Overview#
CSF 2.0 organizes a security program into six functions, subdivided into categories and subcategories: Govern, Identify, Protect, Detect, Respond, Recover. Govern is the addition in version 2.0, and a meaningful one. It places risk strategy, roles, policy, and supply chain oversight on equal footing with the technical functions rather than treating them as preamble.
The framework is outcome-based rather than prescriptive. It states that detection processes are tested, not that a particular SIEM should be purchased and configured a particular way. The prescriptive layer comes from sources like the CIS Benchmarks and MCSB, or NIST 800-53 in a federal context. CSF is the scaffolding those hang on.
Despite its origins, it is not federal-only or limited to critical infrastructure. Version 2.0 explicitly broadened its scope to organizations of any size or sector, and it has become a default common language for describing security posture in the US private sector.
How It’s Used#
- Communicating upward. A Conditional Access policy is an implementation detail. Describing it as closing a gap in PR.AA (Identity Management and Access Control) frames the work in terms leadership can act on and fund.
- Gap assessment. Walking the six functions in order surfaces categories that no one owns, most often Recover and frequently Govern.
- Current and target profiles. Organizations document where they are, define where they intend to be, and use the delta to prioritize and sequence investment.
- Certification context. The GRC content in Security+ and the governance domain of SC-500 both map onto these functions.
Strengths & Limitations#
This is a governance document and it reads like one. There is no hands-on component and nothing to install, which is why technically focused practitioners often skip it and then struggle to justify a project to anyone controlling a budget.
Its failure mode is the inverse of ATT&CK’s. An organization produces a polished current and target profile spreadsheet, then mistakes the artifact for the improvement. A CSF profile is a planning tool. Unless it becomes funded, assigned work with dates attached, it is a document rather than a security outcome.
The core CSF 2.0 publication is short, roughly 30 pages, and worth reading in full. The Informative References and Implementation Examples are better treated as lookup material during profile development than as first-pass reading.
Not the right fit if: hands-on fundamentals are still the priority and there is no security program yet to describe. Without something concrete to map it onto, the framework reads as abstract vocabulary.
Details#
- Type: Governance / risk management framework
- Cost: Free
- Skill Level: Beginner (concepts) → Intermediate (applying profiles)
- Best for: GRC roles, security program design, translating technical work for leadership
- Link: nist.gov/cyberframework
- Core publication: NIST CSWP 29 (PDF)