What is NIST CSF?

CSF doesn't prescribe specific controls the way CIS Controls does; it describes outcomes and lets an organization choose how to achieve them, which is why it pairs well with more prescriptive frameworks rather than replacing them. Identify covers asset inventory, risk assessment, and understanding the business context that determines what actually needs protecting (ID.AM for asset management, ID.RA for risk assessment). Protect covers safeguards like access control, awareness training, and data security (PR.AC, PR.AT, PR.DS). Detect covers the monitoring and anomaly-detection capability a SOC builds (DE.AE for anomalies and events, DE.CM for continuous monitoring). Respond covers incident response execution (RS.RP, RS.CO, RS.MI). Recover covers restoration and improvement (RC.RP, RC.IM). CSF 2.0's new Govern function sits above the other five, covering risk management strategy, roles and responsibilities, policy, and oversight, reflecting a shift toward treating cybersecurity as an enterprise risk decision rather than a purely technical one.

Each subcategory has informative references linking it to other standards (ISO 27001, COBIT, specific NIST 800-series publications), which is part of why CSF functions as a translation layer between frameworks rather than a competitor to them. Maturity is expressed through four Implementation Tiers, from Partial (ad hoc, reactive) to Adaptive (continuously improving based on lessons learned and predictive indicators), and organizations build Current and Target Profiles to show where they are versus where they intend to be, which becomes the basis for a prioritized roadmap rather than a one-time compliance checkbox. CSF is referenced in cyber insurance questionnaires, vendor security assessments, and board reporting because its plain-language function names translate technical posture into language non-security executives can follow.

The Govern function breaks into its own subcategories worth knowing by name: GV.OC (organizational context, understanding the mission and stakeholders that shape risk tolerance), GV.RM (risk management strategy, how much risk the organization is willing to accept), and GV.SC (cybersecurity supply chain risk management, extending governance to vendors and suppliers). Because CSF maps to ISO 27001 controls, COBIT objectives, and specific NIST 800-53 controls, a security team can run a single internal assessment against CSF and derive evidence usable across multiple compliance obligations simultaneously, rather than repeating separate assessments for each standard an auditor or customer asks about.