NIST CSF 2.0: the six functions explained

NIST CSF 2.0 organizes cybersecurity outcomes into six Functions: Govern, Identify, Protect, Detect, Respond and Recover. This article walks through each one using NIST CSWP 29, published February 26, 2024. It uses the categories in Table 1 of that document, in their own order. It is not a ranking.

What is NIST CSF 2.0?

NIST describes the Cybersecurity Framework (CSF) 2.0 as guidance. It is for industry, government agencies and other organizations that manage cybersecurity risks. It offers a structured list of high-level cybersecurity outcomes.

Any organization can use it, regardless of size, sector or maturity. NIST also says the CSF does not prescribe how to achieve the outcomes.

The Core is a layered structure of Functions, Categories and Subcategories. Table 1 in Appendix A gives each Category a short identifier, such as GV.OC or ID.AM. We use them as the document gives them.

What are the six CSF 2.0 functions?

The document says the Functions group outcomes at their highest level. It adds that they should be addressed at the same time. GOVERN, IDENTIFY, PROTECT and DETECT happen all the time. RESPOND and RECOVER should be ready at all times, and they happen when incidents occur.

Govern (GV)

NIST defines it as: the organization’s cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. The document says governance activities are key to bringing cybersecurity into the wider enterprise risk management strategy. Table 1 lists six categories:

• Organizational Context (GV.OC).
• Risk Management Strategy (GV.RM).
• Roles, Responsibilities, and Authorities (GV.RR).
• Policy (GV.PO).
• Oversight (GV.OV).
• Cybersecurity Supply Chain Risk Management (GV.SC).

The document says executives discuss strategy, risk appetite, accountability and resources under GOVERN. A CISO can check how that maps to their own role.

Identify (ID)

The organization’s current cybersecurity risks are understood. NIST says an organization can set its priorities once it understands its assets, suppliers and related risks. The assets include data, hardware, software, systems, facilities, services and people. Categories:

• Asset Management (ID.AM).
• Risk Assessment (ID.RA).
• Improvement (ID.IM).

Protect (PR)

Safeguards to manage the organization’s cybersecurity risks are used. Categories:

• Identity Management, Authentication, and Access Control (PR.AA).
• Awareness and Training (PR.AT).
• Data Security (PR.DS).
• Platform Security (PR.PS).
• Technology Infrastructure Resilience (PR.IR).

The Function also covers platform security. This means the hardware, software and services of physical and virtual platforms. Basic habits in this area are covered under cyber hygiene.

Detect (DE)

Possible cybersecurity attacks and compromises are found and analyzed. NIST says DETECT enables timely discovery and analysis of anomalies, indicators of compromise and other potentially adverse events. It also supports successful incident response and recovery. Categories:

• Continuous Monitoring (DE.CM).
• Adverse Event Analysis (DE.AE).

Respond (RS)

Actions regarding a detected cybersecurity incident are taken. NIST says outcomes in this Function cover incident management, analysis, mitigation, reporting and communication. Categories:

• Incident Management (RS.MA).
• Incident Analysis (RS.AN).
• Incident Response Reporting and Communication (RS.CO).
• Incident Mitigation (RS.MI).

Teams that do this work can start from the incident response and threat hunting role page.

Recover (RC)

Assets and operations affected by a cybersecurity incident are restored. NIST says RECOVER supports restoring normal operations in good time. It aims to reduce the effects of incidents and allow the right communication during recovery. Categories:

• Incident Recovery Plan Execution (RC.RP).
• Incident Recovery Communication (RC.CO).

What changed from CSF 1.1 to 2.0?

The document is careful here, so this section repeats only what it says. The Preface states that what changed in NIST CSF 2.0 includes new features. They highlight the importance of governance and supply chains. GV.SC is the supply chain category inside the Govern Function.

On scope, NIST says the Functions, Categories and Subcategories apply to all information and communications technology (ICT). That includes IT, the Internet of Things and operational technology. They also apply to cloud, mobile and AI environments.

NIST also says gaps in Subcategory numbering mark CSF 1.1 Subcategories that moved in CSF 2.0. Before version 2.0, the framework was called the “Framework for Improving Critical Infrastructure Cybersecurity.” NIST says that title is not used for 2.0.

NIST’s landing page, checked for this article, adds that the CSF 2.0 has been translated into Arabic. It also says the agency celebrated two years of CSF 2.0 on February 24, 2026.

What are Organizational Profiles and Tiers?

A CSF Organizational Profile describes an organization’s current and/or target cybersecurity posture in terms of the Core’s outcomes. NIST says every Profile includes a Current Profile, a Target Profile, or both.

NIST notes that a Target Profile considers expected changes. Examples are new requirements, new technology use and threat intelligence trends. A check worth making: does your threat modeling feed that part of the Target Profile?

Tiers can be applied to Profiles. NIST says they describe how rigorous an organization’s cybersecurity risk governance and management practices are. It names four of them: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). The document says Tiers should complement an organization’s risk management approach, not replace it.

How do the functions fit together?

NIST says all Functions relate to one another. Its example is that an organization sorts assets under Identify and takes steps to secure them under Protect.

It also says GOVERN, IDENTIFY and PROTECT outcomes help prevent and prepare for incidents. GOVERN, DETECT, RESPOND and RECOVER outcomes help discover and manage them.

If you are new to how threat data feeds a program like this, Threat Intelligence 101 is a plain-language starting point. For a related government view, see the CISA cybersecurity roadmap 2024 to 2026 and the executive cyber threat.

Related reading: the 2027 security program plan and the compliance calendar for 2026 and 2027.