What are the NIST CSF 2.0 core functions and how do you use them?

The NIST Cybersecurity Framework 2.0 organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in version 2.0. Together they describe the life cycle of managing cyber risk, and you use them to set a target profile and track progress.

What are the six functions?

NIST's announcement of CSF 2.0 says the core is organised around six key functions: Identify, Protect, Detect, Respond and Recover, along with the newly added Govern function. It says that, considered together, they provide a view of the life cycle for managing cybersecurity risk.

Here is each in plain words.

Govern. Decide how cyber risk fits the business: strategy, roles, policy, oversight, and supply chain expectations. It is the function that explains why the others exist.

Identify. Know what you have and what could hurt it: assets, suppliers, risks, improvement opportunities.

Protect. Put safeguards in place: access control, awareness training, data security, platform hardening.

Detect. Find problems in time: continuous monitoring and analysis of anomalies and events.

Respond. Act when an incident is confirmed: management, analysis, communication and mitigation.

Recover. Restore normal operation after an incident and tell people what happened.

What changed with Govern?

Before 2.0 the framework began at Identify. Adding Govern puts leadership and policy in the core instead of treating them as background. For a security lead, that gives a framework-shaped reason to ask executives for decisions on risk appetite and ownership.

Is it a checklist or a certification?

Neither. The CSF is voluntary guidance. NIST publishes quick start guides for particular audiences, example profiles and mappings to other standards, and the framework asks you to describe a current profile and a target profile and plan the gap. Nobody certifies you "CSF compliant", and you should be wary of anyone who says they can.

How do you use it in practice?

A constructed example for a 60 person software company with no formal programme:

1. They write a one page current profile: for each function, what exists today (for example, Detect: logs exist but nobody reviews them).
2. They choose a target for twelve months: log review weekly, tested restores, a named incident lead, a supplier list with owners.
3. They rank the gaps by risk and effort and assign a person to each.
4. At each quarter they update the profile and show the board a one page comparison.

That is enough to count as using the framework. The artefact is the profile, and the value is the conversation it forces.

Which practices belong in each function?

Common starting points, offered as examples rather than a mandated list:

• Govern: written security policy, named owner, annual risk review.
• Identify: asset and data inventory, supplier list, vulnerability tracking.
• Protect: multifactor authentication, least privilege, patching, backups, secure development practices.
• Detect: central logs, alerting on sign-in anomalies, monitoring of cloud configuration.
• Respond: an incident plan with contacts, and a practice run.
• Recover: restore tests and a communication template.

How do tiers and profiles relate to the functions?

The functions say what outcomes to pursue. A profile records which outcomes you pursue and how well you meet them today. CSF 2.0 also describes implementation tiers, which characterise how rigorous your risk governance and management practices are. Use tiers sparingly: they are a way to describe your approach, not a score to chase. For most teams the useful artefact is the target profile with owners and dates beside each gap.

How to check or apply this

1. Download the CSF 2.0 document and the quick start guide closest to your situation.
2. Write the current profile in a page, function by function, using plain statements.
3. Pick targets you can reach in a year, and note the owner for each.
4. Map them to any other standard you must meet, using NIST's published mappings, so you do the work once.
5. Review progress quarterly and record decisions.

Where you build software, the NIST SSDF (SP 800-218) fits under Protect, and Safeguard's compliance automation can help collect evidence for mapped controls.

Quick check

Sources

• NIST announces CSF 2.0
• NIST Cybersecurity Framework
• NIST SP 800-218, Secure Software Development Framework

Last reviewed: 18 October 2026.