QULDEXResources · Glossary
NIST CSF 2.0 definition: the framework in brief
What does NIST CSF mean?
The CSF describes what good cybersecurity achieves, not how to achieve it. Each outcome can be met with controls from other sources, such as NIST SP 800-53 or ISO 27001.
Organisations use it to describe where they are now, decide where they need to be, and explain the gap to leadership in plain terms.
What are the six functions?
Set strategy, roles and policy; understand assets and risks.
Apply safeguards; find attacks and compromises.
Act on incidents; restore affected services.
How is the CSF used?
A common way to apply the framework.
| Step | What happens |
|---|---|
| Scope | Decide what the profile covers |
| Current profile | Record which outcomes are achieved today |
| Target profile | Decide which outcomes are needed, by priority |
| Gap | Compare the two and plan the work |
| Repeat | Update the profiles as the organisation changes |
This is an illustration written for this page, not a customer record.
NIST CSF 2.0: key facts
| Topic | Detail | Notes |
|---|---|---|
| Published | 26 Feb 2024 | CSF 2.0 replaced version 1.1 of 2018. |
| New in 2.0 | Govern | A sixth function covering strategy, roles, policy and oversight. |
| Scope | All organisations | No longer framed only for critical infrastructure. |
| Assurance | No certificate | There is no official CSF certification; organisations self-assess or use an independent assessor. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What do people get wrong about the CSF?
'We are CSF certified'
NIST does not certify against the CSF.
Instead: say you have assessed or aligned to it.
Treating tiers as a maturity score
Tiers describe how risk is managed, not a grade to maximise.
Instead: choose the tier that fits your risk.
Using version 1.1 material
Older mappings lack the Govern function.
Instead: check that references are to 2.0.
How does QULDEX handle this?
One control and one piece of evidence count towards every framework they apply to.
NIST CSF 2.0: common questions
Is NIST CSF mandatory?
It is voluntary for most organisations. Some US federal requirements and contracts refer to it.
Can you be certified to NIST CSF?
No. There is no official certification. You can self-assess or commission an independent assessment.
What is the difference between NIST CSF and NIST 800-53?
The CSF describes outcomes. SP 800-53 is a catalogue of specific controls that can be used to achieve them.
Assess against CSF 2.0 and other frameworks together
Controls, evidence, findings and corrective actions in one audit workspace.