NIST CSF 2.0 organizes cybersecurity outcomes into six Functions: Govern, Identify, Protect, Detect, Respond and Recover. This article walks through each one using NIST CSWP 29, published February 26, 2024, with the categories listed in its Table 1. It is a list of practices in the document’s own order, not a ranking.
What is NIST CSF 2.0?
NIST describes the Cybersecurity Framework (CSF) 2.0 as guidance for industry, government agencies and other organizations to manage cybersecurity risks. It offers a taxonomy of high-level cybersecurity outcomes that any organization can use, regardless of size, sector or maturity. NIST also says the CSF does not prescribe how outcomes should be achieved.
The Core is a hierarchy of Functions, Categories and Subcategories. Table 1 in Appendix A gives each Category a short identifier, such as GV.OC or ID.AM, and this article uses those identifiers as the document gives them.
What are the six CSF 2.0 functions?
The document says the Functions organize outcomes at their highest level. It adds that they should be addressed concurrently: GOVERN, IDENTIFY, PROTECT and DETECT happen continuously, while RESPOND and RECOVER should be ready at all times and happen when incidents occur.
Govern (GV)
NIST defines it as: the organization’s cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. The document says governance activities are critical for incorporating cybersecurity into the broader enterprise risk management strategy. Table 1 lists six categories:
- Organizational Context (GV.OC)
- Risk Management Strategy (GV.RM)
- Roles, Responsibilities, and Authorities (GV.RR)
- Policy (GV.PO)
- Oversight (GV.OV)
- Cybersecurity Supply Chain Risk Management (GV.SC)
The document says executives discuss strategy, risk appetite, accountability and resources under GOVERN. A CISO can check how that maps to their own role.
Identify (ID)
The organization’s current cybersecurity risks are understood. NIST says understanding assets such as data, hardware, software, systems, facilities, services and people, plus suppliers and related risks, lets an organization prioritize its efforts. Categories: Asset Management (ID.AM), Risk Assessment (ID.RA) and Improvement (ID.IM).
Protect (PR)
Safeguards to manage the organization’s cybersecurity risks are used. Categories: Identity Management, Authentication, and Access Control (PR.AA), Awareness and Training (PR.AT), Data Security (PR.DS), Platform Security (PR.PS) and Technology Infrastructure Resilience (PR.IR). The Function also covers platform security, meaning the hardware, software and services of physical and virtual platforms. Basic habits in this area are covered under cyber hygiene.
Detect (DE)
Possible cybersecurity attacks and compromises are found and analyzed. NIST says DETECT enables the timely discovery and analysis of anomalies, indicators of compromise and other potentially adverse events, and supports successful incident response and recovery. Categories: Continuous Monitoring (DE.CM) and Adverse Event Analysis (DE.AE).
- Identify (ID)Current cybersecurity risks are understood
- Protect (PR)Safeguards to manage risks are used
- Detect (DE)Possible attacks and compromises are found and analyzed
- Respond (RS)Actions regarding a detected incident are taken
- Recover (RC)Assets and operations affected by an incident are restored
Respond (RS)
Actions regarding a detected cybersecurity incident are taken. NIST says outcomes in this Function cover incident management, analysis, mitigation, reporting and communication. Categories: Incident Management (RS.MA), Incident Analysis (RS.AN), Incident Response Reporting and Communication (RS.CO) and Incident Mitigation (RS.MI). Teams that run these activities can start from the incident response and threat hunting role page.
Recover (RC)
Assets and operations affected by a cybersecurity incident are restored. NIST says RECOVER supports the timely restoration of normal operations to reduce the effects of incidents and enable appropriate communication during recovery. Categories: Incident Recovery Plan Execution (RC.RP) and Incident Recovery Communication (RC.CO).
What changed from CSF 1.1 to 2.0?
The document is careful here, so this section only repeats what it says. The Preface states that CSF 2.0 contains new features that highlight the importance of governance and supply chains. GV.SC is the supply chain category inside the Govern Function.
On scope, NIST says the Functions, Categories and Subcategories apply to all information and communications technology (ICT), including IT, the Internet of Things and operational technology, and to cloud, mobile and artificial intelligence environments. It also says the gaps in Subcategory numbering mark CSF 1.1 Subcategories that were relocated in CSF 2.0. Before version 2.0, the framework was called the “Framework for Improving Critical Infrastructure Cybersecurity,” a title NIST says is not used for 2.0.
NIST’s landing page, checked for this article, adds that the CSF 2.0 has been translated into Arabic and that the agency celebrated two years of CSF 2.0 on February 24, 2026.
What are Organizational Profiles and Tiers?
A CSF Organizational Profile describes an organization’s current and/or target cybersecurity posture in terms of the Core’s outcomes. NIST says every Profile includes a Current Profile, a Target Profile, or both. NIST notes that a Target Profile considers anticipated changes such as new requirements, new technology adoption and threat intelligence trends. A check worth making: does your threat modeling feed that part of the Target Profile?
| Question | Current Profile | Target Profile |
|---|---|---|
| What it specifies | Core outcomes the organization is currently achieving, or attempting to achieve | Desired outcomes the organization has selected and prioritized |
| Detail | Characterizes how or to what extent each outcome is being achieved | Considers anticipated changes such as new requirements, new technology adoption and threat intelligence trends |
Tiers can be applied to Profiles. NIST says they characterize the rigor of an organization’s cybersecurity risk governance and management practices, and names four: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). The document says Tiers should complement an organization’s risk management methodology rather than replace it.
How do the functions fit together?
NIST says all Functions relate to one another. Its example is that an organization categorizes assets under Identify and takes steps to secure them under Protect. It also says GOVERN, IDENTIFY and PROTECT outcomes help prevent and prepare for incidents, while GOVERN, DETECT, RESPOND and RECOVER outcomes help discover and manage them.
For readers new to how threat information feeds a program like this, Threat Intelligence 101 is a plain-language starting point. For a related government view, see the CISA cybersecurity roadmap 2024 to 2026 and the executive cyber threat.
Related reading: the 2027 security program plan and the compliance calendar for 2026 and 2027.