NIST Cybersecurity Framework (CSF) 2.0: Six Functions and Practical Implementation

Cybersecurity is more than purchasing antivirus software and configuring a firewall. An organization also needs to understand what it must protect, how it prioritizes risks, how it detects incidents, and how it responds and recovers.

The NIST Cybersecurity Framework (CSF) is a common map for organizing and improving cybersecurity risk management. It helps organizations see the entire program rather than treating technologies as disconnected solutions.

What is NIST CSF?

The CSF was developed by the U.S. National Institute of Standards and Technology (NIST). First published in 2014 as the Framework for Improving Critical Infrastructure Cybersecurity, it initially emphasized U.S. critical infrastructure. Its concepts proved useful more broadly.

NIST CSF 2.0, published in February 2024, explicitly addresses organizations of all sizes and sectors, including businesses, government agencies, and nonprofits, in any country. It describes desirable cybersecurity outcomes, not a mandatory implementation manual, a product catalog, or a certification scheme.

Organizations must decide which outcomes matter, taking their mission, regulatory and contractual obligations, risk tolerance, and available resources into account.

The six CSF 2.0 Functions

Function	Purpose	Essential question
Govern (GV)	Establish and oversee strategy, accountability, policies, and risk priorities	Who decides what risks are acceptable?
Identify (ID)	Understand assets, threats, vulnerabilities, and risks	What needs protecting, and what could go wrong?
Protect (PR)	Apply safeguards to manage cybersecurity risk	How do we prevent or reduce harm?
Detect (DE)	Find and analyze possible attacks and compromises	How do we discover suspicious activity?
Respond (RS)	Take action on detected cybersecurity incidents	How do we contain and manage an incident?
Recover (RC)	Restore affected assets and operations	How do we safely resume business operations?

CSF 1.1 contained five Functions. CSF 2.0 added Govern as a distinct sixth Function, emphasizing leadership and the integration of cybersecurity into enterprise risk management. Govern informs the other five Functions. These Functions are not six strictly sequential project phases: governance, identification, protection, and detection are continuous, while response and recovery capabilities must be prepared before incidents occur.

The CSF Core consists of Functions → Categories → Subcategories. For example, Identify includes Asset Management (ID.AM), with outcomes for maintaining inventories of hardware (ID.AM-01) and software, systems, and services (ID.AM-02).

What to do within each Function

The following policy, technology, operational, and evidence examples are illustrative implementation options, not specific products or controls mandated for every organization by NIST.

1. Govern (GV)

Objective: Treat cybersecurity as an enterprise risk and establish clear accountability, decision criteria, and oversight.

Area	Practical actions
Policies and governance	Define an information security policy, risk management policy, risk appetite and tolerance, authority and accountability, third-party risk requirements, and escalation and approval processes
Tools and services	Consider risk registers or GRC platforms, policy repositories, vendor assessment systems, and training-management tools
Operations	Have leadership review major risks and budgets, assign risk owners, approve and track risk treatments, evaluate critical suppliers, and periodically review strategy and policies
Evidence and deliverables	Approved policies, responsibility matrix, risk acceptance criteria, prioritized risk treatment plan, executive reports, and supplier assessments

CSF Categories: Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles, Responsibilities, and Authorities (GV.RR), Policy (GV.PO), Oversight (GV.OV), and Cybersecurity Supply Chain Risk Management (GV.SC).

2. Identify (ID)

Objective: Understand organizational assets, dependencies, threats, vulnerabilities, and risk exposure.

Area	Practical actions
Policies and governance	Define asset ownership, data classification, inventory maintenance, risk assessment, vulnerability assessment, and exception management requirements
Tools and services	Consider asset discovery and CMDB tools, cloud asset inventories, vulnerability scanners, external attack surface management, and data discovery/classification capabilities
Operations	Inventory devices, servers, applications, SaaS, data, supplier services, network connections, and data flows; prioritize assets and assess risk from threats, vulnerabilities, likelihood, and impact
Evidence and deliverables	Asset and data inventories, network/data-flow diagrams, risk register, vulnerability findings, and prioritized remediation backlog

CSF Categories: Asset Management (ID.AM), Risk Assessment (ID.RA), and Improvement (ID.IM).

3. Protect (PR)

Objective: Reduce the likelihood and impact of unauthorized access, data compromise, and system disruption.

Area	Practical actions
Policies and governance	Establish identity and access management, least privilege, segregation of duties, authentication, encryption, patch management, configuration, backup, secure development, and training requirements
Tools and services	Evaluate IAM, MFA/passkeys, endpoint protection/EDR, firewalls/WAFs, encryption and key management, device management, backup systems, and CI/CD security checks
Operations	Remove unnecessary accounts and privileges; deploy strong authentication; maintain secure configurations and updates; protect data at rest, in transit, and in use; protect and restore-test backups; train personnel
Evidence and deliverables	Access review results, patch status, configuration assessments, backup and restore tests, and training records

CSF Categories: Identity Management, Authentication, and Access Control (PR.AA); Awareness and Training (PR.AT); Data Security (PR.DS); Platform Security (PR.PS); and Technology Infrastructure Resilience (PR.IR).

4. Detect (DE)

Objective: Identify and analyze possible cybersecurity attacks and compromises promptly.

Area	Practical actions
Policies and governance	Define logging, retention, monitoring coverage, alert severity, triage, escalation paths, and outsourced monitoring responsibilities
Tools and services	Consider centralized logging, SIEM, EDR, IDS/IPS, cloud audit logs, alerting platforms, and managed SOC/MDR services
Operations	Monitor authentication, privileged activity, network traffic, system events, and external provider activity; correlate signals and threat intelligence; test and improve detection rules
Evidence and deliverables	Logging inventory, detection use cases, investigation records, detection latency, and validation results

CSF Categories: Continuous Monitoring (DE.CM) and Adverse Event Analysis (DE.AE).

5. Respond (RS)

Objective: Manage, investigate, contain, and communicate about confirmed cybersecurity incidents.

Area	Practical actions
Policies and governance	Establish an incident response plan, incident classification, escalation and notification procedures, evidence-handling requirements, and coordination with third parties
Tools and services	Prepare incident case management, endpoint isolation, network blocking, forensic support, and out-of-band emergency communications
Operations	Triage and validate reports; classify incidents; isolate compromised devices/accounts; investigate scope and root cause; preserve evidence and activity logs; notify relevant parties as required; exercise the plan
Evidence and deliverables	Incident response plan, contact list, incident timeline, evidence records, required notifications, and exercise outcomes

CSF Categories: Incident Management (RS.MA), Incident Analysis (RS.AN), Incident Response Reporting and Communication (RS.CO), and Incident Mitigation (RS.MI).

6. Recover (RC)

Objective: Restore business operations and affected assets safely, in a risk-informed order.

Area	Practical actions
Policies and governance	Define restoration priorities, recovery initiation and completion criteria, restoration verification and approval, and stakeholder communication procedures
Tools and services	Consider offline or immutable backups, alternate environments, disaster recovery infrastructure, configuration automation, and integrity-validation capabilities
Operations	Validate backup integrity before restoration; restore critical services first; verify that compromise is contained and restored systems are trustworthy; confirm normal operations; communicate recovery progress and closure
Evidence and deliverables	Recovery runbooks, service priorities, restore test results, approval and validation records, and recovery completion reports

CSF Categories: Incident Recovery Plan Execution (RC.RP) and Incident Recovery Communication (RC.CO).

Recovery time objectives (RTOs) and recovery point objectives (RPOs) can be valuable operational requirements, but the CSF does not prescribe a universal number. Lessons learned and continual improvement span multiple Functions, including Identify’s Improvement Category (ID.IM); they are not confined to Recover.

How to implement the CSF

The CSF should guide a risk-based improvement cycle rather than become a mechanical compliance checklist.

Scope the Organizational Profile. Choose the organization, service, system, or risk scenario to evaluate.
Gather relevant information. Collect business objectives, requirements, inventories, risk assessments, existing practices, and responsibilities.
Build the Current Profile. Record which selected CSF outcomes are achieved and the evidence supporting them.
Build the Target Profile. Decide which outcomes the organization needs to achieve, based on priorities and risk tolerance.
Analyze gaps and prioritize action. Assign owners, budgets, deadlines, and validation criteria to improvements.
Implement and revisit. Execute actions, assess progress, and update the Profiles when risks or business conditions change.

For example, ID.AM-02 calls for inventories of software, systems, and services. If unmanaged SaaS use is the current gap, a practical target may be to maintain an owner-assigned inventory of all SaaS services. Actions could include reconciling procurement records with SSO activity and reviewing the inventory quarterly.

What are CSF Tiers?

Tiers describe the rigor and characteristics of an organization’s cybersecurity risk governance and management practices; they are not product maturity scores or certification grades.

Tier	Name	Typical characteristics
Tier 1	Partial	Ad hoc practices and limited organization-wide risk awareness
Tier 2	Risk Informed	Risk-informed decisions, but inconsistent organization-wide practices
Tier 3	Repeatable	Defined, approved, repeatable, and regularly reviewed organization-wide practices
Tier 4	Adaptive	Continuous improvement and adaptation based on changing conditions and predictive information

Select an appropriate Tier based on the organization’s risks, mandates, and costs. Tier 4 is not a universal requirement.

Key lessons for practitioners

Start with the whole picture: Understand the six Functions and priority outcomes before shopping for tools.
Connect business leadership and technical teams: Executives define priorities and risk appetite; managers plan controls; practitioners implement and measure them.
Go beyond written policies or purchases: Run access reviews, inventories, monitoring, incident exercises, and recovery tests.
Use complementary standards and guidance: Consider NIST SP 800-53, ISO/IEC 27001, and any laws, regulations, or sector-specific guidance that apply to your organization.
Keep evidence and improve continuously: Revisit risk registers, control assessments, incidents, recovery tests, and management reviews.

References

The descriptions of the six Functions, Categories, Profiles, and Tiers are based on NIST CSF 2.0. The listed policies, technologies, operational tasks, and deliverables are practical examples of possible implementation approaches and should not be mistaken for universal NIST requirements.