NIST CSF 2.0 is a framework of outcomes, not a certification, so there is no CSF audit that grants a pass. Customers, insurers and assessors still ask for proof. Prepare a Current Profile, a Target Profile, a prioritised gap plan and evidence for each outcome you claim, then let the assessor test your claims.
Who assesses you against the CSF?
NIST's own document says the CSF offers a taxonomy of high level outcomes that any organisation can use to understand, assess, prioritise and communicate its cybersecurity efforts, and that it does not prescribe how to achieve them. It is published free of charge, and NIST does not run a certification scheme in it.
So when someone says "we need a CSF assessment", find out who is asking and what they mean. It could be a customer questionnaire, a maturity assessment from a consultancy, a board request or a regulator or contract requiring alignment. Each wants a different artefact. Ask for the format before you build anything.
What is the evidence model?
CSF 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new in 2.0 and covers organisational context, risk management strategy, roles, policy, oversight and supply chain risk management. Each function has categories with identifiers such as GV.OC, ID.AM, PR.AA, DE.CM and RS.MA.
NIST describes Organizational Profiles as the way to describe current and or target posture in terms of Core outcomes. The five steps in the document are to scope the profile, gather information, create it, analyse gaps and make an action plan, and implement and update. Tiers, from Partial (Tier 1) to Adaptive (Tier 4), characterise the rigor of governance and risk management practices. They are not a score that you must raise, and Tier 4 is not a goal for every organisation.
An assessor reading your package wants to see this chain: scope, outcomes, current state with proof, target state, gaps and a plan with owners.
How do you build the package?
Scope. Pick the boundary: whole company, one product or one system. NIST notes you can have as many profiles as you like with different scopes.
Outcome list. Use the CSF 2.0 Core as a spreadsheet, with one row per subcategory you consider in scope. Mark each as achieved, partly achieved, not achieved or not applicable, with a short reason.
Evidence per row. Name a document, record or system export that shows the outcome. Examples: an asset inventory export for ID.AM, identity provider settings for PR.AA, alert samples and review notes for DE.CM, an incident record and post incident review for RS.MA, a restore test for RC.RP.
Policy and ownership. Govern outcomes are evidenced by approved policies, a risk strategy, named roles and records of leadership oversight.
Gaps and plan. For every row below target, record the risk, the fix, an owner and a date.
What do assessors usually test?
Assessors differ, so expect to be sampled rather than inspected end to end. They often ask for a few outcomes at random, request proof and interview the owner. They look for consistency: the policy says one thing, the logs show another, the interview reveals a third. Prepare owners to explain their rows in plain language.
What mistakes cost credibility?
- Claiming every outcome as achieved on day one. Honest gaps with plans read better than a perfect profile.
- Evidence that is a policy with no operating proof.
- Using Tiers as a maturity trophy.
- Skipping Govern. The 2.0 change put governance on equal footing with the other functions.
- Letting the profile go stale after the first assessment.
- Mapping to another framework and assuming the evidence is transferable without checking.
What to do
- Ask who wants the assessment and in what format.
- Define scope in one paragraph and get it approved.
- Create the Current Profile from the Core outcomes, with an honest status per row.
- Attach one piece of evidence per achieved outcome and store it in a single folder tree by function.
- Set a Target Profile based on risk, not on ambition.
- Write the gap plan with owners and dates.
- Run a mock review: pick ten rows at random and have an uninvolved colleague test them.
- Schedule a profile update at least yearly and after major changes.
Quick check
Can you be certified for NIST CSF 2.0?
The NIST document describes the CSF as a set of outcomes and resources, not a certification programme. Some third parties offer assessments or reports against it, so ask what the requester accepts.
What is a CSF Organizational Profile?
It describes an organisation's current and or target cybersecurity posture in terms of the Core outcomes, and it is the basis for gap analysis and action planning.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29, 26 February 2024: functions, categories, Organizational Profiles and Tiers.
How Safeguard helps automate this
The evidence column is where most CSF efforts stall. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence comes from connected systems and code instead of screenshots, and monitoring continues between assessments. That keeps your Current Profile truthful without a quarterly scramble. Technical evidence comes from your actual code and dependencies: scans, SBOMs and reachability. The remediation agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you decide which categories run automatically and with what approval level. Safeguard helps you prepare and keep evidence ready; the assessment itself is performed by whoever you or your customer choose. Book a call.
Last reviewed: 18 October 2026.
