You implement NIST CSF 2.0 by building an Organizational Profile: scope it, describe what you do today (Current Profile), choose what you need (Target Profile), compare the two, and work through the gaps. The CSF is voluntary and has no certification, so your deliverable is a profile plus evidence.
What is the CSF, and what is it not?
NIST publishes CSF 2.0 as CSWP 29 (26 February 2024). Its Core is a list of outcomes grouped into six Functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST says plainly that these outcomes are not a checklist and that the order of the Functions does not imply sequence or importance.
That matters for a DIY team. Nobody will hand you a pass mark. You decide how much of the Core applies, you document why, and you show progress. Customers, boards and regulators then read that work.
Who should own it?
One accountable owner, usually the head of security or the CTO at a small company, plus a named lead for each Function. Govern needs an executive, because it covers strategy, roles, policy and oversight, and it feeds the other five.
How do the five profile steps work in practice?
NIST describes one way to run a profile in five steps. Here they are with concrete work attached.
1. Scope. Pick the boundary. NIST gives examples such as the whole organization, only financial systems, or one threat such as ransomware. A small company should start with the whole company or the production product, and say so in writing.
2. Gather. Collect policies, your risk register or business impact analysis, contracts that impose security requirements, tool inventories and who does what. Gaps in this pile are findings already.
3. Create the profile. For each subcategory you decide, record whether you do it, partly do it, or do not. Note how, who, and where the proof lives. NIST suggests a Community Profile (sector baseline) as a starting Target Profile if one exists for your field.
4. Analyze the gaps and plan. Compare Current to Target. Turn each gap into a ticket with an owner and a date. Rank by risk, not by how easy the fix is.
5. Implement and update. Work the plan, update the profile, and repeat. NIST says continual improvement is the point.
What about Tiers?
Tiers describe how rigorous your governance and risk management are: Partial (1), Risk Informed (2), Repeatable (3) and Adaptive (4). They are not scores you must raise. Pick a tier target that fits your risk and budget, and be able to explain it.
What evidence should you keep?
- The scoped profile document, versioned, with dates and approver
- Policies with approval records
- Asset and supplier inventories (Identify and Govern supply chain outcomes)
- Access reviews, training records, backup tests (Protect)
- Log and alert samples, vulnerability scan history (Detect)
- Incident plan, last exercise notes, recovery test results (Respond and Recover)
- The gap action plan with closed items
Mistakes to avoid
- Treating the Core as a checklist and marking everything "done" to look good.
- Skipping Govern because it feels like paperwork. Roles, risk strategy and oversight are what make the other five last.
- Writing a profile once and never updating it.
- Forgetting suppliers. CSF 2.0 gives supply chain risk its own place under Govern.
What to do
- Name an owner and a lead per Function.
- Write a one page scope statement and get it approved.
- Collect your existing policies, inventories and contracts.
- Fill in a Current Profile for every category, with an evidence link for each yes.
- Choose a Target Profile, using a Community Profile if one fits.
- Turn gaps into owned, dated tickets and rank them by risk.
- Review the profile every quarter and after major changes.
Quick check
Is there a NIST CSF certification?
No. NIST describes the CSF as voluntary. You can demonstrate alignment with a profile and evidence, and some customers may ask for an independent review, but NIST does not certify organizations.
Do I have to cover every subcategory?
No. You choose and prioritize outcomes in your Target Profile based on mission, risk and requirements, and you document the reasoning.
How Safeguard helps automate this
Most of the CSF effort is gathering proof that outcomes are met and keeping it current. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between reviews. That frees your team for the gap work itself.
For Identify, Protect and Detect, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability, not only policies. Safeguard's agent can also open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps you prepare and keep evidence ready. It does not certify you, and the CSF has no certifier.
See it at /demos/framework-mapping.
Want to see it on your own stack? Book a call.
Sources
Last reviewed: 18 October 2026.
