NIST Cybersecurity Framework 2.0: The Enterprise Assessment Guide

What Is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework (CSF) was developed by the National Institute of Standards and Technology and first published in 2014, following an Executive Order from President Obama who called for a common security standard across industries after a series of critical infrastructure attacks. In the years that followed, the CSF became the most widely adopted cybersecurity framework in the world — not just in the United States, but across Europe, Asia, and Latin America.

The key advantage of NIST CSF over other frameworks is its risk-based, non-prescriptive approach. It does not dictate which specific technologies to deploy or which exact controls to implement. Instead, it provides a structured language and methodological framework that organizations can use to describe their current security posture, define target states, and systematically close the gaps between the two. This flexibility makes the framework applicable to a 50-person SME as well as a global enterprise.

Version 1.0 (2014) and the major update to Version 1.1 (2018) established five core functions: Identify, Protect, Detect, Respond, and Recover. This model proved itself in practice but showed gaps as the cybersecurity landscape matured — particularly in the areas of governance, supply chain security, and support for smaller organizations without dedicated security teams.

After a multi-year public revision process with thousands of comments from industry, government, and academia, NIST published Version 2.0 in February 2024. The new version is more than an update — it is a strategic realignment that explicitly positions cybersecurity as a business strategy and a matter for executive leadership. CSF 2.0 now officially applies to all organization types and sizes, not just critical infrastructure.

What's New in CSF 2.0?

The most significant structural addition in NIST CSF 2.0 is the introduction of the sixth core function, GOVERN (GV). This function addresses a blind spot in previous versions: cybersecurity decisions were often made in isolation within the IT department, without sufficient involvement from senior leadership, the board, or executive teams. GOVERN explicitly positions cybersecurity strategy, roles, responsibilities, and risk tolerance as management-level obligations.

Another central focus of CSF 2.0 is a substantially expanded treatment of supply chain security (Supply Chain Risk Management, SCRM). While CSF 1.1 touched on supply chain risks only peripherally, Version 2.0 includes a dedicated category with concrete subcategories covering third-party risk assessment, contract requirements, Software Bills of Materials (SBOMs), and the monitoring of critical suppliers. Given the high-profile supply chain attacks of recent years — SolarWinds, Log4Shell, XZ Utils — this expansion was both overdue and practically necessary.

CSF 2.0 offers, for the first time, extensive implementation examples and profiles tailored to specific industries, company sizes, and maturity levels. NIST maintains a growing catalog of Community Profiles on its website, including specific guidance for small businesses without a dedicated security team. This makes the framework significantly more accessible to the broader market of mid-sized companies that were previously deterred by its complexity.

Cross-framework integration has been systematically strengthened. CSF 2.0 includes official mappings to ISO/IEC 27001, COBIT 2019, the ISA/IEC 62443 series, and the CIS Controls. For how COBIT relates to the service-management framework ITIL in a governance context, see our COBIT vs. ITIL comparison. For European organizations, the substantial overlaps with the NIS2 Directive and the Digital Operational Resilience Act (DORA) are increasingly being leveraged to consolidate compliance efforts rather than addressing each regulation in isolation.

The 6 Core Functions of CSF 2.0

NIST CSF 2.0 organizes cybersecurity activities into six core functions, each subdivided into categories and subcategories. In total, the framework comprises 22 categories and 106 subcategories. The functions are not meant as a sequential process but as simultaneously active, mutually reinforcing domains of activity.

The 4 Implementation Tiers

The NIST CSF Implementation Tiers describe the degree to which an organization has integrated cybersecurity risk management into its processes and culture. Importantly, the tiers are not compliance levels and are not direct measures of security posture. They describe how systematically and strategically an organization approaches cybersecurity.

The tiers serve two purposes: first, understanding the current state (Current Profile); second, defining realistic improvement targets (Target Profile). Not every organization needs to reach Tier 4 (Adaptive) — for many mid-sized companies, Tier 3 (Repeatable) is an appropriate and achievable goal.

Conducting a CSF 2.0 Assessment

A NIST CSF 2.0 assessment follows a structured methodology built around the concepts of Current Profile, Target Profile, and gap analysis. The process is iterative — the first assessment establishes the baseline, and each subsequent assessment measures progress.

In practice, plan for four to six weeks for a first comprehensive CSF 2.0 assessment of a mid-sized organization (500–2,000 employees, 3–5 critical IT systems). The greatest time investment is not in gathering the status quo, but in discussing and aligning ratings between IT, management, and business units.

1. 1Define the scope: Determine which organizational units, systems, and business processes are included in the assessment. An overly broad scope increases complexity and reduces depth — start with critical systems and expand iteratively.
2. 2Create the Current Profile: Assess each of the 106 subcategories against the current implementation level using a scale (e.g., 0 = not present, 1 = partial, 2 = implemented, 3 = measured/optimized). Use interviews, document reviews, and technical tests as evidence sources.
3. 3Define the Target Profile: Together with management, define what target state you want to reach for which subcategories and in what timeframe. The Target Profile must be aligned with risk tolerance, budget, and regulatory requirements.
4. 4Conduct the gap analysis: Systematically compare Current and Target Profiles. For each gap, identify the potential risk impact (high/medium/low) and the approximate effort required to close it.
5. 5Prioritize actions: Use an impact-vs-effort matrix to separate the most important quick wins (high impact, low effort) from strategic long-term investments. Not all gaps need to be closed immediately.
6. 6Create the Action Plan: Translate prioritized measures into concrete projects with owners, budgets, milestones, and success metrics. The Action Plan is the primary deliverable for management.
7. 7Communicate and report: Present results to both technical and non-technical stakeholders. The executive summary should communicate risks in business language, not technical detail.
8. 8Measure progress and reassess: Conduct semi-annual or annual follow-up assessments to measure progress and update the Current Profile. CSF is a continuous improvement cycle, not a one-time project.

NIST CSF 2.0 and Regulatory Compliance

For European organizations, the central question is how NIST CSF 2.0 relates to EU regulations NIS2, GDPR, ISO 27001, and DORA. The good news: CSF 2.0 is complementary to all of these frameworks and can serve as an overarching structure to consolidate compliance activities rather than running them redundantly.

The NIS2 Directive (EU 2022/2555), which member states are transposing into national law, defines minimum security requirements for essential and important entities. The NIS2 security requirements (Article 21) map almost entirely to CSF 2.0 categories. Organizations that conduct a CSF 2.0 assessment and achieve Tier 3 will cover the majority of NIS2 requirements — complete congruence is not guaranteed, but the overlap is substantial.

The Digital Operational Resilience Act (DORA), applicable to financial entities and their ICT providers in the EU since January 2025, places particular emphasis on ICT risk management, incident reporting, and supply chain resilience — all areas that CSF 2.0 directly addresses through GOVERN, IDENTIFY, RESPOND, and RECOVER.

Common Weaknesses Found in Assessments

In practice, CSF 2.0 assessments across industries and company sizes reveal a consistent pattern of recurring weaknesses. Knowing these common findings enables you to focus your assessment on these areas and allocate resources efficiently.

1. 1Incomplete asset inventory (ID.AM): Most organizations significantly underestimate the number of their IT assets. Shadow IT, cloud resources procured outside the official process, and stale CMDB entries mean that a substantial portion of the IT infrastructure goes unaccounted for in the assessment.
2. 2Undocumented risk tolerance (GV.RM): Many organizations lack an explicitly documented cybersecurity risk tolerance. Without this strategic foundation, security investment decisions are made reactively rather than strategically — every security measure is justified ad hoc rather than by reference to defined priorities.
3. 3MFA exceptions on privileged accounts (PR.AA): Multi-factor authentication is often deployed but rarely comprehensive. Privileged accounts (administrators, service accounts), legacy systems, and exceptions granted to "important" users are typical weak points.
4. 4Untested backup and recovery processes (RC.RP): Backups exist, but restore tests are conducted infrequently or not at all. Organizations discover backup deficiencies when they need them most — an unacceptable risk that is easily remedied with minimal effort.
5. 5Inadequate supplier risk assessment (GV.SC): Third-party risk management is rudimentary in many organizations. Security requirements in contracts are non-specific, supplier assessments are not conducted regularly, and critical single-vendor IT dependencies are not documented as risks.
6. 6Alert fatigue in security monitoring (DE.AE): SIEM systems generate floods of alerts, the majority of which go unaddressed. Without tuning, prioritization, and sufficient analyst capacity, even a technically capable SIEM is ineffective in practice.
7. 7No incident response exercises (RS.MA): Incident response plans exist on paper but are rarely rehearsed. Without tabletop exercises and realistic simulations, responders do not know which steps to take when under pressure.
8. 8No security integration in the SDLC (PR.PS): Security requirements in software development are frequently treated as a downstream afterthought. Security by design, static application security testing (SAST), and dependency scanning are often insufficiently or inconsistently implemented.

Quick Start: 5 Steps to Your First CSF 2.0 Assessment

If you haven't conducted a structured cybersecurity assessment yet, or are looking for a methodology for a fast initial screening, this quick-start approach provides a practical foundation. It can be completed in two to four weeks with a small team and delivers enough insight to define prioritized first actions.

1. 1Identify and engage stakeholders: Include IT leadership, CISO (if available), data protection officer, representatives from critical business units, and ideally the executive team. Cybersecurity is not purely an IT topic — without management commitment, the assessment produces a report that sits in a drawer.
2. 2Define a focused scope: Start with your 5–10 most critical IT systems and business processes (those whose failure would cause the greatest harm). A comprehensive assessment comes later — a focused quick assessment completed in 2 weeks is more valuable than a comprehensive one that never gets finished.
3. 3Run a self-assessment using the CSF 2.0 Quick Start Guide: Use the official NIST CSF 2.0 Quick Start Guide or one of the available shortform assessment tools. Rate each core function on three levels: Not present (0), Partially implemented (1), Fully implemented (2). This first pass typically takes half a day.
4. 4Identify the top 3 gaps per function: Analyze the results and identify the three most critical gaps in each of the six functions. Rate each gap by risk impact (what damage can this gap enable?) and effort to remediate.
5. 5Define immediate actions and a 90-day plan: Identify immediately actionable quick wins (typically: MFA on all privileged accounts, initiate asset inventory, perform backup restore test, update incident response contact list) and a 90-day plan for the most important medium-term measures. Present both to executive leadership with risk descriptions in business language.