NIST CSF 2.0 does not prescribe a document set, because it describes outcomes, not actions. A lean, defensible set is an Organizational Profile with current and target states, a scoping statement, a cybersecurity policy, a risk strategy, a roles table, registers for assets and suppliers, and plans for response and recovery.
What does CSF 2.0 say about documentation?
NIST published CSF 2.0 (CSWP 29) on February 26, 2024. It says the Core outcomes are not a checklist, and that the order of Functions and Categories does not imply sequence or importance. It also says the CSF does not prescribe how outcomes should be achieved. So there is no auditor's list, and no certification exists. What you need are documents that show, for each outcome you chose, what you do.
Which documents start the work?
NIST describes five steps to create and use an Organizational Profile: scope it, gather information, create it, analyze gaps and plan, then implement and update. Turn them into documents.
- Scoping statement: which business units, systems and assumptions the profile covers. Make more than one profile if you need to.
- Current Profile: the outcomes you achieve today.
- Target Profile: the outcomes you have selected and prioritized.
- Gap analysis and action plan, such as a risk register or detailed risk report.
You may also use the four Tiers, Partial, Risk Informed, Repeatable and Adaptive, to describe the rigor of your governance and management practices. They are optional.
What belongs under Govern?
GV has six categories: Organizational Context, Risk Management Strategy, Roles and Responsibilities, Policy, Oversight, and Supply Chain Risk Management. Matching documents: a one page context statement with mission and stakeholder expectations (GV.OC), a risk strategy with appetite and tolerance (GV.RM), a roles and authority table (GV.RR), the cybersecurity policy approved by leadership (GV.PO), a review record showing leadership looked at results (GV.OV), and a supplier risk procedure with a supplier register (GV.SC).
What belongs under Identify and Protect?
For ID: an asset inventory covering data, hardware, software, services and people (ID.AM), a risk assessment record (ID.RA), and an improvement log fed by incidents and reviews (ID.IM).
For PR: an access control standard and review records (PR.AA), a training plan and completion list (PR.AT), data security rules for classification, encryption and retention (PR.DS), baseline configuration and patching rules (PR.PS), and backup and resilience design notes (PR.IR).
What belongs under Detect, Respond and Recover?
DE: a monitoring standard stating what is logged and who reviews alerts (DE.CM), and an event analysis procedure (DE.AE).
RS: an incident response plan with roles, severity levels and communication rules (RS.MA, RS.CO), plus a template for analysis and mitigation records (RS.AN, RS.MI).
RC: a recovery plan with priorities and a communication plan for the recovery period (RC.RP, RC.CO), with test results.
CSF has 22 categories in total, so take the list above as a starting set and add documents only where a Target Profile outcome needs one.
How do you keep documents honest?
Write the procedure as it runs. Date every file, name an owner, and keep one sample of evidence per outcome, for example one access review or one exercise record. NIST notes that the Core links to outside resources for how to achieve outcomes, and the Informative References can point you to detailed controls from other standards.
What to do
- Write a scoping statement and decide how many profiles you need.
- Build the Current Profile by interviewing control owners, not by guessing.
- Choose the Target Profile based on risk and customer expectations.
- Write or update the policy, risk strategy and roles table for Govern.
- Build asset and supplier registers.
- Write short standards for access, data, platforms, monitoring, response and recovery.
- Attach one dated sample per outcome.
- Turn gaps into a prioritized action plan and review it quarterly.
Quick check
Can you be certified against CSF 2.0?
No. It is a voluntary framework, and you can describe your alignment through profiles, not a certificate.
Are Tiers required?
No. NIST says an organization can choose to use them to inform its profiles.
How Safeguard helps automate this
The profile helps when it stays current. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between reviews, saving the team time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability, which supports the Identify, Protect and Detect outcomes. The agent can open tested fix pull requests for vulnerable dependencies and other findings, but it is off by default, each category starts on Manual, and you choose which run automatically. Safeguard helps prepare evidence; it does not certify alignment. Book a call.
Sources
Last reviewed: 18 October 2026.
