Breaking Down the NIST Cybersecurity Framework

IBM's 2025 Cost of a Data Breach Report found the global average cost of a breach fell to $4.44 million, down 9% from $4.88 million the prior year, the first decline in five years. The report credits faster containment, organizations identified and contained breaches in a mean time of 241 days, the shortest in nine years, largely driven by AI-assisted detection. In the US specifically, average breach cost still hit a record $10.22 million, up 9% year over year. A structured framework for managing that risk matters more, not less, as attack surfaces expand.

The National Institute of Standards and Technology's Cybersecurity Framework (CSF) remains among the most widely adopted structures for managing that risk, and it changed significantly in 2024. If your understanding of the CSF stops at version 1.1 and its five functions, you are working from an outdated model. CSF 2.0 was published on February 26, 2024, and it added a sixth core function plus a substantially expanded scope.

What is the NIST Cybersecurity Framework?

NIST CSF is a voluntary set of principles, guidelines, and best practices for managing cybersecurity risk. NIST itself sits inside the US Department of Commerce, with a mandate to protect American competitiveness and economic security; the CSF is one of its more consequential public tools for doing that.

Version 1.0 arrived in 2014 following a presidential executive order. CSF 2.0, released in February 2024, is the current version, and it is a bigger change than the jump from 1.0 to 1.1 was. As NIST Director Laurie E. Locascio put it at the time of release, "CSF 2.0, which builds on previous versions, is about more than a single document. It is about a suite of resources that can be customized and used individually or in combination over time as an organization's cybersecurity needs change and its capabilities evolve."

The scope also expanded. CSF 1.x was written primarily for critical infrastructure operators, hospitals, power plants, and similar. CSF 2.0 is explicitly designed, in NIST's words, "for all audiences, industry sectors and organization types, from the smallest schools and nonprofits to the largest agencies and corporations." Congress had directed NIST to specifically account for small business and higher-education needs in this revision, which shows up in the new small-business-specific quick-start guides.

The six core functions of NIST CSF 2.0

CSF guidelines split into Functions, then Categories (subjects of consideration within a Function), then Subcategories (specific outcomes to achieve). The headline change in 2.0: a new Govern function sits alongside the original five.

1. Govern (new in 2.0)
2. Identify
3. Protect
4. Detect
5. Respond
6. Recover

Govern

Govern is the function that did not exist in CSF 1.1, and it is arguably the most consequential addition. It addresses how an organization establishes, communicates, and monitors its cybersecurity risk management strategy: roles, responsibilities, policy, and oversight. According to NIST's own framing, "the governance component emphasizes that cybersecurity is a major source of enterprise risk that senior leaders should consider alongside others such as finance and reputation."

In practice, this is where CSF 2.0 pulls cybersecurity out of being purely an IT department concern and puts it in front of the board and senior leadership as a standing risk category, not an occasional briefing item.

Identify

The preparation stage: you study your business environment to understand what needs protecting and why. This includes asset management (cataloging data, systems, and infrastructure and identifying the business processes around them), understanding your business environment and dependencies (including third-party vendors), and establishing a risk assessment process you can repeat, not a one-off audit.

Protect

This is where you actually implement controls: identity management and access control, staff awareness training (see our guide on the value of security awareness training), data protection measures like encryption and secure backup practices, and ongoing maintenance of the tools and configurations that enforce all of it.

Detect

Detect covers continuous monitoring for anomalies. Modern implementations increasingly lean on AI and machine learning to establish behavioral baselines and reduce false positives, since a security team drowning in false alerts eventually starts ignoring all of them, including the real ones. SIEM tools typically anchor this function, pulling telemetry from firewalls, endpoint tools, and identity systems into one place.

Respond

Respond is what happens after detection confirms an incident: response planning, internal and external communication (including law enforcement and affected customers where required), root-cause analysis, active mitigation, and feeding lessons learned back into future planning. SOAR tooling is commonly used here to automate parts of the response workflow so the team is not doing everything manually under pressure.

Recover

Recover focuses on restoring systems and capabilities after an incident, and on communicating with stakeholders throughout that restoration. It is frequently under-resourced relative to Protect and Detect, which is a mistake, a fast, well-rehearsed recovery plan is often what separates a costly incident from a catastrophic one.

Implementation tiers

CSF tiers describe how mature and consistent an organization's risk management practices are, rated across three dimensions: Risk Management Process, Integrated Risk Management Programs, and External Participation.

Tier 1: Partial

Risk management is reactive and ad hoc. There is little to no information sharing internally or with external partners, and the organization typically has no real visibility into supply chain risk.

Tier 2: Risk-Informed

Risk awareness exists and informs prioritization, but it has not been formalized into policy. Some external engagement happens, but it is inconsistent and not continuous.

Tier 3: Repeatable

Formal, documented risk management policies exist and are actively updated as the threat picture changes. Skills are matched to responsibilities, monitoring is consistent, and external information sharing is comprehensive, not occasional.

Tier 4: Adaptive

Continuous improvement is built into the process itself, with near real-time adjustment to changing threats and business conditions. Supply chain risk is monitored continuously rather than assessed periodically.

NIST's guidance has not changed here: organizations should aim for at least Tier 2, and the right tier for a given organization is a cost-benefit decision, not an assumption that Tier 4 is always the goal. A ten-person company chasing Tier 4 maturity is usually misallocating budget.

Why organizations adopt it

Regulatory relevance without being purely voluntary

CSF itself remains voluntary for most private organizations, but Executive Order 13800 made it mandatory for federal agencies and their contractors, which functionally extends its reach into any private company doing federal work.

Flexibility across company size

The expanded small-business quick-start guides mean the "flexible for any organization" claim is less theoretical than it used to be. NIST's Applied Cybersecurity Division chief Kevin Stine said the update "aims to make the framework even more relevant to a wider swath of users in the United States and abroad," and the added implementation examples are a direct response to feedback that earlier versions were too abstract for smaller teams to operationalize.

International alignment

CSF has been translated into 13 languages as of the 1.x era, with 2.0 translations ongoing through volunteer efforts. Governments in Japan, Israel, Canada, Brazil, Saudi Arabia, and the UK have either adopted elements of it or engaged with NIST to expand implementation. NIST has also worked to align CSF concepts with ISO/IEC standards, which matters for multinational companies juggling more than one compliance regime.

NIST CSF in practice: a Western Australia case study

A case study by researchers Ahmed Ibrahim, Craig Valli, Ian McAteer, and Junaid Chaudhry assessed a local government organization in Western Australia that had no clear picture of its overall cyber risk coverage.

The researchers built an assessment tool mapped to CSF Functions and Categories, gathering input from executive, management, and technical staff on a simplified 0/5/10 scoring scale. The results: cybersecurity measures covered 36% of the Identify function, 45% of Protect, 25% of Detect, 38% of Respond, and 100% of Recover. That last number is a useful reminder that strong recovery capability does not mean much if detection is weak, you will recover often, from things you should have caught earlier.

The organization landed at Tier 1. Recommended fixes included building a real asset inventory and information security policy, tightening access control, adopting behavioral-baseline detection tools, and coordinating incident response procedures organization-wide, with Microsoft Power BI used to maintain ongoing visibility across the environment. The result was faster, better-coordinated incident response and a documented path toward higher tiers. You can find the full case study here.

The limitation worth naming

CSF is a framework, not a control checklist, and that is both its strength and its weakness. It tells you what outcomes to achieve, not exactly how to achieve them, which means two organizations can both claim "CSF alignment" while having meaningfully different actual security postures. Pairing CSF with a more prescriptive control catalog, NIST SP 800-53 is the common pairing, gives you the structure plus the specificity. Used alone, CSF is a good way to organize thinking about risk; it is not, by itself, proof that any particular control is actually in place.