NIST CSF 2.0

We assess your maturity against the NIST Cybersecurity Framework 2.0 and then close the gaps with you, from the initial assessment through a well-founded target profile to the control that actually works in operations. This works on its own, alongside an ISMS based on ISO 27001, with the CIS Controls as the technical layer, or as an organizing framework for the obligations under NIS2 and DORA.

Before we get to the framework itself, some context. NIS2, ISO 27001, CIS Controls, NIST CSF: these names are constantly mentioned in the same breath, even though they do not belong to the same category at all. They answer three different questions, and the quickest way to understand this is a single example that runs through all three levels.

The NIST Cybersecurity Framework 2.0 is not a catalog of controls but a common language for cybersecurity: 106 desired outcomes, organized into six functions from Govern through Identify, Protect, Detect and Respond to Recover. It describes what must be achieved and deliberately leaves open how.

It is published by the National Institute of Standards and Technology, the US standards agency. Version 2.0 was released on February 26, 2024, the first fundamental revision since 2014. The former title “Framework for Improving Critical Infrastructure Cybersecurity” has been dropped: the framework is now explicitly aimed at organizations of any size and sector. It is free to use.

This is where most misunderstandings begin. The CSF does not prescribe controls, and NIST says so in the document itself: the outcomes are not a checklist of actions to perform. Outcome PR.AA-03 reads in full: “Users, services, and hardware are authenticated.” There is nothing there about multi-factor authentication. That is intentional: the same wording has to work for a craft business with twelve computers and for a bank.

The CSF thus answers two questions: what must be achieved and how good you are at it. The third, how to do it, it deliberately leaves open. That is why it does not compete with ISO 27001 or the CIS Controls: it is the map, not the to-do list.

The Core has three levels and leads from general to specific: six functions as a language for senior management, 22 categories for thematic structure, and 106 outcomes that the specialist team can discuss.

Govern frames the other five: the function has no protective effect of its own but determines which outcomes take priority in the first place. According to NIST, order and size say nothing about importance. With eleven outcomes, Detect is the smallest function, yet in practice it is regularly the biggest gap. Click a function to see its categories:

Version 1.1 had five functions. The sixth is more than an addition: Govern covers 31 of the 106 outcomes, almost a third of the framework. NIST shifts the focus from the technology in use to the question of who decides on what basis and who is accountable for it.

Two categories are decisive for mid-sized organizations. GV.RR explicitly holds senior leadership accountable. GV.SC dedicates ten outcomes of its own to supply chain risks, from prioritizing suppliers and contractual requirements to involving third parties in contingency planning. In version 1.1, this was a side issue.

Anyone implementing NIS2 will recognize a lot here. The CSF replaces neither the applicability assessment nor the legal obligations, but it places them in a framework that a supervisory board can also read, and it makes the state of implementation comparable from year to year.

The framework is often reduced to its six functions. That leaves out the part that turns a taxonomy into a management tool. Tiers first, because this is where the most persistent misconception lives. Four levels describe how rigorously an organization governs its cybersecurity risks: ad hoc or by policy, case by case or organization-wide, by gut feeling or based on threat data. What they explicitly are not: a maturity model in which level 4 would be the goal for everyone.

For many mid-sized organizations, Tier 3 is the sensible target state; Tier 4 would be expensive symbolism. What matters is not the number but whether the tier fits the threat landscape and the requirements.

The second tool is the organizational profile, and it is the real engine. A profile is not a document but a distance: the Current Profile records which of the 106 outcomes are achieved today, the Target Profile which ones should be. The difference is the roadmap. NIST describes five steps for this:

The weak point of the process lies in step 3: where does the Target Profile come from? Derived from gut feeling or from the wish to look good everywhere, it becomes a wish list with 106 items. This is exactly where our core approach comes in. Which adversaries are targeting your industry and your size, which techniques do they use according to MITRE ATT&CK, and which of the 106 outcomes address exactly these techniques?

This turns a prioritized target state into a justified one, and a maturity assessment into a basis for decisions. NIST provides for this in the framework itself: the Target Profile should take trends from threat data into account. Most assessments still do not.

If you have to choose between the three, here are the differences side by side:

For your choice, this means: choose by the driver, not by the framework. If a customer or a regulator demands proof, there is no way around ISO 27001. If the goal is fast, measurable risk reduction, the CIS Controls are the shorter route. And the CSF is right if you first need to know where you stand, or need a language in which the specialist team and management can discuss the same situation.

We work along the process NIST provides, with an addition at the decisive point. And we do not stop at the roadmap:

If you are heading toward an ISMS based on ISO 27001 anyway, the target profile gives you the prioritization that the standard itself does not provide. If you fall under NIS2 or DORA, you get a structure in which the obligations can be evidenced year after year. And if you only want to know where you stand, our work ends after the roadmap.