What Is NIST CSF? Framework 2.0 Explained

Key takeaways

• The NIST Cybersecurity Framework (CSF) is a voluntary, risk-based structure that helps organizations prioritize and communicate how they manage cyber risk. Version 2.0 (2024) organizes practice around six Core Functions: Govern, Identify, Protect, Detect, Respond, and Recover.
• The CSF Core, Implementation Tiers, and Organizational Profiles work together. Tiers describe how consistently and systematically risk is managed; Current and Target Profiles capture “as-is” and “to-be” posture for scoping investment.
• Adoption is voluntary for most private-sector organizations, yet the framework appears in federal guidance, procurement language, and sector playbooks. Many teams use it to show reasonable security diligence beyond checkbox compliance.
• In cloud estates, the CSF maps cleanly to cloud security posture management, identity and data controls, and continuous monitoring. A CNAPP can supply unified inventory and evidence that feed Profile updates without duplicate tooling.

The NIST Cybersecurity Framework is a U.S. National Institute of Standards and Technology publication that translates security outcomes into a common language for executives, risk owners, and engineers. It does not replace NIST SP 800-53 or sector schemes. It helps you organize controls, measure maturity, and explain tradeoffs in terms business leaders understand.

Organizations use it to align budgets, vendor selections, and incident readiness. The framework stays technology-neutral, so it applies to on-premises, hybrid, and multi-cloud programs when you map your architecture honestly in Profiles.

This article explains what the CSF contains, how Core, Tiers, and Profiles fit together, a compact sector-style example, benefits, cloud-specific use, and how unified cloud security data supports alignment.

What Is the NIST CSF?

The NIST CSF is a catalog of cybersecurity outcomes and informative references, not a certification scheme.

NIST CSF 2.0, published in 2024, refines how organizations govern cyber risk and adds the Govern Function as the first pillar.

The other five Functions are Identify, Protect, Detect, Respond, and Recover. Each Function breaks into Categories and Subcategories. Subcategories point to informative references (for example, other NIST publications, CIS controls, or ISO standards) that teams can adopt where they fit.

Govern answers who owns risk decisions, how policies tie to enterprise objectives, and how you measure performance. This makes the CSF easier to use with boards and regulators than a flat control list with no business context.

The CSF is less prescriptive than control-heavy baselines such as NIST SP 800-171 or NIST SP 800-53. This flexibility helps small teams start with priorities. It also demands discipline: without Profiles and metrics, “aligned with the CSF” becomes a hollow label.

What Does the NIST CSF Include?

The NIST CSF has three main components: the Core, Implementation Tiers, and Organizational Profiles. The Core defines cybersecurity outcomes, the Tiers describe how consistently risk is managed, and Profiles map current and target cybersecurity posture.

Core

The Core is the structured list of outcomes in the NIST CSF. 

• Govern covers risk management strategy, roles, policy, and oversight. 
• Identify covers asset management, risk assessment, and supply chain risk.
• Protect covers identity, data security, platform security, and resilience technologies. 
• Detect covers continuous monitoring and anomaly detection processes. Respond covers incident response, including analysis, mitigation, and communications. Recover covers system restoration and lessons learned.

Teams map existing security controls and initiatives to these Subcategories to understand coverage. Gaps become backlog items for remediation. 

When the Core is paired with compliance reporting across AWS, Azure, and GCP, teams can show which cloud accounts and workloads support each outcome and where evidence is still thin.

Because Subcategory language stays stable across provider and API changes, it provides a consistent way to track and report risk. This is useful when platforms change or are re-architected, but leadership still expects consistent risk reporting in quarterly reviews.

Tiers

Implementation Tiers describe the rigor of your cybersecurity risk management practices, not a maturity score for individual controls.

NIST defines four Tiers:

• Tier 1 (Partial): Ad hoc and reactive practices with limited organization-wide coordination.
• Tier 2 (Risk Informed): Risk management practices are approved but not consistently applied across the organization.
• Tier 3 (Repeatable): Formalized, organization-wide policies and consistent implementation of risk management processes.
• Tier 4 (Adaptive): Continuous improvement driven by lessons learned, threat intelligence, and evolving risks.

Higher Tiers reflect stronger governance, more consistent processes, and the ability to adapt security practices based on new threats and internal feedback.

Moving between Tiers takes time. Progressing from Tier 1 to Tier 3 within a single budget cycle is uncommon unless leadership invests in staffing, tooling, and training together.

Tiers should be used to set realistic security roadmap targets, not as a maturity scorecard or reporting metric for presentations.

Profiles

Organizational Profiles document cybersecurity posture for a defined scope, such as an enterprise, business unit, or system.

Current Profile describes how Subcategories are implemented today, including references to controls and supporting evidence.

Target Profile defines the desired cybersecurity outcomes for a future date, often aligned with a migration, transformation, or product milestone.

Comparing the Current and Target Profiles produces a prioritized list of security gaps that can guide remediation planning.

Profiles should clearly define assumptions, including:

• Covered cloud environments
• Regulated data classifications
• Critical suppliers and dependencies

Without clear scope, Profiles become generic documentation that does not reflect real production environments and may not satisfy audit requirements asking how controls apply in practice.

Example: Small Aerospace Manufacturer

Consider a small aerospace supplier bidding on defense work. It starts at Tier 1 (Partial): ad hoc practices, limited enterprise policy, and reactive fixes. Leadership adopts the CSF to structure a path toward Tier 3 (Repeatable): formal policies, consistent monitoring, and repeatable response.

Identify: The company inventories design data stores, ERP endpoints, and partner VPNs. It maps which systems hold export-controlled information.

Protect: It enforces MFA for remote access, segments partner connections, and encrypts sensitive design repositories. Access policies tie to roles, not shared passwords.

Detect: It centralizes logs from endpoints, identity, and cloud APIs. Alerts route to a named owner during business hours first, then 24/7 as budget allows.

Govern: Executives review cyber risk quarterly with engineering and finance. Procurement adds security clauses for new SaaS tools.

The Current Profile records gaps (for example, incomplete logging in one plant). The Target Profile sets dates for closing them before the next customer audit. Metrics might track the percentage of crown-jewel assets under continuous assessment and mean time to contain simulated incidents.

This example is illustrative. Your scope, regulators, and contracts determine which Subcategories matter most.

What Are the Main Benefits of Adopting the NIST CSF?

The main benefits of adopting the NIST CSF are shared vocabulary, risk-based prioritization, and improved communication with boards and partners.

Teams move away from abstract discussions like “we need more security” and instead focus on specific gaps, such as which CSF Functions are weakest, what Target Profile is required, and what it will cost to close those gaps.

Measurement and KPIs

The CSF enables structured measurement by mapping Subcategories to security KPIs, such as:

• MFA coverage across systems
• Backup and restore testing frequency
• Phishing simulation success rates
• Percentage of production changes scanned in CI/CD pipelines

This allows shift-left security metrics and runtime security metrics to be evaluated together, giving leadership visibility into both design-time and operational security posture.

Governance and Due Diligence

For organizations without a single mandatory security standard, CSF Profiles help demonstrate structured risk management and reasonable due diligence.

They do not guarantee immunity from breaches, but they show that security decisions are documented, consistent, and based on defined outcomes, something increasingly expected by insurers, customers, and regulators.

Scorecards and Reporting

CSF goals can also be tracked through simple scorecards, such as:

• Percentage of Subcategories fully implemented in the Target Profile
• Number of open security exceptions with owners and deadlines
• Trends in critical incidents and near-miss events

Scorecards should be consistent, transparent, and updated on a regular cadence aligned with leadership expectations.

How Does the NIST CSF Help in Cloud Environments?

The NIST CSF provides a stable outcome-based structure that remains consistent even as cloud services and providers change monthly.

Core Cloud Mappings

CSF Functions map to key cloud security domains:

• Identify: cloud asset inventory, data classification, and IAM reviews across AWS, Azure, and GCP
• Protect: encryption, network segmentation, secure configuration baselines, and infrastructure-as-code security
• Detect: cloud-native logging (CloudTrail, Azure Activity Logs, GCP Cloud Audit Logs), CNAPP or CSPM alerts, and SIEM correlation
• Respond: incident response playbooks, including cloud provider support processes and identity session revocation
• Recover: backup regions, system restoration workflows, and recovery validation processes

Shared Responsibility Model

The CSF aligns with cloud shared responsibility models but doesn’t replace them.

It clarifies what organizations must own (such as data protection, identity configuration, and key management) versus what is managed by the cloud provider or SaaS vendor.

Practical Priorities in Cloud Security

Most cloud security programs begin with Identify and Protect, because misconfigurations and excessive permissions are typically the first issues uncovered in assessments.

Detection maturity often develops later, but remains critical for internet-facing systems, where credential theft and phishing continue to drive breaches, as reflected in the Verizon Data Breach Investigations Report.

Operational Alignment

Organizations often extend CSF Subcategories into day-to-day cloud operations by:

• Mapping vulnerability management and patching workflows to CSF outcomes
• Aligning Governance with cloud tagging standards and account structures
• Using policy-as-code guardrails so new accounts inherit baseline security controls
• Integrating detection signals from CSPM alerts into broader risk workflows

How Orca Security Helps You Align With the NIST CSF

Orca Security supports CSF-aligned programs by unifying cloud inventory, misconfigurations, vulnerabilities, identities, and sensitive data in one model. SideScanning™ reads workload and configuration state from cloud APIs and block storage snapshots with an agentless security approach, so coverage does not depend on agent installs on every workload.

That visibility feeds Identify and Protect evidence: where regulated data lives, which identities can reach it, and which misconfigurations increase the likelihood of compromise. Attack path analysis connects internet exposure, permissions, and crown-jewel assets, which helps prioritize remediation that moves Profiles toward the Target state. Exportable findings and integrations support Detect, Respond, and Recover workflows when teams route issues into ticketing and SOAR.

The CSF remains voluntary and flexible. Orca does not replace policy choices or Tier judgments. It reduces friction between cloud reality and the outcomes you claim in Organizational Profiles.

Get a Demo 

Frequently asked questions about NIST CSF