Implementation walkthrough
How to implement NIST CSF 2.0: video walkthrough
A walkthrough of putting a cybersecurity programme on the NIST Cybersecurity Framework 2.0, with a Current Profile, a Target Profile leadership has chosen and an action plan.
Key takeaways
- NIST CSF 2.0 is voluntary guidance; there is no NIST certification.
- The Core has six Functions, now including Govern.
- A Current Profile shows today's position; a Target Profile records leadership's choice.
- The gap between the two becomes an action plan in priority order.
- The framework describes outcomes and can sit over ISO/IEC 27001 or SOC 2 controls.
Outcomes your leadership can steer
The NIST Cybersecurity Framework 2.0 is voluntary guidance from the US National Institute of Standards and Technology for managing cybersecurity risk. Its Core is a taxonomy of cybersecurity outcomes organised into six Functions, Govern, Identify, Protect, Detect, Respond and Recover, that any organisation can use to understand, assess, prioritise and communicate its cybersecurity effort. Around the Core sit Organizational Profiles, Tiers and Informative References that map each outcome to the standards behind it.
The framework describes outcomes, not methods, which is why it can sit over an ISO/IEC 27001 information security management system, a SOC 2 control set or other control catalogues. NIST does not certify against it, and no NIST certified status exists. This short film walks through how the framework is implemented as a management routine.
From Current Profile to action plan
Start by scoping the Organizational Profile: the entities, systems, data, suppliers and obligations in scope, who is asking for the framework and what leadership wants to see. The gap analysis then records how far each selected outcome is achieved today, with evidence, in the Current Profile, and compares it with a Target Profile that leadership has chosen for its risks and obligations.
The difference becomes an action plan in priority order. The priority outcomes are implemented with the teams who own them, using the controls and standards the organisation already relies on, and progress is reported in terms leadership can steer. Your own leadership, internal audit and, if you choose, an independent assessor judge whether the Target Profile is achieved; there is no certification body in this route.
Sterling's expert and experienced consultants build the Profiles with your teams and implement the priority outcomes under Sterling OS™, with the evidence held in Effivity. CSF 2.0 was published on 26 February 2024, replacing version 1.1, and as a voluntary framework it has no transition deadline.
NIST CSF 2.0 at a glance
- Purpose
- Cybersecurity risk management: a taxonomy of outcomes across six Functions, Govern, Identify, Protect, Detect, Respond and Recover, for understanding, prioritising and communicating cyber risk
- Relevant to
- Organisations of any size, sector or maturity; boards and executives, security and IT leaders, risk managers, US federal suppliers and anyone asked "are you aligned with NIST?"
- Edition
- CSF 2.0 (NIST CSWP 29), published 26 February 2024, replacing version 1.1 of April 2018; no transition deadline, because the framework is voluntary
- Certification
- None. NIST publishes the framework and does not certify against it; no "NIST certified" status exists. Your Profile is assessed by your own leadership, internal audit and, if you choose, an independent assessor
- Sterling's role
- Profile design with your leadership, the priority outcomes implemented with your teams, Effivity, training and the first review cycle, then Sustain™
- Cost and timing
- Total investment for a NIST CSF 2.0 programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months
NIST CSF 2.0: questions people ask
Can an organisation be certified to NIST CSF 2.0?
No. NIST publishes the framework and does not certify anyone against it; its own FAQ states that it has no plans to develop a conformity assessment programme and leaves conformity needs to the private sector. A provider offering a "NIST certified" badge or a "CSF compliance certificate" is offering a document of its own design, and Sterling does not issue one either. What an organisation can have is a Target Profile, evidence that its outcomes are achieved and, if it wants one, an independent assessment of both.
Is NIST CSF 2.0 mandatory?
Not for most organisations. NIST describes the CSF as guidance that may be adopted voluntarily and through government policies and mandates: US federal agencies have been required to apply it since a 2017 Executive Order, and some regulators, insurers and customers reference it in their requirements. Otherwise you adopt it because you want a structured, widely recognised way to manage cybersecurity risk.
What changed between CSF 1.1 and CSF 2.0?
Version 2.0, published on 26 February 2024, is the first major update since the framework's creation in 2014. It addresses all organisations rather than critical infrastructure alone, adds Govern as a sixth Function, brings cybersecurity supply chain risk management into the Core, reorganises the Categories and Subcategories, and comes with Quick Start Guides, a Reference Tool, an Organizational Profile template and Community Profiles.
How does NIST CSF 2.0 relate to ISO/IEC 27001?
They do different jobs and work well together. ISO/IEC 27001 is a requirements standard for an information security management system, certifiable by an accredited body; the CSF is a voluntary set of outcomes with no certification. NIST's Informative Reference catalogue lists a mapping between ISO/IEC 27001:2022 and CSF 2.0, so an ISMS can supply most of the controls behind a Target Profile while the CSF gives leadership, customers and insurers the outcome view: the certificate for the market, the Profile for the board.
What is the difference between the CSF and NIST SP 800-53 or SP 800-171?
The CSF says what outcomes to achieve; SP 800-53 and SP 800-171 say which controls to implement. SP 800-53 is NIST's catalogue of security and privacy controls, in twenty control families; SP 800-171 sets the requirements for protecting controlled unclassified information in non-federal systems, reaching suppliers through US federal contracts. Both are Informative References for CSF 2.0, so coverage of either can be shown in the Profile.
Keep exploring
Related to this video
Read next
The complete guide
Everything on NIST CSF 2.0
Start with the NIST CSF 2.0 page, or go straight to the guide you need.
On the NIST CSF 2.0 page
- What does NIST CSF 2.0 ask of an organisation?
- How do you implement NIST CSF 2.0?
- How much does NIST CSF 2.0 implementation cost?
- How long does NIST CSF 2.0 implementation take?
- Who needs NIST CSF 2.0 implementation?
- How NIST CSF 2.0 improves cybersecurity decisions and protects the business
- Frequently asked questions about NIST CSF 2.0
Guides
Often combined with NIST CSF 2.0
More videos: Information security, cyber and cloud
- How to implement NIST SP 800-171Implementation walkthrough · 3 min 15 s
- NIST SP 800-171 requirements explainedTwo-minute brief · 2 min
- How to get TISAX labelsImplementation walkthrough · 3 min 15 s
- TISAX requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE IA StandardCompliance walkthrough · 3 min 15 s
- UAE IA Standard requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27001Implementation walkthrough · 3 min 24 s
- ISO/IEC 27001 requirements explainedTwo-minute brief · 2 min
- How to implement PCI DSSImplementation walkthrough · 3 min 24 s
Talk to a consultant
Plan your NIST CSF 2.0 implementation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice