What the NIST Cybersecurity Framework is

Who publishes it

The CSF comes from the National Institute of Standards and Technology, an agency of the U.S. Department of Commerce. NIST develops measurement standards and technical guidance, and the CSF is one of its best known publications.

The current version is CSF 2.0, published on February 26, 2024 as NIST CSWP 29. It costs nothing, there is no account to create, and you can download the whole document today.

What it is

At its heart the CSF is a shared list of cybersecurity outcomes: statements about what is true of an organization that is managing its risk sensibly. NIST describes it as “a taxonomy of high-level cybersecurity outcomes” (NIST CSWP 29). Each outcome describes a result, such as knowing which devices and data you have, rather than naming a product to buy or a box to check.

That distinction is the whole point. The framework deliberately does not tell you how to reach an outcome, because the sensible answer for a ten-person firm is not the sensible answer for a hospital. NIST is direct about it: the outcomes “are not a checklist of actions to perform” (NIST CSWP 29). You decide what fits your business, and the framework gives you the vocabulary to describe it.

The six Functions

CSF 2.0 sorts every outcome into six functions. The official order starts with Govern, and NIST draws them as a wheel rather than a line, because they feed one another instead of running in sequence. Govern sits in the center because it shapes how you approach the other five.

Govern

Decide who is responsible for cybersecurity in your business, what your rules are, and how you keep an eye on whether those rules are being followed in practice.

Identify

Know what you genuinely have. Your systems, your data, your devices, your suppliers, and the risks attached to each of them.

Protect

Put safeguards in place so that fewer incidents occur, and so the ones that do occur do less damage.

Detect

Notice when something is going wrong, instead of finding out weeks later from a customer or a bank.

Respond

Know what you will do once you have spotted an incident, and decide it before you are in the middle of one.

Recover

Get your systems and your business back to normal afterward, and keep the people who need to know informed while you do it.

How the framework is structured

The framework nests in three levels, from broad to specific.

Functions are the six broad areas above. Categories break each function into related groups of outcomes, covering subjects like asset management, awareness and training, and incident response. CSF 2.0 has 22 of them. Subcategories are the individual outcome statements, and they are where the real detail lives. CSF 2.0 has 106 of them.

Every subcategory carries a short identifier, such as GV.RR-02 or PR.AA-01, which is how people point at one specific outcome without reciting the whole sentence. NIST publishes two companions alongside them: Implementation Examples, which suggest concrete ways an outcome might be reached, and Informative References, which map each outcome to other standards and guidelines that cover the same ground.

What CSF 2.0 changed

Earlier versions were aimed at critical infrastructure, and the document was titled “Framework for Improving Critical Infrastructure Cybersecurity.” CSF 2.0 dropped that title, and with it the narrower framing. NIST now presents the framework as designed for organizations of all sizes and sectors, including industry, government, academia, and nonprofits.

The other headline change is Govern. Earlier versions had five functions. CSF 2.0 added Govern as a sixth and placed it first, which reflects something small businesses tend to recognize immediately: most problems are not exotic technical failures. They are questions of who was responsible, what the rules were, and whether anyone was watching.

CSF 2.0 also expanded its treatment of supply chain risk, and NIST released a set of Quick-Start Guides alongside it, including one written specifically for small businesses.

What the CSF is not

There is a lot of loose talk about the CSF online, so it is worth being precise about the boundaries.

It is not a law. For a private business, use of the CSF is voluntary. NIST’s small business guide calls it “voluntary guidance” (NIST SP 1300). A customer contract, an insurer, or a regulator may separately ask you to use it, but the framework itself requires nothing of you.

It is not a certification. NIST does not run a certification or conformity assessment program for the CSF, and it says it has no plans to build one. Nobody can award your business a NIST CSF certificate, and any product promising you one is offering something NIST does not provide.

It is not a checklist you finish once. It describes outcomes rather than tasks, and the risks it deals with keep changing, so using it well is an ongoing habit rather than a project with an end date.

NIST also does not endorse or validate any particular vendor, tool, or approach to using the framework. That includes NISTnow.

Why a small business should care

You may never be asked about the CSF by name. But the questions it asks are the ones that show up anyway: when a customer sends you a security questionnaire, when an insurer wants to know what controls you have. They also show up when you stop and wonder whether the backup you set up three years ago is still running.

The practical value of a framework is that it is a list others have already thought hard about, so you are not trying to remember everything from a standing start. It also gives you a way to describe where you stand that other people recognize, which helps when you are talking to a customer, an insurer, or a consultant.

And it scales down honestly. NIST wrote a small business guide precisely because the framework is meant to be useful to a business with no security team at all.

Where NISTnow fits

NISTnow is a self-guided assessment that rates a business on all 106 subcategory outcomes, called controls in NISTnow, or on 44 of them in NISTquick. NISTnow is not affiliated with NIST, which does not endorse, certify, or review NISTnow or any other product. It prepares a business for a formal assessment rather than replacing one, and the page on how it works shows each step.

The primary sources

Everything on this page comes from NIST, and NIST publishes all of it for free. If you want to skip the summary and read the primary sources, the list below is where to start.

• The NIST Cybersecurity Framework home page

  NIST's own hub for the framework and everything that supplements it: guides, examples, translations, and news. The best place to start if you want to browse.

• The framework document itself (PDF)

  The primary source: The NIST Cybersecurity Framework (CSF) 2.0, published as NIST CSWP 29 on February 26, 2024. It is a 32-page PDF, and it is far more readable than that sounds. Appendix A is the complete list of all 106 outcomes.

• Small Business Quick-Start Guide (PDF)

  NIST SP 1300, a 9-page supplement for businesses that have little or no cybersecurity planning in place today. If you read only one of these, read this one.

• The CSF 2.0 Reference Tool

  NIST's official browser for the framework. Search the functions, categories, and subcategories, and export them either to read or to feed into other tools.

• The full set of Quick-Start Guides

  Short official guides on specific topics, including supply chain risk and building your own organizational profile.

• NIST's own FAQs

  NIST answering the common questions directly, including the ones about certification and conformity assessment.