Home  /  NIST CSF
NIST CSF 2.0 · Cybersecurity Framework

See your security posture the way US customers and boards do.

The NIST Cybersecurity Framework is the most widely used way to describe cyber risk. We assess where you stand across its six functions, agree where you need to be and map the path between them.

6 functionsGovern to Recover
Current → targetProfiles and a roadmap
MappedTo ISO 27001 and SOC 2
In short: NIST CSF 2.0 is a widely adopted, voluntary framework that describes cyber risk across six functions. Cyber Veda assesses your current and target profile and maps it to the ISO 27001 or SOC 2 controls you already run.

Why NIST CSF

When a US customer, investor or board member asks how mature your security is, they often mean “against NIST”. The framework gives everyone a shared language, from engineers to directors, and the 2.0 update added a Govern function that puts leadership accountability front and centre.

The six functions

The CSF organises cybersecurity outcomes into six functions, broken down into categories and subcategories. Govern sits at the centre because it shapes how you carry out the other five.

NIST CSF 2.0 functions: Govern at the centre, surrounded by Identify, Protect, Detect, Respond and Recover. Govern at the centre IdentifyProtectDetectRespondRecover
  • Govern
    Set and oversee strategy, roles, policy and supply-chain risk. New in 2.0, and it informs the other five.
  • Identify
    Understand your assets, suppliers and cyber risks.
  • Protect
    Safeguards that manage those risks: access, training, data security, platform security.
  • Detect
    Find and analyse possible attacks and compromises.
  • Respond
    Act on a detected incident: manage, analyse, contain and report.
  • Recover
    Restore assets and operations after an incident.

A good first step towards certification

A NIST CSF assessment is a practical way to see your whole security picture before committing to a certification. The outcomes map closely to ISO 27001 and SOC 2, so the work you do now is reused when you go for a certificate.

What's included

  • Scoping workshop to agree what is in scope and why
  • Current profile across Govern, Identify, Protect, Detect, Respond and Recover
  • Target profile based on your risk, customers and budget
  • Mapping to the ISO 27001 or SOC 2 controls you already operate
  • Prioritised roadmap and a board-ready summary

When you'd use this

  • US customers or investors ask you to describe your security against NIST
  • Your board wants a clear, recognised view of cyber risk
  • You want a structured starting point before choosing a certification
FAQ

Common questions

What is the NIST CSF?

The NIST Cybersecurity Framework is published by the US National Institute of Standards and Technology. Version 2.0, released in 2024, organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is voluntary and used by organisations of every size worldwide.

Can you get certified against NIST CSF?

No. NIST CSF is not a certification scheme. Organisations use it to describe their current posture, set a target and track progress. If you need a certificate, ISO 27001 or a SOC 2 report is usually the next step, and the CSF work carries straight over.

What changed in NIST CSF 2.0?

Version 2.0, released in February 2024, added a sixth function, Govern, covering strategy, roles, policy and supply-chain risk. It also broadened the framework from critical infrastructure to organisations of every size and sector, and added quick-start guides and implementation examples.

What are NIST CSF profiles and tiers?

A profile describes your cybersecurity outcomes: a current profile shows where you are, a target profile where you want to be. Tiers describe how rigorous your risk management is, from Tier 1 (Partial) through Tier 2 (Risk Informed) and Tier 3 (Repeatable) to Tier 4 (Adaptive).

How does NIST CSF map to ISO 27001?

Closely. NIST publishes informative references that map CSF outcomes to other frameworks, and most outcomes line up with ISO 27001 clauses or Annex A controls. A CSF assessment is a useful step towards ISO 27001, and an ISO 27001 system is good evidence for a CSF profile.

Is NIST CSF mandatory?

Not for private organisations. It is voluntary, but customers, insurers and investors increasingly use it as the yardstick when they ask about your security.

Is NIST CSF relevant in Australia?

Yes. It is widely recognised by boards, insurers and international customers, especially in the US. Australian organisations often use it alongside the Essential Eight and ISO 27001.

Talk to someone who has taken companies like yours to audit.

Book a free 30-minute consultation. Tell us what is driving the need, and leave with a realistic timeline and the first three things to do.

Book a 30-min consultation Explore services