NIST CSF 2.0: The NIST Cybersecurity Framework Explained for UK Organisations

The NIST CSF (NIST Cybersecurity Framework) is a voluntary framework from the US National Institute of Standards and Technology that describes the outcomes an organisation should achieve to manage cyber security risk. The current version, CSF 2.0, was published on 26 February 2024. It groups 106 outcomes, called subcategories, into 22 categories under six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is free, it is not a certification and it does not tell you which products to buy.

For UK organisations, NIST CSF usually arrives through a US customer’s security questionnaire, a US parent company or an investor’s due diligence. It does not replace ISO 27001 or Cyber Essentials, but it maps onto both, so you rarely need a separate programme to answer it.

What is the NIST Cybersecurity Framework?

The framework was first published in 2014 for US critical infrastructure, revised as version 1.1 in 2018, and rewritten as CSF 2.0 for organisations of any size, sector or country. It has three parts:

• The CSF Core: the functions, categories and subcategories, written as outcomes such as “backups of data are created, protected, maintained and tested”.
• Organisational Profiles: your current and target positions against the Core.
• Tiers: a four-level scale describing how rigorous your cyber risk governance and management are.

The Core is deliberately technology-neutral. To decide how to achieve each outcome, NIST publishes informative references that map the outcomes to detailed control sets such as NIST SP 800-53, along with implementation examples and quick-start guides. Everything is available free from NIST’s Cybersecurity Framework site.

What are the six functions of NIST CSF 2.0?

The six NIST CSF functions organise everything else. Govern sits at the centre and shapes how the other five are carried out; Identify, Protect, Detect, Respond and Recover follow the life of a risk from understanding it to recovering from an incident.

What changed in NIST CSF 2.0?

CSF 2.0 is the first major revision since 2018 and changes both the structure and the audience:

• A new Govern function. Strategy, roles, policy and oversight were scattered across version 1.1. They now sit in one function aimed at senior leadership.
• Wider scope. The framework dropped “critical infrastructure” from its title and is written for every organisation, including small businesses and organisations outside the US.
• Supply chain risk management moves from Identify (ID.SC in version 1.1) into Govern as GV.SC and gains more outcomes, covering suppliers from selection to the end of the relationship.
• Restructured categories. Protect was reorganised around platform security and infrastructure resilience, and improvement activity moved under Identify.
• More practical help: implementation examples for each subcategory, quick-start guides, Community Profiles for sectors and threats, and online mappings to other standards.

What are NIST CSF tiers and profiles?

Profiles are how you use the framework. A Current Profile records which outcomes you achieve today; a Target Profile records the outcomes you want, chosen according to your risks, obligations and budget. The gap between the two becomes your action plan. Community Profiles give a shared starting target for a sector, technology or threat.

Tiers describe how rigorous your cyber risk practices are, applied to both governance and management. NIST uses them to inform your Current and Target Profiles:

NIST does not require any particular tier. Choose the one your risk and resources justify, then use the profile gap to get there.

NIST CSF vs ISO 27001: what is the difference?

The main difference between NIST CSF and ISO 27001 is that ISO 27001 is a certifiable management system standard with mandatory requirements, while NIST CSF is a voluntary set of outcomes with no certificate. They overlap heavily in content.

So, is NIST CSF better than ISO 27001? Comparing ISO 27001 vs NIST comes down to what you need to show, not which is stronger. If customers need proof, ISO/IEC 27001 gives you a certificate they recognise worldwide; if you need a board-level structure or must answer a US questionnaire, the CSF is easier to explain. A common pattern is to run an ISO 27001 ISMS and report to the board using the six CSF functions. Our guide to what ISO 27001 is covers the standard in more depth.

How does NIST CSF map to ISO 27001 and Cyber Essentials?

Most CSF outcomes have a home in ISO 27001, while Cyber Essentials covers mainly the Protect function. The table shows our indicative mapping at function level; map at subcategory level before relying on it.

Free download: our NIST CSF 2.0 to ISO 27001 and Cyber Essentials mapping (.xlsx) takes the same mapping down to all 22 categories, with columns to record your Current Profile, Target Profile, owner and evidence.

Cyber Essentials is still worth having alongside the CSF: it is the certificate UK public sector buyers ask for, and its rules are specific where the CSF is not, such as installing high and critical updates within 14 days. The full control list is in our guide to the ISO 27001 Annex A controls.

When do UK organisations use NIST CSF?

UK organisations rarely adopt NIST CSF on its own. They use it when:

• A US customer asks. Some US companies structure their supplier security questionnaires around the CSF functions.
• A US parent or investor reports on it. Group security teams and investors’ due diligence may score subsidiaries against the CSF.
• The board wants one picture. Six functions are easier to report on than 93 Annex A controls.
• You want a technical layer underneath. The CIS Controls map every Safeguard to a CSF function, which turns outcomes into a checklist.

If a US customer wants an independent report rather than a framework, they usually mean SOC 2, which our guide to SOC 2 compliance explains.

Can you get NIST CSF certified?

No. NIST does not certify organisations and there is no accredited NIST CSF certification scheme. What you can have is a self-assessment or an independent assessment that scores your Current Profile against the framework and sets out a Target Profile. If a customer needs a certificate, point them to your ISO 27001 or Cyber Essentials certificate and give them your CSF profile as supporting detail.

Why Sovereign Secure?

We can map and assess your controls against the six CSF 2.0 functions alongside the standards you are certified to, but we do not issue NIST certificates, because none exist. Sovereign Secure Ltd is ISO 27001 certified and provides ISO 27001 consultancy, with certification audits carried out by our partner certification body, MQA International. We are an IASME-licensed Cyber Essentials certification body and a PCI SSC Qualified Security Assessor (QSA) company, so one assessment can show how your CSF profile lines up with ISO 27001, Cyber Essentials and PCI DSS v4.0.1.

Our penetration testing and vulnerability scanning produce direct evidence for CSF outcomes such as ID.RA-01 (vulnerabilities in assets are identified, validated and recorded) and ID.IM-02 (improvements are identified from security tests and exercises). With offices in Accrington, Los Angeles, Singapore, Dubai and Dhaka, we work with UK organisations answering US customers and with US groups that have UK operations.

Next step

Start by scoring yourself in the free NIST CSF 2.0 mapping spreadsheet. Then send us the questionnaire or framework you have been asked to meet and tell us what you already hold. We will tell you how much of it your existing ISO 27001 or Cyber Essentials work already answers. Contact us or call +44 161 523 5276.