Cyberpediaby Brain
ENDEFR

The NIST CSF 2.0 framework

The NIST Cybersecurity Framework 2.0, published in February 2024: its six functions and what it changes for employees and management.

In 30 seconds

What it is
A reference framework with six functions (Govern, Identify, Protect, Detect, Respond, Recover), published in version 2.0 on 26 February 20241.
Its status
Version 1.1 is presented as a voluntary guide3; version 2.0 "may be adopted voluntarily and through governmental policies and mandates"2. The framework does not say how to achieve the outcomes2.
For management
The Govern function, added in version 2.0, places cybersecurity among the company's risks1.
The reflex
Follow your company's security rules and report any unusual message or behavior to the security team. For its part, the framework provides for managing, reporting and communicating an incident, as well as triaging incident reports2.

What it is

The NIST Cybersecurity Framework, often abbreviated CSF, is a reference document published by NIST, the US National Institute of Standards and Technology. It describes the outcomes an organization aims to reach to manage its cybersecurity risks. Version 2.0 was published on 26 February 20241.

An employee does not have to read it in full. It mainly helps explain why a company sets rules on passwords, backups or reporting an incident: these rules match specific functions of the framework. This page presents its structure and what it changes, depending on whether you are an employee or a manager.

Straight answers

Is CSF 2.0 a law?

No, according to the sources cited here. NIST describes version 1.1 as a voluntary guide, based on existing standards and practices3. Version 2.0 "may be adopted voluntarily and through governmental policies and mandates": a state or an organization can therefore impose it through its own policy, but the document itself creates no obligation2. The sources cited here do not address French law: they do not allow us to say whether any French law refers to it.

Who is concerned?

All organizations. Version 2.0 targets organizations of every size and sector, from the smallest schools and nonprofits to the largest agencies and companies1. The first version, published in 2014, was aimed first at critical infrastructure1.

What are the six functions?

Govern, Identify, Protect, Detect, Respond and Recover. They are detailed below. NIST represents them as a wheel: Govern sits at the center, because this function guides how the other five are carried out2.

Does the CSF say what to do, tool by tool?

No. The document describes expected outcomes and prescribes neither the outcomes nor the means of achieving them2. The means are described in online resources: informative references, implementation examples, quick-start guides and profiles2.

Does an employee have a role in the CSF?

Yes, indirectly. The outcomes of the Protect function include awareness and training as well as data security, and those of the Respond function include reporting and communication2. The concrete actions vary from one organization to another, as does the person responsible for them2.

1What it changes for employees1 min

The framework is aimed first at the people who run a cybersecurity program2. The employee sees its effects in internal rules. Three functions concern them day to day.

  • Protect: the expected outcomes cover identity management, authentication and access control, awareness and training, and data security2. In everyday life, this matches the measures from Cybermalveillance.gouv.fr: long, different passwords, two-factor authentication, updates as soon as they are offered, backups with a copy kept off the device4.
  • Detect: the framework aims at the rapid discovery of anomalies and events that may indicate an attack2. Faced with an unexpected or alarming message, Cybermalveillance.gouv.fr advises asking the sender for confirmation through another channel4.
  • Respond and Recover: the Respond function covers incident management, analysis, limiting the effects, reporting and communication, and Recover covers restoring the affected assets and activities2. The actions to take and the people who take them depend on the organization2. In practice, the employee follows the internal procedure and informs the right person.

The separation of personal and professional uses, another Cybermalveillance.gouv.fr measure, prevents the compromise of a personal account from harming the company, and the reverse4.

2What it changes for managementManagement1 min

CSF 2.0 adds the Govern function. It covers the cyber risk management strategy, expectations and policy, which must be established, communicated and monitored2. It covers the organizational context, strategy, supply chain risk management, roles, responsibilities and authorities, policy and oversight2.

NIST stresses that cybersecurity is a major source of risk for the enterprise, which leaders must consider alongside other risks such as financial and reputational ones1. The framework also provides for profiles: a current profile describes the outcomes achieved, and a target profile describes those the organization has chosen and ranked by priority2. Comparing the two makes it possible to spot gaps2. Tiers characterize the rigor of governance and risk management2.

3What the text saysOfficial text1 min

The document is organized in three components: the Core, which groups functions, categories and subcategories of outcomes; the organizational profiles; and the Tiers2. Here are the six functions, as NIST defines them.

  • Govern: the risk management strategy, expectations and policy are established, communicated and monitored2.
  • Identify: the current risks are understood, which requires knowing the assets (data, hardware, software, systems, facilities, services, people) and the suppliers2.
  • Protect: safeguards are put in place2.
  • Detect: possible attacks and compromises are found and analyzed2.
  • Respond: actions are taken regarding a detected incident2.
  • Recover: the assets and operations affected by an incident are restored2.

The outcomes do not form a task list: the order and size of the functions imply neither sequence nor importance2. The functions are handled in parallel. Govern, Identify, Protect and Detect are carried out continuously, while Respond and Recover must be ready at all times2.

The framework applies to all information and communications technology, including cloud, mobile and artificial intelligence2.

4Where implementation stands1 min

CSF 2.0 has been published since 26 February 20241. NIST added quick-start guides for specific audiences, including small businesses, as well as a catalog of references that links the framework to more than 50 other cybersecurity documents1. Its home page mentions in 2026 an Arabic translation and a two-year anniversary on 24 February 20267.

On the alignment with other texts, the sources cited here say little. NIST states that its work with ISO and IEC makes it possible to build cybersecurity frameworks and to organize measures according to the CSF functions1. NIST's OLIR program publishes mappings between elements of third-party documents and those of NIST documents5. The sources cited here mention neither ISO 27001 nor NIS 2 by name: this page therefore takes no position on these two texts.

Another country has built its own framework. The UK NCSC's Cyber Assessment Framework is organized around four objectives, including risk management, protection, detection and minimizing the impact of incidents6. It is used in sectors regulated under the UK NIS regulations6. This framework is distinct from the CSF.

Fact sheet

Identifier
CP-378
Wing
6. Governance and GRC
Brain skill
Safeguarding Data (safeguard_data)
Brain reflex
cr-033
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. NIST, “NIST Releases Version 2.0 of Landmark Cybersecurity Framework”, 26 February 2024. https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework (accessed 3 November 2026)
  2. NIST, “The NIST Cybersecurity Framework (CSF) 2.0”, 26 February 2024. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf (accessed 3 November 2026)
  3. NIST, “Getting Started with CSF 1.1”, 5 February 2018. https://www.nist.gov/cyberframework/getting-started-csf-11 (accessed 3 November 2026)
  4. Cybermalveillance.gouv.fr, “Les 10 mesures essentielles pour votre cybersécurité”, 6 January 2021. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/10-mesures-essentielles-assurer-securite-numerique (accessed 3 November 2026)
  5. NIST, “National Online Informative References Program OLIR”. https://csrc.nist.gov/projects/olir (accessed 3 November 2026)
  6. NCSC (UK), “Cyber Assessment Framework”. https://www.ncsc.gov.uk/collection/cyber-assessment-framework (accessed 3 November 2026)
  7. NIST, “Cybersecurity Framework”. https://www.nist.gov/cyberframework (accessed 3 November 2026)

Cite this article

Brain, “The NIST CSF 2.0 framework”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/nist-csf-2-cybersecurity-framework/

BibTeX 
@misc{brain_cp378_en_2026,
  author = {Brain},
  title = {The NIST CSF 2.0 framework},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/nist-csf-2-cybersecurity-framework/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence