NIST CSF 2.0 is a framework, not a certification, so nothing expires and nobody passes. You keep it current by refreshing your Current Profile on a schedule, comparing it to your Target Profile, acting on the gaps, and feeding lessons from incidents and tests into the Improvement category (ID.IM).
What are you maintaining?
CSF 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST's own document describes Profiles as the way to use it. A Current Profile records the outcomes you achieve now. A Target Profile records the outcomes you selected and prioritised. You analyse the gaps between the two and write an action plan, then repeat.
The document also describes Tiers. They reflect how you manage cybersecurity risk, from Partial (Tier 1) through Risk Informed, Repeatable and Adaptive (Tier 4). NIST says they characterise the rigor of your risk governance and management practices and that you can choose to use them to inform your Profiles.
What does ongoing monitoring mean here?
Two parts of the framework do the work after the first assessment.
DE.CM, Continuous Monitoring. Assets are monitored for anomalies, indicators of compromise and other potentially adverse events. The listed outcomes cover networks and network services, the physical environment, personnel activity and technology use, external service provider activity, and computing hardware, software, runtime environments and their data. A good first pass is to ask, for each of those, who looks at what, how often, and where the result is written down.
ID.IM, Improvement. Improvements are identified from evaluations, from security tests and exercises, from operational processes, and from incident response plans that are kept current. This is the loop that keeps the profile honest. Every incident review, tabletop exercise and audit should produce changes to the Target Profile or the action plan.
A year in the life of a profile
Quarter 1: refresh the Current Profile. For each outcome you selected, mark it achieved, partly or not, with a pointer to evidence. Compare with last year and note why anything moved.
Quarter 2: test. Run an exercise or a technical test. Record findings against ID.IM outcomes.
Quarter 3: review monitoring coverage. Walk through DE.CM. Did a new cloud account, vendor or business unit appear that nobody watches?
Quarter 4: update the Target Profile and the Tier view. Decide what to prioritise next year, and brief leadership. Governance outcomes belong in this conversation too.
What evidence shows the program is alive?
Keep three things per cycle: the dated Current Profile, the gap analysis with its action plan, and the minutes of the leadership review that decided priorities. NIST describes communicating Profiles to stakeholders, and a customer who asks about your alignment is best served by those documents, not a slide. Store old versions, so you can show how outcomes moved over time and which actions closed which gaps.
What triggers an off cycle update?
New products or regions, a merger, a major supplier change, a significant incident, a new legal requirement or a customer request for alignment. Write the list down so the trigger does not depend on memory.
Mistakes to avoid
- Treating the first Profile as permanent.
- Measuring Tiers as a goal. Use them to describe, not to score.
- Monitoring with no owner for the alerts.
- Letting improvement actions go untracked.
What to do
- Pick the outcomes in scope and write your Target Profile.
- Record the Current Profile with an evidence link per outcome.
- Turn each gap into an action with an owner and a date.
- Map DE.CM outcomes to specific tools and review owners.
- Add an ID.IM step to every incident review and exercise.
- Calendar the quarterly rhythm above and keep dated copies of each Profile.
Quick check
Can we be certified against CSF 2.0?
NIST publishes the framework and its resources, not a certification. Customers may accept your Profile and evidence as alignment.
What is the difference between a Profile and a Tier?
A Profile lists outcomes, current or target. A Tier describes how rigorously you manage cybersecurity risk, from Partial to Adaptive.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, which fits a framework whose upkeep is a regular cycle. Evidence is collected from connected systems and code instead of screenshots, so the Current Profile can be refreshed from data. Technical evidence from scans, SBOMs and reachability comes from your real software. Autonomous remediation can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare and keep evidence ready and does not certify you. See the framework mapping demo.
Sources
- NIST, Cybersecurity Framework 2.0 (NIST CSWP 29), downloaded and read 18 October 2026.
- NIST, Cybersecurity Framework resources, fetched 18 October 2026.
Last reviewed: 18 October 2026.
