Direct answer: the NIST Cybersecurity Framework (CSF) 2.0 was published on 26 February 2024 (NIST CSWP 29). Its Core contains 6 Functions, 22 Categories and 106 Subcategories: Govern, Identify, Protect, Detect, Respond and Recover. The biggest change in 2.0 is elevating Govern to a top-level Function and explicitly connecting cybersecurity to enterprise risk management (ERM) and supply chain risk management (SCRM). It is not a certification, not law, and does not prescribe "how" to do things; it provides an outcome-oriented common language: use a Current Profile for today, a Target Profile for the goal, and Tiers for the rigor of governance/management, then do a gap analysis. For exporters/website operators, it is best used to answer customer security questionnaires, structure supply-chain security and map NIS2/DORA/CRA requirements into one communicable framework—not to "get another certificate".
This guide is for executives, CISOs/security leads, IT/operations, procurement and compliance teams. It explains CSF 2.0's structure, the role of Govern, how to use Tiers/Profiles, the difference from NIS2/DORA/CRA/ISO 27001, customer-questionnaire/supply-chain use cases and a 90-day adoption checklist. Sources are the official NIST CSF 2.0 page, NIST CSWP 29 (26 February 2024) and the CSF 2.0 Quick-Start Guides (all accessed 8 November 2026). Official framework facts, editorial counts and implementation advice are kept separate. This is not certification, legal or procurement advice.
(1) CSF 2.0 = 6 Functions / 22 Categories / 106 Subcategories; Govern is the new top-level Function covering strategy, roles, policy, supply chain and oversight. (2) Tiers are not a "certification grade", and Tier 4 is not mandatory; they describe governance/management rigor and should match risk. (3) CSF is voluntary, outcome-oriented and does not prescribe "how"; Current/Target Profiles plus a gap analysis are more useful than chasing a certificate.
CSF 2.0 at a glance: 6 / 22 / 106
The CSF 2.0 Core is a three-level "Function → Category → Subcategory" hierarchy. Counting the official Core IDs gives 6 Functions, 22 Categories and 106 Subcategories. The six Functions are GV (Govern), ID (Identify), PR (Protect), DE (Detect), RS (Respond) and RC (Recover). Govern is not "a sixth parallel item"; it provides the strategy, priorities, policy, roles and oversight for the other five. That is the most important structural change from 1.1. CSF also provides Organizational Profiles, Tiers, Informative References, Implementation Examples and Quick Start Guides.
| Item | Data | Note |
|---|---|---|
| Version/date | CSF 2.0 / 26 Feb 2024 | NIST CSWP 29 |
| Functions | 6 | Govern, Identify, Protect, Detect, Respond, Recover |
| Categories | 22 | Counted by Core IDs |
| Subcategories | 106 | Outcome-oriented; no prescribed controls |
| Profiles | Current / Target | Describe today/goal; gap analysis |
| Tiers | 1-4 | Partial / Risk Informed / Repeatable / Adaptive |
| Nature | Voluntary | Not a certification, not law |
Sources: official NIST CSF 2.0 page and NIST CSWP 29 (26 February 2024); 6/22/106 are editorial counts of Core IDs (GV/ID/PR/DE/RS/RC), accessed 8 November 2026. CSF is voluntary and does not issue certifications.
The six Functions: why Govern is separate
Govern covers cybersecurity risk strategy, expectations, policy, roles/responsibilities/authorities, supply chain risk management and oversight; it sets the priorities and resources for the other five. Identify covers assets, risk and improvement; Protect covers identity/access, awareness/training, data security, platform security and resilience; Detect covers adverse-event analysis and continuous monitoring; Respond covers incident management, analysis, communication and mitigation; Recover covers recovery planning and communication. By Subcategory count, Govern is the largest at 31, showing that 2.0 turns "governance" from a soft requirement into checkable outcomes.
| Function | Focus | Categories | Subcategories |
|---|---|---|---|
| GV Govern | Strategy, policy, roles, supply chain, oversight | 6 | 31 |
| ID Identify | Assets, risk, improvement | 3 | 21 |
| PR Protect | Identity/access, training, data, platform, resilience | 5 | 22 |
| DE Detect | Adverse-event analysis, continuous monitoring | 2 | 11 |
| RS Respond | Incident management, analysis, communication, mitigation | 4 | 13 |
| RC Recover | Recovery planning, communication | 2 | 8 |
Sources: NIST CSWP 29 Appendix A (CSF Core); Category/Subcategory counts are editorial counts from IDs (accessed 8 November 2026). Function order/size does not imply importance or execution order.
Tiers: governance/management rigor, not a "certification grade"
CSF Tiers run from Tier 1 Partial to Tier 4 Adaptive and describe the rigor of cybersecurity risk governance and management: higher tiers are more institutionalized, risk-informed and continuously improving. Tiers are not a maturity score, and Tier 4 is not mandatory; choose the tier that matches business/threat/resources and use it for internal communication and cross-team alignment. Treating Tier 4 as a KPI leads to over-investment; staying at Tier 1 forever hurts in customer questionnaires/supply-chain reviews.
| Tier | Characteristics | Fit/caveat |
|---|---|---|
| 1 Partial | Ad hoc, reactive, case-by-case; limited organization-level risk awareness | Starting point; build Govern/assets/basic controls first |
| 2 Risk Informed | Management-approved but not necessarily organization-wide policy; priorities informed by risk objectives | Realistic target for many SMEs |
| 3 Repeatable | Organization-wide policy/process, regularly updated, repeatable | When customer/supply-chain reviews demand it |
| 4 Adaptive | Continuous improvement, adapts to threat/technology change, organization-wide risk-informed | High-adversary/critical business; not universally required |
Sources: NIST CSWP 29 Appendix B and Section 3 (26 February 2024). Editorial summary; tier selection should match risk/resources, not "higher is always better".
Profiles: write "now", then "target"
The Organizational Profile is CSF's most practical tool: the Current Profile records which Subcategories are met today, the Target Profile records what the business/risk requires, and the difference is the gap/roadmap. Profiles can be built by business line, system, region or customer requirement; you do not need all 106 at once. For exporters, the Target Profile can align directly with customer security questionnaires, NIS2/DORA/CRA clauses or ISO 27001 controls, avoiding a different form for every customer.
| Step | Action | Output |
|---|---|---|
| 1. Scope | Choose business/system/region/customer requirements | Profile scope |
| 2. Current | Score/evidence the 106 Subcategories | Current Profile |
| 3. Target | Set goals by risk/contract/regulation | Target Profile |
| 4. Gap | Current vs Target | Gap list, priorities |
| 5. Roadmap | Owner/budget/time/evidence | Implementation plan |
| 6. Review | Update regularly, integrate into ERM | New Profile |
Editorial Profile usage, not an official template; see NIST CSF 2.0 Profiles and Quick Start Guides for templates/tools.
How CSF 2.0 works with NIS2/DORA/CRA/ISO 27001
CSF 2.0 is a voluntary, outcome-oriented framework, not law; NIS2/DORA/CRA are EU legal/compliance requirements, and ISO 27001 is a management-system certification. They are not substitutes: CSF can be the common language/gap analysis/customer-communication layer, while legal clauses and ISO controls supply the "how/evidence". For companies facing both EU and global customers, use CSF as the unified governance view and map NIS2/DORA/CRA/ISO requirements to Subcategories, instead of running separate silos.
| Framework | Nature | Best for | Does not replace |
|---|---|---|---|
| NIST CSF 2.0 | Voluntary framework | Governance view, gap analysis, customer communication | Regulatory compliance/certification |
| NIS2 | EU directive | EU entities/supply-chain security duties | Specific technical controls |
| DORA | EU regulation | Financial entity ICT risk/third parties | General security framework |
| CRA | EU regulation | Products with digital elements | Organizational governance |
| ISO/IEC 27001 | Certifiable standard | ISMS, certificate, customer trust | Specific technical outcomes |
Editorial comparison, not legal advice; NIS2/DORA/CRA scope/duties follow the official EU texts, and ISO certification follows the certification body.
90-day adoption checklist
Use the first 90 days to close the "scope, current, target, gap, roadmap" loop; do not start by buying tools or chasing full certification. Weeks 1-2 set scope and Govern ownership; weeks 2-4 build the Current Profile; weeks 4-6 build the Target Profile/gap; weeks 6-8 prioritize/budget; weeks 8-10 implement 1-2 high-priority improvements; weeks 10-12 review and integrate into ERM/customer questionnaires. Govern comes first: who owns, who approves, how often reviewed, how supply chain is managed.
| Phase | Action | Output |
|---|---|---|
| Weeks 1-2 | Set scope/business lines/systems; define Govern roles and approvals | Scope, RACI |
| Weeks 2-4 | Build Current Profile across the 106 Subcategories | Current scores/evidence |
| Weeks 4-6 | Build Target Profile by risk/contract/regulation | Target, gap list |
| Weeks 6-8 | Prioritize, budget, owners, timeline | Roadmap |
| Weeks 8-10 | Implement 1-2 high-priority improvements (assets/identity/logging) | Improvement evidence |
| Weeks 10-12 | Review, integrate into ERM/questionnaires, update Profile | New Profile, reporting |
Editorial adoption advice, not an official template; scope/priority/budget follow enterprise risk and resources.
FAQ
When was CSF 2.0 released?
26 February 2024, NIST CSWP 29; it contains 6 Functions, 22 Categories and 106 Subcategories (counted by Core IDs), plus Profiles, Tiers and online resources.
Is CSF 2.0 a certification?
No. CSF is a voluntary framework; it does not issue certifications and does not prescribe specific controls. It provides an outcome-oriented common language, while the organization chooses standards/controls by risk.
Why does Govern matter?
Govern covers strategy, policy, roles/responsibilities, supply chain risk and oversight, and sets the priorities/resources for the other five Functions. 2.0 elevates it so cybersecurity enters enterprise risk management/governance, not just IT.
Is Tier 4 mandatory?
No. Tiers describe governance/management rigor, not a maturity score; choose by business/threat/resources. Tier 4 fits high-adversary/critical business, not a universal KPI.
Do we need all 106 Subcategories?
Not at once. Use Current/Target Profiles to select scope and set goals by risk/contract/regulation; 106 is the full Core, not a requirement to cover everything.
How does CSF relate to NIS2/DORA/CRA?
CSF is voluntary; NIS2/DORA/CRA are EU legal requirements. CSF can provide the unified governance/gap analysis/customer communication, while legal clauses and ISO controls provide the "how/evidence"; they do not replace each other.
How do we use it for customer security questionnaires?
Map questionnaire questions to CSF Subcategories and answer from a Target Profile; attach evidence (policy/logs/tests/drills) to Subcategories to avoid redoing a different form for every customer.
Where do we start?
Set scope and Govern roles, build a Current Profile (scoped, not all 106), then a Target Profile/gap, prioritize, implement 1-2 high-priority improvements, and integrate into ERM/customer questionnaires.
Research method and limitations
This article separates "official framework facts" from "editorial summaries." The CSF 2.0 publication date, 6 Functions, Govern/Identify/Protect/Detect/Respond/Recover, Tiers 1-4, Profiles, CSWP 29 and Quick Start Guides come from the official NIST CSF 2.0 page and NIST CSWP 29 (26 February 2024); the 22 Category/106 Subcategory counts and per-Function distribution are editorial counts of Core IDs. Tier/Profile usage, the NIS2/DORA/CRA/ISO comparison and the 90-day checklist are editorial. CSF is voluntary and does not issue certifications; legal/certification conclusions follow official texts/certification bodies.
Eight limitations: (1) this is not certification/legal advice; (2) it covers CSF 2.0's structure/usage, not a translation of all 106 Subcategories; (3) no real enterprise assessment/evidence is included; (4) not all Informative References/Implementation Examples are expanded; (5) specific tools/platforms are not assessed; (6) the NIS2/DORA/CRA/ISO mapping is editorial and not checked clause by clause; (7) tier selection depends on enterprise risk/resources; (8) standards/resources may update, so recheck the official NIST pages before implementation.
Sources and basis
- NIST, Cybersecurity Framework (CSF) 2.0: nist.gov/cyberframework. CSF 2.0, Profiles, Tiers, Quick Start Guides, resources. Accessed 8 November 2026.
- NIST, The NIST Cybersecurity Framework (CSF) 2.0 (CSWP 29, 26 February 2024): nist.gov/publications/nist-cybersecurity-framework-csf-20. Framework text, Core, Tiers, Profiles. Accessed 8 November 2026.
- NIST, CSF 2.0 PDF: tsapps.nist.gov/publication/get_pdf.cfm?pub_id=957258. Appendix A Core, Appendix B Tiers. Accessed 8 November 2026.
- NIST, CSF 2.0 Quick-Start Guides: nist.gov/cyberframework/quick-start-guides. Organizational Profiles, Small Business, SCRM, Tiers, ERM, etc. Accessed 8 November 2026.
Data cut-off 8 November 2026; CSF clauses/resources follow the official NIST pages and CSWP 29; this is not certification, legal or procurement advice.