Compliance / NIST CSF 2.0
Measure your program against the framework everyone recognizes.
The NIST Cybersecurity Framework is voluntary, but it has become the common language of cybersecurity in the United States. Boards, regulators, cyber insurers and customers often ask how an organization measures up against it.
Version 2.0, released in February 2024, added a sixth function, Govern, and broadened the framework to organizations of every size and sector. We use it to give leadership a clear, defensible picture of where the program stands and where it should go next.
At a glance
- Published by
- National Institute of Standards and Technology
- Current version
- CSF 2.0, February 2024
- Functions
- Govern, Identify, Protect, Detect, Respond and Recover
- Status
- Voluntary, and widely referenced by regulators and insurers
NIST CSF 2.0
Current profile, target profile, roadmap
The framework works best as a planning tool. We document your current profile, agree on a target profile that fits your risk and budget, and turn the difference into a roadmap leadership can fund and track.
Because CSF 2.0 maps to most other frameworks, the same assessment helps with HIPAA, PCI DSS, CMMC and ISO 27001 work. Texas state agencies will also recognize it as the basis of the Texas Cybersecurity Framework.
How we help
Maturity assessment
An honest baseline across all six functions.
- Current profile across all six functions
- Tier assessment
- Benchmarking for leadership
Target profile and roadmap
Decide where you want to be and how to get there.
- Target profile based on risk and obligations
- Gap analysis
- Prioritized roadmap with cost ranges
Governance
The new Govern function, put into practice.
- Cybersecurity risk management strategy
- Roles, responsibilities and authorities
- Policy framework
- Supply chain risk management
- Board reporting
Progress tracking
Show improvement over time.
- Annual reassessment
- Metrics for leadership
- Updates as the business changes
Services that support this work
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
- Managed Detection & ResponseSecurity monitoring, detection engineering and threat hunting focused on real threats rather than alert volume.
- Incident Response & Digital ForensicsContain active incidents, find out what happened and recover with evidence you can stand behind.
FAQ
Frequently asked questions
Is the NIST CSF required?
For most private companies it is voluntary. Some public sector bodies, regulators and contracts reference it, and many cyber insurers and boards use it as a yardstick, which makes it a sensible default even when nobody requires it.
What changed in CSF 2.0?
The biggest change is the new Govern function, which covers strategy, roles, policy and supply chain risk. Version 2.0 also made the framework explicitly applicable to organizations of all sizes and added implementation examples and quick-start guides.
Find out where you stand on NIST CSF 2.0.
A readiness review shows what an assessor would find today and what it will take to close the gaps.