The NIST Cybersecurity Framework is not a regulation and there is no certificate at the end of it. It is a shared vocabulary for describing what a security program does — which makes it unusually useful as a management tool, because it lets a board, an IT team and an auditor discuss the same program without talking past each other.
The six functions
CSF 2.0 organizes cybersecurity activity into six functions. Version 2.0's headline change was the addition of Govern, which sits above the other five.
- Govern — how cybersecurity risk is managed as part of overall enterprise risk: roles, policy, oversight, supply chain
- Identify — understanding assets, data, suppliers and the risks to them
- Protect — the safeguards: identity, access control, training, data security, platform hardening
- Detect — finding anomalies and adverse events
- Respond — containing, analysing and communicating during an incident
- Recover — restoring capability and learning from what happened
Why Govern was the important addition
Earlier versions described what a security program should do technically but said comparatively little about who is accountable for it. In practice, that was the most common point of failure: organizations with reasonable tooling and no clear owner for risk decisions.
Govern asks the questions that determine whether the rest of the framework has any effect: Who owns cybersecurity risk? How is it reported? What is the organization's risk appetite? How are suppliers assessed and held to account? For most mid-market organizations, this is where the largest gaps sit — and closing them costs organizational attention rather than money.
How to use it without turning it into paperwork
The framework is a structure for assessment and prioritization, not a checklist to complete. A workable approach:
- 1Assess current state honestly against each function, using a simple maturity scale
- 2Define a target profile — the maturity level appropriate to your risk, sector and obligations, which is rarely the maximum
- 3Identify the gaps between current and target, and rank them by the risk they leave open
- 4Build a roadmap that closes the highest-value gaps over a realistic period, usually 12 to 24 months
- 5Re-assess annually and report movement to leadership
What leadership should expect to see
- A named owner for cybersecurity risk with a reporting line to executives
- A current-state assessment and a defined target profile
- A roadmap with sequencing, budget and measurable outcomes
- A risk register with documented acceptances and review dates
- Periodic reporting that shows movement rather than activity volume
Relationship to other frameworks
CSF works well as an organizing layer above more prescriptive requirements. PCI DSS, CMMC and customer contractual requirements map into it cleanly, which means one assessment can serve several obligations. That mapping is worth doing deliberately: it avoids running parallel compliance programs that each ask your team for the same evidence.