NIST CSF 2.0 can organize a first year roadmap by acting as a filing system: group each planned task under a function, start with governance and asset visibility, then add protection, detection, response and recovery work across the quarters. It is a structure for your plan, not a certification.
What CSF 2.0 is and is not
NIST describes the Cybersecurity Framework as helping organizations understand and improve their management of cybersecurity risk. CSF 2.0 adds a Govern function (confirmed in CIS's note about aligning its own controls to it), alongside the existing functions. NIST also publishes Quick Start Guides and sample Profiles.
Nothing in CSF is a certification you earn. Companies use it to describe their current state, set a target state and track the gap. Do not say you are "CSF compliant" unless you can state exactly what that means, because the framework does not define a pass mark.
Mapping quarters to functions
| Quarter | Main focus | CSF function it feeds |
|---|---|---|
| 1 | Owner, inventory, access baseline | Govern, Identify, Protect |
| 2 | Scanning in CI, fix routine | Identify, Protect |
| 3 | Incident exercise, vendor basics | Respond, Govern |
| 4 | Continuous checks, review | Detect, Recover, Govern |
The mapping is loose on purpose. A single task, like an incident exercise, touches several functions.
A lightweight way to use it
- List your current practices in one column.
- Place each under a function in a second column.
- Mark gaps. Functions with nothing under them are visible at once.
- Pick a target profile in plain words for the end of the year, such as "we can detect and respond to a credential compromise within our own business hours."
- Choose one gap per quarter to close.
This takes an afternoon and gives the roadmap a skeleton leadership can read.
Why start with Govern
Governance is where small companies are weakest. A named owner, written priorities, and a place where risk decisions are recorded matter more than the next tool. The CISA performance goals make a similar point by pairing asset inventory with a named accountable leader at the head of their list.
Try it yourself
This demo shows how findings and evidence can be mapped to compliance frameworks. Click through a mapping and look at how one control answers more than one framework's requirement.
Click through it at your own pace, or open it full screen.
Pitfalls
- Treating each subcategory as a to do item. The framework is outcome based, so pick outcomes that matter for your risks.
- Spending a quarter on the mapping itself. Aim for a half day.
- Reporting percentage coverage without a stated method.
Safeguard's compliance and evidence automation maps evidence to frameworks, which helps once you decide which ones matter to your buyers. A free scan is an easy first step.
Quick check
Can a company be certified against NIST CSF?
CSF is a framework for managing risk, not a certification scheme. Describe your profile and gaps, not a pass or fail.
Do we need CSF if we already follow another framework?
Not necessarily. Use whichever your buyers recognize, since many frameworks overlap.
Sources
- NIST Cybersecurity Framework
- CIS Critical Security Controls v8.1
- CISA Cybersecurity Performance Goals (archived page that points to a newer version)
Last reviewed: 19 October 2026.
