NIST CSF basics
Six outcomes, 22 categories: reading the CSF 2.0 Core.
NIST released Cybersecurity Framework (CSF) 2.0 in February 2024. At its heart sits the Core, a catalogue of security results grouped under six functions. Below: how that catalogue is coded, what sits under each function, and how a single incident touches every one of them.
Back to NIST CSF services01 · Reading a code
Every outcome has an address
Learn the code once and the whole Core opens up.
Open the Core and you meet strings such as PR.AA-01 or GV.SC-04. Think of each one as a postal address. The letters before the dot name the function. The two after it name the category. The number picks out one result, which NIST calls a subcategory. Version 2.0 lists 106 of them.
- Function (PR)
- The broadest bucket. PR stands for Protect; the other five codes are GV, ID, DE, RS and RC.
- Category (AA)
- A theme inside the function. Here AA covers identity management, authentication and access control.
- Subcategory (01)
- One result you can test, own and score. It names the end state, never the product that gets you there.
Numbering in 2.0 skips in places. Outcomes that moved or were withdrawn left their numbers empty, so a gap in a list is deliberate, not a typo.
02 · The six functions
Six functions, six questions a director can ask
Govern holds the middle; the other five follow the life of a threat.
| Function | Categories in 2.0 | The question it settles |
|---|---|---|
| Govern (GV) | Organizational context, risk management strategy, roles and authorities, policy, oversight, supply chain risk management | Have leaders said how much cyber risk is acceptable, and who owns it? |
| Identify (ID) | Asset management, risk assessment, improvement | Do we know what we have and where it is weak? |
| Protect (PR) | Identity and access, awareness and training, data security, platform security, infrastructure resilience | Are the safeguards in place and maintained? |
| Detect (DE) | Continuous monitoring, adverse event analysis | Would we spot an attack while it is under way? |
| Respond (RS) | Incident management, incident analysis, reporting and communication, mitigation | Can we contain it and tell the right people? |
| Recover (RC) | Recovery plan execution, recovery communication | Can we restore operations and confidence? |
03 · Why Govern
Govern arrived because outcomes need an owner
Version 1.1 had five functions. The sixth moved accountability to the front.
In version 1.1, governance and supplier topics were spread across Identify. Version 2.0 lifted them into a function of their own, so the question of who decides now comes before the question of what to deploy. The 2.0 text also speaks to organisations of any size and sector. The first edition, in 2014, was written with critical infrastructure operators in mind.
- A written risk appetite. Leaders have stated, in words someone could test against, how much cyber risk the business will carry.
- Named owners. Security decisions sit with people who know they hold them and have budget to act.
- Policy that gets revisited. Policies are shared with staff and reopened when the business or the threats shift.
- Suppliers in scope. Vendors are ranked by the harm they could cause, and contracts reflect that ranking.
- Results reach the top. Programme results go to leadership, and leadership changes strategy in response.
04 · One incident
Illustrative: one stolen password, all six functions
A logistics firm's breach, followed through the Core.
Illustrative scenario. A logistics company in Pune with about 300 staff learns that a dispatcher's password, reused from a breached shopping site, was used to sign in to its fleet dashboard.
- Govern. The board had already ranked shipment data as high value and ruled that any breach reaches the CEO the same day. That earlier decision tells everyone how seriously to treat the alert.
- Identify. The asset inventory shows the dashboard holds client addresses and faces the internet, which sets the stakes.
- Protect. Multi-factor sign-in covered administrators but not dispatchers. That gap let the attacker through.
- Detect. A sign-in from an unfamiliar country raises an alert, and an analyst confirms the session is hostile.
- Respond. The account is locked, sessions are ended, logs are preserved, and the client contracts with notice duties are pulled.
- Recover. Altered dispatch records come back from backup, clients receive a factual update, and the lesson returns to Govern as a decision to extend multi-factor sign-in to every role.
Nobody finishes the functions in order. All six run at once, and what Recover learns flows straight back into Govern.
05 · Beyond the Core
What NIST publishes around the Core
The Core is the list. These companions help you use it.
- Organizational Profiles
- A current profile records which outcomes you reach today; a target profile records where you mean to be. The distance between them is your work plan.
- Tiers
- Four levels, from Partial to Adaptive, describing how rigorous and risk-aware your practices are.
- Implementation examples
- Short, action-led illustrations for many subcategories, kept online so NIST can update them faster than the framework.
- Informative references
- Mappings from CSF outcomes to other documents, such as NIST SP 800-53, kept in NIST's online reference tools.
- Quick-start guides
- Brief companion papers for particular readers, including small businesses and teams building their first profile.
Nothing to certify
NIST certifies no one against the CSF and accredits no one to do it. What exists is an assessment: a person inside or outside the company compares your practices with the outcomes and records the result. A 'CSF certificate' is a marketing label.
06 · Common misreads
Four ways teams misread the Core
Each one costs effort without lowering risk.
- Ticking every line. Many subcategories will matter little to you. Your target profile is the place to say which, and why.
- Starting with Protect. Buying tools before Govern and Identify are settled puts safeguards around assets nobody has listed.
- Forgetting Recover. Teams fund prevention and alerting, then learn during an outage that nobody ever test-restored a backup.
- Copying a sample profile. A sector example is a starting point. Your target has to come from your own appetite and obligations.
Sources: NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024); NIST CSF 2.0 quick-start guides and the CSF 2.0 Reference Tool on nist.gov; NIST Framework for Improving Critical Infrastructure Cybersecurity, version 1.1 (2018).
Questions about the CSF 2.0 Core
Do we have to address all 106 subcategories?
No. You choose the ones that matter.
Nothing in the CSF makes you cover every outcome. Your target profile marks the ones that count for your risks and contracts and notes why the rest are out of scope. A good assessor probes that reasoning rather than the tally.
Can an Indian company use the CSF?
Yes. It is free and sector-neutral.
NIST is a US agency, but the framework costs nothing, is written for any sector and has been translated into other languages. Indian firms often adopt it as a shared vocabulary next to ISO/IEC 27001 or their regulator's directions.
Do the six functions happen one after another?
No. They run side by side.
Diagrams sometimes draw them as a line from Identify to Recover. In practice you are monitoring, protecting and governing on the same day, and each incident sends lessons back to Govern.
Where did supply-chain risk move in 2.0?
Into Govern, as category GV.SC.
Version 1.1 placed supply chain risk management under Identify. Version 2.0 moved it to Govern and expanded it, signalling that choosing and overseeing suppliers is a leadership call and not only a technical review.
Score your programme against the full Core.
An Auditify NIST CSF assessment records your current profile for all six functions and shows which gaps to close first.