NIST Cybersecurity Framework 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new in version 2.0. For a VP of engineering, the practical use is a current profile, a target profile and a ranked gap list, not a certification project.
What is the CSF?
NIST describes the CSF as a way to help organisations better understand and improve how they manage cybersecurity risk. It is voluntary, widely used and not tied to one sector or size. NIST's CSF page links the framework document, quick start guides, sample profiles and mappings to other standards. Version 2.0 was published in 2024 and expanded the audience beyond critical infrastructure.
What does each function mean for engineering?
- Govern: roles, policy, risk strategy and oversight, including supply chain risk management. Engineering owns decisions about which risks are accepted and who signs.
- Identify: know your assets, data, suppliers and risks. This is the inventory of services, repositories, dependencies and data stores.
- Protect: safeguards such as access control, secure configuration, training and data security.
- Detect: monitoring that finds anomalies and events.
- Respond: incident management, analysis, communication and mitigation.
- Recover: restoring operations and communicating during recovery.
Version 2.0 raised the profile of supply chain risk, which you can see in the Govern outcomes. That matters for engineering teams that depend on open source and third party services.
How do you use profiles?
A profile states which outcomes matter to you. A current profile records what you do today. A target profile records what you want within a time frame. The difference is your gap list. Do this at a coarse level first: for each function, write three to five outcomes you care about and rate them as done, partial or missing.
A constructed example: a 120 person software company rates itself partial on asset inventory, missing on supplier risk review, done on access control and partial on incident exercises. Its target profile for the next two quarters is a complete service and dependency inventory and a supplier tiering process. That is two projects, each with an owner.
What are implementation tiers?
Tiers describe how rigorous and integrated your risk practices are, from partial to adaptive. They are not scores to chase. They help you decide whether risk management is ad hoc or a repeatable habit that leadership reviews.
How does this fit with other frameworks?
NIST publishes informative references that map CSF outcomes to other documents. If you also work to ISO 27001 or SOC 2, use the CSF as a communication layer: it explains your posture in a language executives and regulators know. Keep control evidence in one place.
What to do
- Read the CSF 2.0 overview and one quick start guide for your size.
- Draft a current profile with the team leads in a single workshop.
- Pick a target profile for the next two quarters.
- Turn the top gaps into projects with owners and dates.
- Add supply chain items: a dependency inventory and supplier tiers.
- Report progress to the executive team each quarter.
- Refresh the profile once a year.
Quick check
Is the NIST CSF a certification?
No. It is voluntary guidance. You can state alignment, and some customers or regulators reference it, but there is no CSF certificate.
What is new in CSF 2.0?
It adds the Govern function and widens the audience beyond critical infrastructure. It also gives more attention to supply chain risk management.
Sources
Last reviewed: 18 October 2026.
