For engineers, NIST CSF 2.0 turns into a short list of checks: know your assets, enforce strong identity, protect data, keep platforms patched and configured, build resilience, monitor continuously and rehearse response and recovery. The framework lists outcomes, not tools, so each check below is a way to produce proof for an outcome category, not a NIST requirement.
How is CSF 2.0 organised?
NIST's document groups outcomes into six functions, each with categories. Govern covers context, strategy, roles, policy, oversight and supply chain risk. Identify covers asset management (ID.AM), risk assessment (ID.RA) and improvement (ID.IM). Protect covers identity management, authentication and access control (PR.AA), awareness and training (PR.AT), data security (PR.DS), platform security (PR.PS) and technology infrastructure resilience (PR.IR). Detect covers continuous monitoring (DE.CM) and adverse event analysis (DE.AE). Respond covers incident management, analysis, reporting and mitigation. Recover covers recovery plan execution and communication.
NIST says the CSF does not prescribe how outcomes should be achieved and links to resources that provide guidance on practices and controls. Choose your own implementations and be ready to show them.
The checklist by category
ID.AM, asset management. Keep a living inventory of hardware, software, services, data stores and cloud accounts. Generate it from sources such as cloud APIs, device management and a software bill of materials, not by hand. Tag owner and criticality. Test: pick five random cloud resources and confirm each is in the inventory.
ID.RA, risk assessment. Run vulnerability scanning on code, dependencies, containers and infrastructure. Record findings with severity, exploitability and owner, and track remediation time. Prioritise vulnerabilities that are actually reachable in your code. Test: show the age of your oldest high severity finding and why it is still open.
PR.AA, identity and access. Central identity provider, multi factor authentication for all users and stronger methods for administrators, least privilege roles, no shared accounts, automatic removal on departure and periodic access reviews. Test: compare the leaver list to active accounts.
PR.DS, data security. Encrypt data in transit and at rest, manage keys separately, classify sensitive data, mask data in non production and control exports. Test: scan a staging database for real personal data.
PR.PS, platform security. Hardened baselines as code, patch within defined timeframes, signed and reviewed builds, secrets kept out of repositories, and dependency controls that block known malicious or vulnerable packages. Test: attempt to deploy without review and confirm the pipeline stops it.
PR.IR, infrastructure resilience. Backups protected from deletion by compromised accounts, tested restores, redundancy matched to recovery objectives and network segmentation. Test: restore a backup into a clean environment and time it.
DE.CM, continuous monitoring. Central logs from identity, cloud control plane, endpoints, applications and network; alerts routed to a person; coverage checks that every account and region sends logs. Test: trigger a harmless alert and see who gets paged.
DE.AE, adverse event analysis. Triage guidelines, severity definitions and a record of reviewed events and outcomes. Test: show last month's triage notes.
RS, respond. An incident plan with roles, a tabletop at least yearly, evidence preservation steps, communication templates and a record of lessons learned.
RC, recover. Recovery plans per critical service, restore tests, and customer and regulator communication steps.
GV.SC, supply chain. A register of suppliers and open source components, risk ratings for critical ones and a process for reviewing new ones before adoption.
What evidence do you keep?
Exports with timestamps beat screenshots: inventory exports, identity provider settings, scanner reports, pipeline configuration, backup and restore logs, alert samples, tabletop notes and supplier register. Store them by function and category so a reviewer can follow the Profile.
What mistakes are common?
- Tooling bought before the inventory exists.
- Multi factor authentication enabled for staff but not for service accounts or break glass access.
- Logs collected, nothing alerting.
- Backups in the same account as production.
- Scanning without owners or deadlines, creating a pile instead of a process.
- Counting policies as proof of operation.
What to do
- Generate the asset inventory from systems and review it monthly.
- Enforce multi factor authentication and least privilege, and review access quarterly.
- Add vulnerability and dependency scanning to the pipeline with owners and deadlines.
- Encrypt data, separate keys and test staging data for leaks.
- Protect backups from deletion and test a restore.
- Centralise logs, alert on the important ones and test the alert path.
- Run a tabletop and a recovery test each year.
- Export evidence by category into one shared folder structure.
Quick check
Does CSF 2.0 require specific technical tools?
No. NIST describes outcomes and points to resources for practices and controls. You choose the implementation and show proof for each outcome.
Which function is new in CSF 2.0?
Govern, which covers organisational context, risk management strategy, roles, policy, oversight and supply chain risk management.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29, 26 February 2024: functions and categories.
How Safeguard helps automate this
Many of these checks end as evidence to export. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of screenshots, and monitoring runs continuously between reviews. For identification and platform hygiene, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. The remediation agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps you prepare and keep evidence ready, and the CSF itself has no certificate to earn. Book a call.
Last reviewed: 18 October 2026.
