NIST Cybersecurity Framework

The NIST Cybersecurity Framework (NIST CSF) is a voluntary set of guidelines for managing cybersecurity, developed by the U.S. standards body NIST (National Institute of Standards and Technology). Instead of dictating specific tools or products, it describes the outcomes an organization should achieve. In other words, it says what to do, not with what. It is not a checklist or a standard you get certified against. In the current CSF 2.0 release (February 2024), the framework’s core is built around six functions: Govern, Identify, Protect, Detect, Respond and Recover.

What is the NIST Cybersecurity Framework?

NIST CSF was first published in 2014 under a U.S. presidential order (Executive Order 13636). It was originally meant to help operators of critical infrastructure in the United States — for example power grids, water utilities and banks. Over time it became a common language for describing cybersecurity maturity. People started using it well beyond the U.S. and beyond critical infrastructure.

The 2.0 release in 2024 officially extended it to all organizations — regardless of sector, size or maturity. It was also renamed, from „Framework for Improving Critical Infrastructure Cybersecurity” to simply the „Cybersecurity Framework”.

The framework is technology-neutral. It does not name specific products or settings, only describes the expected outcomes (e.g., „assets are inventoried”, „anomalies and events are detected and analyzed”). That makes it easy to line up with other standards and requirements, including ISO/IEC 27001, NIST SP 800-53, CIS Controls and sector-specific rules.

What are the components of NIST CSF?

The framework has three main parts:

• Core — an ordered set of cybersecurity outcomes: functions, categories and subcategories. CSF 2.0 contains 6 functions, 22 categories and 106 subcategories. Subcategories are concrete, measurable outcomes.
• Tiers — four implementation tiers describing how rigorously and how systematically an organization manages risk: Tier 1 — Partial, Tier 2 — Risk Informed, Tier 3 — Repeatable, Tier 4 — Adaptive. These are not maturity levels to „achieve”. They help judge whether your practices fit your actual risk.
• Profiles — the alignment of the Core to a specific organization. A Current Profile describes the present state, and a Target Profile the state you are aiming for. The gap between them drives the action plan and priorities.

What are the functions of NIST CSF 2.0?

The CSF 2.0 Core rests on six high-level functions:

1. Govern (GV) — a new function added in version 2.0. It covers strategy, policy, roles and responsibilities, supply chain risk management and oversight. In the framework’s graphic model, GOVERN sits in the center, because it sets the tone for the other five functions and ties cybersecurity into the company’s overall risk management.
2. Identify (ID) — understanding the organization’s situation: inventorying assets, data, systems and suppliers, and recognizing risks. Without this, you cannot tell what to protect and against what.
3. Protect (PR) — safeguards that reduce the chance and impact of incidents: identity and access management, training, data protection, and system maintenance and configuration.
4. Detect (DE) — finding and analyzing possible attacks and breaches: continuous monitoring, tying events together, and spotting anomalies on the network and on computers.
5. Respond (RS) — actions after an incident is detected: handling the case, analysis, limiting the damage, communication and reporting.
6. Recover (RC) — restoring assets and business operations after an incident, and capturing lessons for the future.

Earlier versions of the framework had five functions, without GOVERN. Adding the Govern function in version 2.0 is the most important substantive change. It signals that cybersecurity is also a leadership responsibility, not just an IT one.

How does NIST CSF differ from ISO/IEC 27001?

Both are based on risk management, but they have a different character and purpose:

• Status: NIST CSF is a voluntary framework — there is no such thing as a „CSF compliance” certificate. ISO/IEC 27001 is a certifiable standard: an organization can obtain a formal certificate after an audit by an independent third party.
• What they describe: ISO 27001 sets requirements for an information security management system (ISMS), with an emphasis on confidentiality, integrity and availability of data. CSF describes cybersecurity outcomes organized into six functions.
• Level of detail: ISO 27001 is more specific — Annex A provides a ready set of controls. CSF is more flexible and outcome-focused. It points to goals, not the way to reach them.
• Working together: the two can be used side by side. CSF is often used to talk about risk with leadership and to point out gaps, while ISO 27001 serves as a certifiable ISMS. Their scopes overlap substantially and can be mapped to each other.

Why does NIST CSF matter for monitoring and threat detection?

From the day-to-day work of security teams (SOC, NDR, network monitoring), the most relevant function is Detect and its subcategories covering continuous monitoring and event analysis. CSF points to outcomes such as continuous monitoring of networks and systems, detecting anomalies, and tying events together from multiple sources. In practice this translates into concrete requirements for telemetry (the data collected from networks and systems):

• Network visibility: flow records (NetFlow/IPFIX), traffic metadata, DNS logs and edge-device events. This is the basis for spotting anomalies and an attacker moving across the network (lateral movement).
• Detection and analysis: tying events together, establishing what normal traffic looks like (baselining), and catching deviations from it. This data then feeds the Respond function.
• Measurability: because subcategories are written as outcomes, they can serve as reference points in a gap analysis — and show you what your detection does not yet cover.

CSF does not define specific detection rules or tools — that is the job of the technical layer. What it provides is a consistent structure in which detection and response capabilities can be described, measured and prioritized.

Learn more

• Incident Response Lifecycle — Supports CSF Respond by guiding how organizations detect, contain, and recover from incidents.
• Cloud Security Posture Management (CSPM) — Helps CSF Identify and Protect by finding cloud misconfigurations and reducing exposure.
• Inventory — Supports CSF Identify by maintaining an accurate view of assets, systems, and dependencies.