NIST CSF 2.0 is a voluntary framework with six functions: Govern, Identify, Protect, Detect, Respond and Recover. A first security hire can use it as a map. Describe where the company is, choose where it needs to be, and show the gap on one page.
What changed in CSF 2.0?
NIST released version 2.0 on 26 February 2024. It widened the audience from critical infrastructure to organizations of any size and sector, added a Govern function, and increased attention to supply chains. NIST also published quick start guides for specific audiences, implementation examples and a searchable catalog of informative references that links the framework to more than 50 other documents.
Govern is the piece that suits your situation. It covers how the organization makes and carries out decisions on cybersecurity strategy, and treats cyber risk as an enterprise risk next to finance and reputation.
Why not start with the controls list?
Because the framework is not a controls list. It is an outcomes vocabulary. NIST describes the functions as together giving a view of the life cycle of managing cybersecurity risk. You choose which outcomes matter, which is why it works for a twenty person startup and for a bank.
How do I build a first profile?
A profile is simply a description of current and target outcomes. Here is a constructed example for a 60 person software company.
Govern: Current, no named owner for cyber risk and no written policy. Target, the CEO owns risk, a one page policy exists and is reviewed yearly.
Identify: Current, no list of systems and suppliers. Target, a maintained inventory covering production, source control and key vendors.
Protect: Current, MFA on some systems. Target, MFA on everything that holds code, data or admin rights.
Detect: Current, logs exist but nobody looks. Target, alerts on privileged actions in cloud and CI, with an owner.
Respond: Current, an outage chat channel. Target, a written incident plan, tested twice a year.
Recover: Current, backups never restored. Target, a restore test every quarter.
That is a page. Executives can read it in two minutes and argue about priorities, which is the point.
How do I pick priorities?
Rank gaps by likely harm and effort. Early wins are often in Identify and Protect, because you cannot defend what you cannot list and MFA is cheap. Govern gaps are quick to close, and they unlock the budget for the rest.
Include software supply chain in Identify. A dependency inventory shows what open source you run. Safeguard generates SBOMs and scans dependencies with reachability analysis, which helps you rank vulnerabilities by whether your code can actually reach them. The free browser scan at gold.safeguard.sh/scan covers up to 100 dependencies.
What to do
- Read NIST's quick start guide that matches your organization.
- Write current and target outcomes for each of the six functions on one page.
- Name an owner for each function, starting with Govern.
- Pick three gaps for the next quarter and set dates.
- Show the profile to management and agree the targets.
- Update the profile every quarter and keep the old versions.
Quick check
Is NIST CSF a certification?
No. It is a voluntary framework. Organizations use it to assess and communicate their cybersecurity outcomes, not to earn a certificate.
Do I need to cover every CSF outcome?
No. You choose the outcomes that fit your risks and set a target profile. The framework is meant to be tailored.
Sources
Last reviewed: 18 October 2026.
