Accelerate and simplify NIST CSF alignment.

The NIST Cybersecurity Framework (CSF) is a guide published by the US government that helps organisations of any size manage the risk of cyber attacks and data breaches. Think of it as a structured checklist that covers everything from understanding what you need to protect, to what you should do if something goes wrong. It was created in response to growing cyber threats to businesses and critical services and is now used by organisations worldwide as a common language for cybersecurity. The latest version (CSF 2.0) was released in 2024 and places particular emphasis on leadership accountability and business strategy, not just IT.

NIST CSF 2.0 is a major revision of the Cybersecurity Framework originally released in 2014. The most significant change is the addition of a sixth function, Govern, which sits above the original five (Identify, Protect, Detect, Respond, Recover) and addresses organisational context, roles, policies, and supply chain risk strategy. CSF 2.0 also broadens the framework's scope beyond critical infrastructure to all organisations, introduces tiered implementation guidance, and places stronger emphasis on cybersecurity governance and supply chain risk management.

NIST CSF 2.0 organises cybersecurity activities into six functions:

Govern (establishing and monitoring cybersecurity risk strategy, policies, and roles)

Identify (understand assets, risks, and vulnerabilities)

Protect (implement safeguards to prevent or reduce the impact of incidents)

Detect (discover cybersecurity events in a timely manner)

Respond (take action when an incident is detected)

Recover (restore capabilities impaired by an incident).

Each function is broken down into categories and subcategories that map to specific security outcomes.

NIST CSF 2.0 defines four tiers that describe how rigorous an organisation’s cyber risk governance and management practices are:

1. Partial. Ad hoc and reactive, with limited awareness of cyber risk

2. Risk Informed. Risk is understood and managed, but not consistently across the organisation

3. Repeatable. Formally approved policies applied consistently, and regularly updated

4. Adaptive. Practices continuously improve based on lessons learned and changing threats

NIST is clear that these aren’t maturity levels or a scorecard you must climb. Tier 4 isn’t the goal for everyone, and you choose the tier that fits your risk and budget.

Many organisations treat tiers as a maturity benchmark, and many go further, scoring each subcategory on a 0–5 maturity scale to build their Current and Target Profiles.

NIST CSF 2.0 is a voluntary framework. It is not legally mandated in the UK or EU. However, it is widely recognised as a mark of good practice and is increasingly referenced by regulators, insurers, and procurement teams. UK businesses subject to the FCA's operational resilience rules or the ICO's data protection requirements will find significant overlap between NIST CSF 2.0 and those obligations. EU businesses subject to DORA or NIS2 will similarly find that aligning with CSF 2.0 helps satisfy many of those requirements. Adopting the framework voluntarily can therefore support multiple compliance programmes simultaneously as well as provide reassurance to customers, suppliers, and partners.

Cyber insurers are increasingly asking for evidence of NIST CSF alignment (and other frameworks) as a benchmark to assess how well a business manages its cyber risk and to set premiums accordingly. Organisations that can demonstrate alignment with CSF 2.0, particularly around governance, access controls, incident response planning, and backup procedures, are generally seen as lower-risk by underwriters. Some insurers now explicitly ask about CSF maturity as part of the application process. CyberKainos offer a cyber insurance assessment service to help organisations keep their premiums as low and their cover as comprehensive as possible.

NIST CSF 2.0 is designed as a meta-framework that can be mapped to other standards. NIST publishes official crosswalks between CSF 2.0 and ISO/IEC 27001:2022 and others via the CSF 2.0 Reference Tool. Many controls in CSF 2.0 align directly with SOC 2 Trust Service Criteria, particularly around access control, monitoring, and incident response. For DORA, CSF 2.0's Govern and Identify functions map closely to DORA's ICT risk management requirements, while Respond and Recover align with DORA's incident reporting and operational resilience obligations.