GRC-01-002-P · Primer — The NIST Cybersecurity Framework (CSF 2.0)

The idea in one sentence

The NIST Cybersecurity Framework (CSF 2.0) is a voluntary, outcome‑based guide that organizes all cybersecurity work into six core functions—Govern, Identify, Protect, Detect, Respond, and Recover—to align risk decisions with business goals.

Why it exists

Think of a household budgeting app that groups expenses into categories like housing, food, and entertainment so families can see where money flows and adjust priorities; similarly, CSF groups security work so technical and business teams speak the same language. Without such a common map, organizations often spend on flashy tools without knowing which risk areas remain uncovered. The framework solves the problem of fragmented security efforts by providing a shared vocabulary that highlights gaps and aligns investments with desired outcomes.

How it works

First, an organization adopts the six CSF functions as a high‑level map. Next, it inventories its current security activities and maps each to a function—for example, firewalls and encryption fall under Protect, while log aggregation belongs to Detect. In the provided example, the company discovers strong Protect controls but weak Detect capabilities, prompting it to invest in continuous monitoring tools. Because CSF describes outcomes, the team then selects specific controls from existing standards such as NIST SP 800‑53 or ISO 27001 to fill the Detect gap. The Govern function, added in CSF 2.0, ensures senior leadership reviews risk decisions and oversees the entire mapping process. After mapping, the organization sets measurable targets for each function, monitors progress, and adjusts resources as needed.

CSF can be layered with the ISO 27001 Annex A control set for organizations that need certification, or combined with the NIST Risk Management Framework for deeper risk assessment. Some sectors adopt a simplified three‑function view (Identify, Protect, Respond) when resources are limited, but the full six‑function model remains the standard.

See it — the six CSF functions

flowchart LR
  G["Govern"] --> I["Identify"]
  I --> P["Protect"]
  P --> D["Detect"]
  D --> R["Respond"]
  R --> RC["Recover"]

The one gotcha

A common mistake is treating CSF as a checklist of products to purchase; in reality it defines the outcomes you want, and you must choose the specific controls—often from 800‑53 or ISO 27001—to achieve them. The correction is to use CSF as a mapping and prioritization tool, not a shopping list.

The one-line takeaway

CSF 2.0 gives you a common language to turn security risk into concrete, business‑aligned actions.

Where you'll meet it

Practitioners encounter CSF during risk workshops, when drafting security policies, or in audit reports that reference the six functions. Tools like governance dashboards or GRC platforms often include CSF mapping modules to track progress against each function.