Insights · Framework guide

NIST CSF 2.0 as a Practical Checklist for Your Company

The NIST Cybersecurity Framework 2.0 is a free, voluntary framework that organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST published it on 26 February 2024, and it works for companies of any size and country. This guide turns it into a checklist you can use for a first gap assessment.

Updated: 6 November 2026

What CSF 2.0 is and who it is for

CSF 2.0 is published by the US National Institute of Standards and Technology as NIST CSWP 29. It describes outcomes, not products or technical settings. NIST states that it is meant for organizations regardless of size, sector or maturity, and that earlier versions were already used by many governments and companies outside the United States. Version 2.0 added the Govern function and widened the scope beyond critical infrastructure.

The framework has three parts. The Core is the list of outcomes, organized into 6 functions, 22 categories and 106 subcategories. Organizational Profiles describe where you are and where you want to be. Tiers describe how rigorous your risk governance and management are. Nothing in it is a certification: you cannot be certified against CSF, you can only use it to structure and communicate your security work.

The six functions as a checklist

Use the questions below as a first pass. Each function is broken into categories in the official Core, and every item should have a named owner and some evidence, such as a policy, a report or a screenshot of a setting.

• Govern: Has management approved a cybersecurity risk strategy and policy? Are roles and responsibilities written down? Do you know your legal and contractual obligations? Is supplier risk part of procurement and contracts? Does leadership review results regularly?
• Identify: Do you have a current inventory of hardware, software, data and cloud services? Have you assessed risks and ranked your critical systems? Do you track vulnerabilities and threat information? Do you feed lessons learned back into the program?
• Protect: Are identities managed, with multi-factor authentication and least-privilege access? Is staff trained? Is data protected at rest and in transit, and are backups protected? Are systems patched and hardened, and are logs kept? Can your infrastructure take a failure without total loss?
• Detect: Are networks, endpoints and cloud accounts monitored continuously? Is someone watching the alerts around the clock, or at least reacting to them quickly? Do you analyze events to decide what is a real incident?
• Respond: Is there a tested incident response plan with roles, contacts and decision rights? Can you triage, investigate, contain and report incidents, including to regulators and customers where required?
• Recover: Is there a recovery plan with priorities and target times? Have you tested restoring from backups? Do you have a plan for communicating during and after an incident?

Profiles and tiers: setting a realistic target

An Organizational Profile is a table of the Core outcomes. The Current Profile records which outcomes you achieve today and how well. The Target Profile records the outcomes you have chosen to reach, based on your risk, budget and obligations. The difference between the two is your gap list and the basis of your roadmap. NIST offers a Quick Start Guide on Organizational Profiles and one for small businesses.

Tiers are separate from the Core. They describe the rigor of your governance and risk management on a four-step scale: Tier 1 Partial (ad hoc), Tier 2 Risk Informed (management-approved practices), Tier 3 Repeatable (formal, policy-based and regularly reviewed) and Tier 4 Adaptive (continuously improving). Higher is not automatically better. A small company with limited exposure can reasonably target Tier 2 for most areas and Tier 3 for the few that matter most.

Mapping to ISO 27001 and NIS2

NIST maintains informative references, which link CSF outcomes to other documents. Its public catalog, the Online Informative References Program, lists mappings that include ISO/IEC 27001:2022, NIST SP 800-53, CIS Controls and PCI DSS. NIST points out that it does not check the correctness of mappings submitted by others, and that a listing is not an endorsement. The CSF 2.0 Reference Tool lets you filter the Core by a chosen reference and export it, and NIST SP 1347 explains how.

For NIS2, the picture is narrower. ENISA published technical implementation guidance in June 2025 with a mapping table. It maps the security requirements of Commission Implementing Regulation (EU) 2024/2690 to ISO/IEC 27001, ISO/IEC 27002, NIST CSF 2.0, ETSI EN 319 401, CEN/TS 18026 and national frameworks. That regulation covers certain digital infrastructure and ICT service providers, such as cloud, data centre, DNS and managed service providers. ENISA states that the mapping is not a measure of equivalence and that using the guidance does not by itself establish compliance. For other NIS2 sectors the requirements are set nationally, so check your national authority. In Germany, for example, the NIS2 implementation act has applied since 6 December 2025.

Practical conclusion: CSF and ISO 27001 overlap strongly, so one control set can serve both, but CSF alone does not prove NIS2 or ISO 27001 compliance.

How to run a gap assessment

A first assessment for a mid-sized company usually takes a few weeks of part-time effort. Keep it simple and evidence-based.

• Set the scope: legal entities, locations, cloud tenants and critical suppliers.
• Pick the level of detail: categories for a quick view, subcategories for a full one.
• Build the Current Profile: score each outcome, for example not done, partly, largely, fully, and attach evidence.
• Interview owners instead of only reading policies. Check that documented controls really run.
• Define the Target Profile from your risks, customer demands, insurance and legal duties.
• List the gaps, rate them by risk and effort, and assign owners and dates.
• Repeat at least yearly and after major changes or incidents, and report progress to management.

What companies typically outsource

Most small and mid-sized companies keep Govern and most of Identify in-house, because they need business context and management decisions. Technical, staff-intensive work is often bought as a service:

Outsourcing the work does not outsource accountability. Define who decides, who is called and what evidence the provider delivers.

• Security monitoring (Detect): a managed SOC or managed detection and response service, with endpoint or network detection tools.
• Vulnerability assessment (Identify): recurring scanning, penetration tests and prioritized remediation advice.
• Incident response (Respond and Recover): an on-call retainer with forensic and containment support, ideally agreed before an incident.
• Resilience engineering (Protect and Recover): backup design, restore testing and infrastructure hardening.
• Independent assessment: an external review of your Current Profile and Target Profile.