NIST CSF 2.0 is a voluntary framework that organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. For a CTO it is a planning and reporting tool. Choose a target profile, assign owners, and measure gaps, because nobody certifies you against it.
What changed in version 2.0?
NIST's CSF page presents CSF 2.0 with supporting material: quick start guides for common goals, templates for creating and using profiles, and informative references that map the framework to other NIST resources. NIST marked two years of CSF 2.0 in February 2026.
The structural change worth a CTO's attention is the sixth function, Govern, which sits above the other five and covers strategy, roles, policy and oversight. It puts leadership decisions inside the framework instead of leaving them as background.
Why use a profile instead of a checklist?
A profile records which outcomes matter to you, where you are now and where you want to be. NIST offers templates for both a current and a target profile. That framing suits engineering leadership because it turns a long list into a short gap list with priorities.
Be clear about what the framework is not. The older CSF 1.1 guidance, still on NIST's site, describes it as voluntary and as not a one-size-fits-all approach. Treat 2.0 the same way. Customers may ask how you align, but alignment is your own statement, so write it carefully and keep evidence.
What should the CTO personally own?
Govern outcomes. Risk appetite, accountability, and which security decisions need executive sign off are not delegable to the security team alone. If your board asks for a cyber update, Govern is where the language should come from.
Delegate the rest, but ask for a one page view per function: current profile status, top gaps, owners and dates.
A constructed example
A 200 person software company writes a target profile for the next year. Under Identify it chooses asset and software inventory as the top gap, because nobody can list which services use a vulnerable library. Under Respond it picks a tested incident communication plan. Under Govern it commits to a quarterly risk review chaired by the CTO. Three items, each with an owner and a date, replace a 90 line spreadsheet nobody read.
What to do
- Read the CSF 2.0 document and the quick start guide that fits your situation.
- Write a current profile in plain language, then a target profile for twelve months.
- Assign each Govern outcome to a named executive, starting with yourself.
- Pick no more than five gaps that matter most to customers and regulators.
- Use the informative references to map to frameworks customers already ask about.
- Report to leadership each quarter using the same one page view, so trends are visible.
- State alignment carefully: say what you mapped, not that you are compliant or certified.
Safeguard can feed the Identify and Protect work with dependency inventories, vulnerability findings and compliance automation. The framework choices stay with you.
Quick check
Can a company be CSF 2.0 certified?
No. It is a voluntary framework. Beware claims of certification.
What is the new function in 2.0?
Govern, which covers strategy, roles, policy and oversight across the other five functions.
Sources
Last reviewed: 18 October 2026.
