NIST Cybersecurity Framework (CSF) 2.0, explained

NIST's text gives each Function a one-sentence definition. GOVERN is new in CSF 2.0 and is described as sitting at the centre of the other five because it "informs how an organization will implement the other five Functions":

NIST frames these as concurrent, not sequential: GOVERN, IDENTIFY, PROTECT and DETECT "should all happen continuously," while RESPOND and RECOVER "should be ready at all times and happen when cybersecurity incidents occur."

Appendix A of CSWP 29 breaks each Function into Categories with a two-letter-plus-two-letter identifier. Counting NIST's own Table 1 gives 22 Categories across the six Functions, and counting the outcome statements listed under them in the same appendix gives 106 Subcategories:

Each Category is further divided into Subcategories, the actual outcome statements; NIST notes their numbering is "intentionally not sequential," since gaps mark CSF 1.1 Subcategories that were relocated in 2.0. The full Subcategory list, plus the separately maintained Informative References and Implementation Examples that suggest how to achieve each one, are published through the CSF 2.0 Reference Tool on NIST's CSF website rather than frozen into the CSWP 29 text itself, so they can be updated more often. NIST also notes the Functions, Categories and Subcategories "apply to all ICT used by an organization, including information technology (IT), the Internet of Things (IoT), and operational technology (OT)."

CSF 2.0 keeps these as distinct concepts that are easy to conflate:

• Organizational Profile — describes which outcomes you pursue. A Current Profile states what you do today; a Target Profile states what you are aiming for. NIST notes a Target Profile "can help express the organization's cybersecurity risk management requirements and expectations to suppliers, partners, and other third parties."
• Community Profile — a shared Target Profile baseline for "a particular sector, subsector, technology, threat type, or other use case," published so individual organisations do not start from a blank page.
• Tiers — describe how rigorously you pursue them, independent of which outcomes you picked. NIST defines four: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4), a "progression from informal, ad hoc responses to approaches that are agile, risk-informed, and continuously improving." NIST is explicit that Tiers "should complement an organization's cybersecurity risk management methodology rather than replace it."

Appendix B gives a "notional illustration" with two columns per Tier: risk governance (GOVERN) and risk management (the other five Functions). A condensed reading, with the supplier line from NIST's table kept because it matters most to component buyers and sellers:

CSF 2.0 keeps the Core short and moves detail into online resources on the NIST CSF website:

CSF 2.0's own text calls it "a foundational resource that may be adopted voluntarily and through governmental policies and mandates" — it carries no universal legal force on its own, but a specific regulator, customer contract or procurement rule can choose to require conformance with it. NIST states the primary audience is "individuals responsible for developing and leading cybersecurity programs," while noting the framework is also meant to be legible to "executives, boards of directors, acquisition professionals ... risk managers, lawyers, human resources specialists." Unlike the 2014 original, CSF 2.0 explicitly targets organisations of "all sizes and sectors — including industry, government, academia, and nonprofit," not just operators of critical infrastructure.

The CSF is written for an organization's own risk, but several Subcategories in Appendix A describe exactly what a product security team produces. The evidence column is one reading, not NIST's:

The GV.SC (Cybersecurity Supply Chain Risk Management) Category is new to the Core structure in CSF 2.0 and, per NIST's text, provides "a connection between outcomes that focus purely on cybersecurity and those that focus on C-SCRM," pointing to NIST SP 800-161r1 for the detailed practice (see the SP 800-161 guide). For a device or firmware maker, this is the Category that should absorb supplier due diligence: chip-vendor SDKs, ODM-built images, and open-source components you did not write yourself. It sits alongside, rather than replaces, the specific technical work of a firmware SBOM or an OpenSSF Scorecard check against a dependency's repository — CSF organises why and how you govern that risk; the SBOM and Scorecard are evidence you can plug into the IDENTIFY and GOVERN outcomes. GOVERN's Tier 1 role mirrors the organization tier of NIST SP 800-39, and the NCCoE's zero trust builds map their capabilities to CSF 2.0 as well.

RESPOND and RECOVER map onto the operational side of a PSIRT: incident analysis, mitigation, and the reporting and communication Category (RS.CO) are the same activities covered by a vulnerability disclosure policy and a CRA 24-hour reporting process, if your product is in scope of the EU Cyber Resilience Act. No regulation known to us at the time of writing names CSF 2.0 conformance as a direct legal requirement for device makers; the specific regulator or customer contract involved, not this guide, governs any claim to the contrary.

Synthetic example. The company, product line and statuses are invented to show the format; they are not a NIST Community Profile.

An industrial gateway maker scopes a Profile to one product line and records five Subcategories:

The action column becomes the POA&M NIST mentions in step 4, and the Current column is what the company can share with a prospective customer.

• Claiming "CSF compliance." CSF does not prescribe controls; state which Profile and Tier you assessed.
• Mixing Tiers and Profiles. A Target Profile with every outcome at Tier 4 is rarely a real plan.
• Leaving IoT and OT out of scope. NIST's text names IoT and OT explicitly.
• Starting with PROTECT. Without GOVERN outcomes, priorities are guesses.
• Copying CSF 1.1 mappings. Subcategory IDs moved in 2.0; recheck any older crosswalk.