NIST CSF 2.0 Requirements: Complete Guide to the Cybersecurity Framework
The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, is a voluntary framework that helps organizations manage cybersecurity risk. The updated version adds a sixth function (Govern) and expands applicability beyond critical infrastructure to all organizations. While NIST CSF is not a certification, it is widely used as a foundation for cybersecurity programs and is often referenced in regulations and contracts. This guide covers the key requirements across all six functions.
Table of Contents
Govern (GV) — New in CSF 2.0
The Govern function establishes and monitors the organization cybersecurity risk management strategy, expectations, and policy. This is the new overarching function added in CSF 2.0.
Organizational Context
Your organization must understand its mission, stakeholder expectations, and legal/regulatory requirements to inform cybersecurity risk management decisions. This means documenting your business context and how cybersecurity supports your objectives.
Risk Management Strategy
You must establish and communicate a cybersecurity risk management strategy that includes risk appetite, tolerance levels, and priorities. The strategy must be approved by leadership and regularly reviewed.
Roles, Responsibilities, and Authorities
Cybersecurity roles, responsibilities, and authorities must be established and communicated. Everyone must know who is accountable for cybersecurity decisions and actions within the organization.
Supply Chain Risk Management
You must establish a supply chain risk management program. This includes identifying critical suppliers, assessing their cybersecurity practices, including security requirements in contracts, and monitoring supply chain risks.
Identify (ID)
The Identify function helps you understand your cybersecurity risk to systems, assets, data, and capabilities.
Asset Management
You must inventory and manage all hardware, software, data, and external information systems. You need to know what you have, where it is, and who is responsible for it. This includes discovering and tracking shadow IT.
Risk Assessment
You must identify, analyze, and prioritize cybersecurity risks. This includes identifying threats and vulnerabilities, assessing likelihood and impact, and determining risk responses. Risk assessments must be conducted regularly and after significant changes.
Improvement
Improvements to cybersecurity risk management processes, procedures, and activities must be identified across all functions. This includes learning from incidents, assessments, and industry best practices.
Protect (PR)
The Protect function implements safeguards to ensure delivery of critical services and limit the impact of cybersecurity events.
Identity Management, Authentication, and Access Control
Access to assets must be limited to authorized users, processes, and devices. This includes identity proofing, credential management, multi-factor authentication, and access control based on least privilege principles.
Awareness and Training
All users must be informed and trained to perform their cybersecurity-related duties. This includes security awareness training, role-based training for privileged users, and training for third-party stakeholders.
Data Security
Data must be managed consistent with your risk strategy to protect confidentiality, integrity, and availability. This includes encryption at rest and in transit, data integrity checking, and data leakage prevention.
Platform Security
The hardware, software, and services of physical and virtual platforms must be managed to protect their confidentiality, integrity, and availability. This includes secure configuration, patch management, and secure development practices.
Technology Infrastructure Resilience
Security architectures must be managed to protect asset confidentiality, integrity, and availability, and organizational resilience. This includes network segmentation, redundancy, and infrastructure protection.
Detect (DE)
The Detect function implements activities to identify the occurrence of cybersecurity events.
Continuous Monitoring
You must continuously monitor your information systems and assets to identify cybersecurity events and verify the effectiveness of protective measures. This includes network monitoring, endpoint detection, and log analysis.
Adverse Event Analysis
Anomalies and potential cybersecurity events must be analyzed to determine if they represent actual incidents. This includes correlating events from multiple sources, understanding normal behavior baselines, and determining event impact.
Respond (RS)
The Respond function implements activities to take action against detected cybersecurity incidents.
Incident Management
You must have incident response plans that are executed when incidents are detected. This includes triage, containment, eradication, and communication procedures. Incident responders must know their roles and have the authority to act.
Incident Analysis
Investigations must be conducted to understand the scope and impact of incidents. This includes forensic analysis, root cause determination, and documenting findings. Incidents must be categorized and prioritized.
Incident Reporting and Communication
Response activities must be coordinated with internal and external stakeholders. This includes communicating with affected parties, reporting to regulators as required, and sharing information with ISACs and other organizations.
Recover (RC)
The Recover function implements activities to maintain plans for resilience and restore services after a cybersecurity incident.
Incident Recovery Plan Execution
Recovery plans must be executed during or after an incident to restore systems and services. This includes backup restoration, system rebuilding, and verifying the integrity of restored systems before returning them to production.
Frequently Asked Questions
Is NIST CSF mandatory?
NIST CSF is voluntary for most organizations. However, it is mandatory for US federal agencies (per Executive Order 13800), and many industries and contracts reference it as a baseline. Some state regulations also reference NIST CSF as a standard of reasonable security.
What is new in NIST CSF 2.0?
CSF 2.0 (released February 2024) adds the Govern function as a sixth core function, expands applicability beyond critical infrastructure to all organizations, introduces community profiles, and provides updated implementation examples and quick-start guides.
Can you get NIST CSF certified?
No, NIST CSF does not have a formal certification program. Organizations can self-assess or hire third parties to evaluate their alignment with the framework. Some organizations pursue SOC 2 or ISO 27001 certification while using NIST CSF as the underlying control framework.
How does NIST CSF relate to ISO 27001?
NIST CSF and ISO 27001 are complementary. NIST CSF provides a high-level risk-based framework, while ISO 27001 provides a certifiable management system. Many organizations use NIST CSF to structure their program and ISO 27001 for formal certification. There is significant control overlap between the two.
What are NIST CSF tiers?
NIST CSF defines four implementation tiers: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4). Tiers reflect the degree to which an organization cybersecurity risk management practices exhibit characteristics defined in the framework. They are not maturity levels.
What policies do I need for NIST CSF?
Key policies include asset management, risk assessment, access control, security awareness training, data security, incident detection, continuous monitoring, incident response, recovery planning, and communications procedures. PoliWriter generates all of these aligned with NIST CSF 2.0.
Other Requirements Guides
Generate NIST CSF 2.0 policies automatically
PoliWriter creates all the policies you need to satisfy NIST CSF 2.0 requirements, customized to your organization. AI-powered, audit-ready, hours not months.
Get Started Free