NIST CSF 2.0

NIST Cybersecurity Framework (CSF) 2.0

Published by National Institute of Standards and Technology (NIST), U.S. Department of Commerce · CSF 2.0 — published February 26, 2024 (NIST CSWP 29)

A voluntary framework of standards, guidelines, and best practices for managing and reducing cybersecurity risk, organized as a taxonomy of high-level cybersecurity outcomes.

How it’s structured

• 6 Functions: Govern, Identify, Protect, Detect, Respond, Recover — Govern was added in CSF 2.0 as a cross-cutting function informing how the other five are carried out
• Implementation Tiers and Organizational Profiles describe an organization's current and target cybersecurity posture

Who it applies to

Any organization regardless of sector, size, or maturity — CSF 2.0 broadened applicability beyond CSF 1.0's original critical-infrastructure focus.

How Pentforge uses it in an engagement

• Gap analysis and evidence preparation designed for CSF 2.0's six functions — preparation support, not a certification
• Engagement scoping mapped to the client's target Organizational Profile

What you get

• A gap register mapped to the six CSF functions
• A profile-style summary of current vs. target posture for internal reporting

Related references

NIST SP 800-53 Revision 5 ↗

"Security and Privacy Controls for Information Systems and Organizations" — a catalog of security and privacy controls organized into 20 control families, used as supporting control detail alongside the CSF's outcome-level functions.

NIST SP 800-115 ↗

"Technical Guide to Information Security Testing and Assessment" — methodology for planning and conducting technical security tests and assessments, including techniques such as penetration testing; Pentforge's technical testing engagements are designed around this methodology.

Official source

• NIST Cybersecurity Framework 2.0 on csrc.nist.gov ↗
• NIST Cybersecurity Framework overview on nist.gov ↗