NIST CSF 2.0 is a voluntary framework that describes cybersecurity outcomes under six functions: Govern, Identify, Protect, Detect, Respond and Recover. For a DevOps lead it works best as a vocabulary for your pipeline and a way to show leadership where the gaps are, not as a pass or fail test.
What is new in version 2.0?
NIST describes CSF 2.0 as aimed at industry, government and other organizations, with companion material: quick start guides, profile templates and informative references that map the framework to other standards. The headline structural change is the Govern function, which puts risk strategy, roles and policy alongside the technical functions.
The framework is not a certification. Nobody issues a CSF certificate, so claims of being "CSF compliant" should be read as a self-assessment unless an assessor states otherwise.
Where does your pipeline sit in the six functions?
A constructed mapping for a team with Git, CI, a container registry and Kubernetes:
- Govern. Who decides what gets blocked at a gate, and who can approve an exception. Written down, with an owner.
- Identify. Inventory of repositories, services, base images and dependencies. If you cannot list them, the later functions are guesses.
- Protect. Branch protection, signed commits or artifacts, secrets management, least-privilege deploy roles, dependency pinning.
- Detect. Alerts on anomalous deploys, new privileged roles, vulnerable dependencies appearing in production.
- Respond. A runbook for a compromised token or malicious package, with an on-call owner.
- Recover. Tested rebuilds from clean sources, backup restores, a way to roll back and re-sign artifacts.
Notice that most teams are strong on Protect and thin on Govern and Recover. That asymmetry is the useful finding.
How do profiles help?
A profile is a statement of your current outcomes and your target outcomes, with the difference as a plan. NIST provides profile templates and community profiles. Write a Current profile for the delivery pipeline in an afternoon and a Target profile with leadership. Rank gaps by risk reduction per week of work.
Keep the profile short enough to review quarterly. A forty-page profile nobody reads is worse than a one-page profile everyone updates.
How do you keep the mapping honest?
The risk with any framework exercise is self-flattery. Rating Detect as "working" because an alert tool is installed is not the same as having someone who answers the alert. For every rating, require one piece of evidence a colleague could check: a dashboard link, a recent alert and its resolution, a restore test report. If the evidence is older than a quarter, downgrade the rating.
Also separate what the pipeline does from what the organization does. Your CI can enforce review rules, but Govern outcomes such as risk appetite and exception approval need leadership. Flag those gaps as decisions someone else must make, rather than quietly absorbing them as DevOps tasks.
How to check or apply this
- List the systems in the delivery pipeline and name an owner for each.
- Rate each of the six functions as absent, partial or working, with one piece of evidence per rating.
- Pick the three outcomes with the biggest gap and highest consequence.
- Write them as target outcomes with a date and an owner.
- Map each target to a concrete control change in the pipeline.
- Revisit the profile each quarter and after any incident.
Safeguard's policies and gates, dependency scanning and reachability analysis give concrete evidence for Identify and Protect outcomes. That is evidence for your own self-assessment, not a CSF attestation.
Quick check
Is CSF 2.0 mandatory?
It is voluntary for most organizations. Some regulators and customers ask for alignment, so check your contracts.
How do I show progress to leadership?
Use the current and target profile. Report how many target outcomes moved from partial to working each quarter.
Sources
Last reviewed: 18 October 2026.
