NIST Cybersecurity Framework (CSF) 2.0
The US government's widely adopted, vendor neutral framework for managing cybersecurity risk, updated to version 2.0 in February 2024 to add Govern alongside the original five functions. It is free to read and is one of the most commonly referenced frameworks in job postings, audits, and security programme documentation worldwide.
Guide
Other
National Institute of Standards and Technology (NIST)
Reference, a few hours to read the core document
All
Free
What it is
The NIST Cybersecurity Framework is a voluntary, outcome focused framework published by the US National Institute of Standards and Technology to help organisations of any size or sector understand, manage, and communicate cybersecurity risk. It does not mandate specific technical controls; instead it organises cybersecurity activity into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Version 2.0, released in February 2024, added Govern as a new, standalone function covering how an organisation sets up cybersecurity risk strategy, roles, and oversight, reflecting how much cybersecurity failure traces back to governance gaps rather than purely technical ones.
Why it matters for a career
CSF is referenced constantly in job descriptions, security audits, vendor questionnaires, and compliance programmes, often without much explanation, so understanding its six functions and their basic meaning is close to a baseline literacy requirement for security, risk, and even engineering leadership roles that touch security. It is also frequently the shared language between a security team and business stakeholders who do not need or want a technical deep dive.
What is inside it
Beyond the core six functions, NIST publishes supporting material: implementation examples, informative references mapping CSF to other standards like ISO 27001, quick start guides for specific audiences (small business, enterprise risk management, supply chain), and CSF Profiles, which are organisation specific applications of the framework to a particular context. NIST SP 800-61 Revision 3, the incident response guide, is itself now structured explicitly as a CSF 2.0 community profile for the Respond and Recover functions.
Free versus paid
Entirely free. NIST publishes it, and all its supporting documents, without cost or licensing restriction, and it is designed to be adopted and adapted by any organisation.
Who it suits
Useful to almost anyone in security, from someone studying for Security+ (which references risk management frameworks conceptually) to a working security engineer who needs to map their team's work to something leadership and auditors already recognise.
Common questions
Is it a checklist I can just implement? No, it is deliberately outcome focused rather than prescriptive; organisations choose how to achieve each function's outcomes. Is it US specific? Its origin is a US government agency, but it is used globally as a common reference regardless of jurisdiction. Do I need to memorise all six functions in detail? Knowing what each function means at a glance, Govern, Identify, Protect, Detect, Respond, Recover, covers most practical uses; deeper detail matters mainly if you are directly building or auditing a security programme against it.
Ready to start?
Opens on National Institute of Standards and Technology (NIST) in a new tab.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.