NIST CSF 2.0: a security programme your board can read.
We score your current profile across the six functions, agree a target with leadership, and turn the gap into a roadmap that maps to ISO 27001 and SOC 2.
- Starting out:
- a current profile and a realistic first target.
- Already certified:
- one view of ISO 27001 and SOC 2 work in the CSF's language.
- All six functions scored, Govern included
- A target profile set from your real risk appetite
- A roadmap ranked by risk reduced per unit of effort
- Mapped to ISO 27001 and SOC 2 controls
What is the NIST Cybersecurity Framework?
The NIST CSF is a voluntary framework from the US National Institute of Standards and Technology for managing cybersecurity risk. It describes outcomes, not tools, in six functions. There's no certificate: its value is a shared language, a clear current-vs-target picture, and a roadmap.
Your programme
- Leadership and policy
- Assets and suppliers
- Safeguards
- Monitoring
- Incident response
- Recovery
The framework
- Six functions
- Categories
- Subcategories (outcomes)
- Current profile
- Target profile
- Implementation tiers
CSF
A profile and a roadmap
Your current profile scored against the outcomes, a target profile agreed with leadership, and a roadmap that closes the gap in order of risk.
It isn't a certification. When customers need proof, the same work maps to ISO 27001 or SOC 2.
The six functions of CSF 2.0
Govern
Strategy, roles and policy, owned by leadership. New in 2.0.
Identify
Assets, data, suppliers and the risks to them.
Protect
Access control, training, data security, resilience.
Detect
Continuous monitoring to find events fast.
Respond
Contain, analyse, communicate and mitigate.
Recover
Restore services and learn from incidents.
Where the CSF is used most
- Financial services
- Healthcare
- Energy & utilities
- Manufacturing
- SaaS & technology
- Education
Often the trigger is a board asking “how secure are we?”, a US customer or insurer naming the CSF, or a programme that needs one structure across several frameworks.
Read NIST CSF 2.0 explained: the six functions, categories and what changedWho uses the NIST CSF?
Any organization, any size, any country. CSF 2.0 dropped the critical-infrastructure framing: it's a common language for security programmes, used alongside certifiable standards, not instead of them.
01 · Who asks
Board, customers, insurers
- Board and investors
- US enterprise customers
- Cyber insurers
- Regulators
Want a clear maturity picture and a credible plan.
02 · Your organization
Your security programme
- Leadership and policy
- Security and IT teams
- Incident response
- Business continuity
Scored as a current profile against the six functions.
03 · Your suppliers
Supply chain
- Cloud and SaaS vendors
- Managed service providers
- Critical software
Governed as supply-chain risk under Govern.
If your board can't answer “how mature is our security, and what's next?” in one page, a CSF profile gives them that page.
CSF 2.0 puts supply-chain risk under Govern: your critical suppliers belong in your profile, assessed and monitored like any other risk.
How a NIST CSF programme works
Six phases, each with a named output and a clear ask of your team. The NIST CSF assessment covers the first three. The full programme runs all six.
- Context
Context & scope
We establish your business context, obligations, risk appetite and the scope the profile covers, with leadership in the room.
- Business context
- Obligations
- Risk appetite
- Profile scope
- You get
- A written scope and the risk criteria the target will use.
- You provide
- Leadership time and a named programme owner.
- Current
Current profile
We assess every function and category through interviews, document review and technical checks, and score each outcome's maturity.
- Interviews
- Evidence review
- Technical checks
- Maturity scoring
- You get
- A current profile with maturity scores across all six functions.
- You provide
- Access to owners, policies and tooling.
- Target
Target profile & roadmap
We agree a target profile with leadership, function by function, and rank the gap by risk reduced per unit of effort.
- Target profile
- Tier per function
- Gap analysis
- Roadmap
- You get
- A target profile and a prioritized roadmap.
- You provide
- Leadership decisions on appetite and priorities.
- Improve
Remediation
We help your team close the highest-value gaps: governance, access, logging, incident response, backups and supplier reviews.
- Policies
- Technical controls
- Incident response
- Supplier risk
- You get
- Gaps closed, with evidence for each.
- You provide
- Engineering time and owners for each roadmap item.
- Measure
Metrics & reporting
We set metrics that mean something to engineers and executives, and a board-ready report on progress against the target.
- Metrics
- Dashboard
- Board report
- Mapping
- You get
- An executive dashboard and reporting on an agreed cadence.
- You provide
- Data owners for each metric.
- Review
Independent review & refresh
We review maturity claims independently, map the programme to ISO 27001 and SOC 2 where you pursue them, and re-assess the profile periodically.
- Maturity review
- Framework mapping
- Re-assessment
- Next target
- You get
- A refreshed profile and the next target.
- You provide
- Time for the re-assessment interviews.
No one-size timeline: it depends on the scope of the profile, your starting maturity and how far the target reaches. You get a firm timeline in writing before work starts.
What you receive
Everything the programme produces lands in one CSF file. Each item is paired with the question a board member, customer or insurer asks about it.
Each gap comes with the specific fix and the owner who'll run it. We verify each fix and re-score the profile, so progress is measured, not asserted.
There's no NIST CSF certification. You get an independent assessment of your profile. When customers need a certificate or report, the same work maps to ISO 27001 and SOC 2.
01, Context phase: Scope & risk criteria
Business units, systems and risk appetite, agreed in writing.
02, Current phase: Current profile
Every category scored, with the evidence behind each score.
03, Current phase: Supplier risk view
Critical suppliers and how they're assessed, under Govern.
04, Target phase: Target profile
A target per function, tied to obligations and appetite.
05, Target phase: Prioritized roadmap
Gaps ranked by risk reduced per unit of effort, with owners.
06, Improve phase: Incident response plan
Roles, playbooks and recovery priorities, rehearsed.
07, Measure phase: Executive dashboard
A handful of metrics leadership can track.
08, Measure phase: Board report
One readable page: profile, progress, decisions needed.
09, Review phase: Framework mapping
Each outcome mapped to Annex A and the SOC 2 criteria.
Illustrative example, not client data
What one profile line looks like
- Function
- Protect (PR)
- Category
- Identity management and access control
- Current
- Tier 2 · MFA on email only
- Target
- Tier 3 · MFA everywhere, quarterly reviews
- Priority
- High: largest risk reduction per effort
- Maps to
- ISO 27001 A.5.15–5.18 · SOC 2 CC6
Four common NIST CSF misconceptions
Each one is reasonable, and each one wastes effort.
Assumption 01
Assumption: We can get NIST CSF certified.
What the CSF actually means
There's no certification scheme. You can get an independent assessment, and certify to ISO 27001 or attest with SOC 2 where customers need proof.
Assumption 02
Assumption: We should aim for Tier 4 everywhere.
What the CSF actually means
Tiers describe rigour, not a grade. Set the target your risk justifies, function by function; over-reaching wastes budget.
Assumption 03
Assumption: The CSF is only for US critical infrastructure.
What the CSF actually means
Version 2.0 is written for every organization, and it's used worldwide as a common security language.
Assumption 04
Assumption: CSF work is separate from ISO 27001 or SOC 2.
What the CSF actually means
CSF outcomes map to Annex A and the SOC 2 criteria. One control set and one set of evidence serve all three.
Heard one of these from your team? A NIST CSF assessment shows where you really stand.
Get a NIST CSF assessmentWhat you can hold us to.
We don't publish client logos or case studies; we keep our clients' security posture private. These are the commitments we make instead.
Our commitments
Experienced practitioners lead
Every engagement is led by experienced practitioners.
Peer review
Every deliverable is peer-reviewed before it reaches you.
Written scope and change control
You know what is covered, and what happens if scope changes, before work starts.
Scores you can trace
Every maturity score backed by evidence you can inspect.
Want to speak to a client? Ask for a reference while we scope your work and we'll arrange it directly.
Ask for a referenceNIST CSF questions buyers ask
Can you be certified against NIST CSF?
No. You get an independent assessment instead.
There's no accredited certification scheme. Organizations share an independent assessment of their profile with boards and customers.
NIST CSF and risk management, explained.
Every NIST CSF guide we publish: the six functions, tiers and profiles, how the CSF sits beside ISO 27001 and SOC 2, and the wider risk and GRC picture.
The framework02
Choosing frameworks02
Know where your programme stands, in one page.
Send the basics
Your organization, roughly how many people, what you must comply with, and any certifications you hold.
We scope the work
We respond within 24 hours, then agree the scope with you in writing.
Your NIST CSF assessment
You get a current profile, a target and a prioritized roadmap.
- Starting out:
- a current profile and a realistic first target.
- Already certified:
- one view of ISO 27001 and SOC 2 work in the CSF's language.
The CSF has no certification. Where you need one, we map the work to ISO 27001 or SOC 2.