles: a current profile describes the outcomes achieved, and a target profile describes those the organization has chosen and ranked by priority [2]. Comparing the two makes it possible to spot gaps [2]. Tiers characterize the rigor of governance and risk management [2]. ## What the text says The document is organized in three components: the Core, which groups functions, categories and subcategories of outcomes; the organizational profiles; and the Tiers [2]. Here are the six functions, as NIST defines them. - Govern: the risk management strategy, expectations and policy are established, communicated and monitored [2]. - Identify: the current risks are understood, which requires knowing the assets (data, hardware, software, systems, facilities, services, people) and the suppliers [2]. - Protect: safeguards are put in place [2]. - Detect: possible attacks and compromises are found and analyzed [2]. - Respond: actions are taken regarding a detected incident [2]. - Recover: the assets and operations affected by an incident are restored [2]. The outcomes do not form a task list: the order and size of the functions imply neither sequence nor importance [2]. The functions are handled in parallel. Govern, Identify, Protect and Detect are carried out continuously, while Respond and Recover must be ready at all times [2]. The framework applies to all information and communications technology, including cloud, mobile and artificial intelligence [2]. ## Where implementation stands CSF 2.0 has been published since 26 February 2024 [1]. NIST added quick-start guides for specific audiences, including small businesses, as well as a catalog of references that links the framework to more than 50 other cybersecurity documents [1]. Its home page mentions in 2026 an Arabic translation and a two-year anniversary on 24 February 2026 [7]. On the alignment with other texts, the sources cited here say little. NIST states that its work with ISO and IEC makes it possible to build cybersecurity frameworks and to organize measures according to the CSF functions [1]. NIST's OLIR program publishes mappings between elements of third-party documents and those of NIST documents [5]. The sources cited here mention neither ISO 27001 nor NIS 2 by name: this page therefore takes no position on these two texts. Another country has built its own framework. The UK NCSC's Cyber Assessment Framework is organized around four objectives, including risk management, protection, detection and minimizing the impact of incidents [6]. It is used in sectors regulated under the UK NIS regulations [6]. This framework is distinct from the CSF. ## Sources 1. NIST, "NIST Releases Version 2.0 of Landmark Cybersecurity Framework", 26 February 2024. https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework (accessed 3 November 2026) 2. NIST, "The NIST Cybersecurity Framework (CSF) 2.0", 26 February 2024. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf (accessed 3 November 2026) 3. NIST, "Getting Started with CSF 1.1", 5 February 2018. https://www.nist.gov/cyberframework/getting-started-csf-11 (accessed 3 November 2026) 4. Cybermalveillance.gouv.fr, "Les 10 mesures essentielles pour votre cybersécurité", 6 January 2021. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/10-mesures-essentielles-assurer-securite-numerique (accessed 3 November 2026) 5. NIST, "National Online Informative References Program OLIR". https://csrc.nist.gov/projects/olir (accessed 3 November 2026) 6. NCSC (UK), "Cyber Assessment Framework". https://www.ncsc.gov.uk/collection/cyber-assessment-framework (accessed 3 November 2026) 7. NIST, "Cybersecurity Framework". https://www.nist.gov/cyberframework (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/nist-csf-2-cybersecurity-framework/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.