NIST Cybersecurity Framework (CSF) 2.0 compliance software
Assess the 106 outcomes of NIST CSF 2.0 as a Current Profile against your Target Profile, and see what your SP 800-53 controls already evidence.
- Issuing bodyNIST, CSWP 29 (26 February 2024)
- Core6 Functions, 22 Categories, 106 Subcategories
- ProfilesCurrent Profile and Target Profile
- TiersPartial, Risk Informed, Repeatable, Adaptive
What NIST CSF 2.0 requires
Who it applies to
- Organisations of any size or sector adopting a recognised cybersecurity outcome framework
- U.S. critical infrastructure operators and their suppliers
- Boards and executives who need one cybersecurity posture view across programmes
- Organisations already running NIST SP 800-53, ISO/IEC 27001 or SOC 2 controls
The NIST Cybersecurity Framework 2.0 (CSWP 29, February 2024) organises cybersecurity into six Functions — Govern, Identify, Protect, Detect, Respond and Recover — with 22 Categories and 106 Subcategory outcomes. Govern is new in 2.0 and sets direction for the other five.
CSF describes outcomes, not controls: it says what should be true and leaves how to the organisation. Organisations describe where they are (a Current Profile) and where they intend to be (a Target Profile), and the gap is the plan. Tiers — Partial, Risk Informed, Repeatable, Adaptive — characterise how rigorous their risk governance and management are.
CSF and NIST SP 800-53 answer different questions and are assessed separately in GRCLens: CSF is the outcome view a board reads, 800-53 the control catalogue a system implements. Each CSF outcome lists the 800-53 controls that go towards it, so 800-53 work already done becomes a starting point for the CSF rating.
How GRCLens supports NIST CSF 2.0
NIST CSF 2.0 runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Current vs Target Profile
Rate every outcome, set a target per category, and see the gap by Function and Category with the largest gaps first.
Tiers declared and indicated
Record the organisation's current and target Tier, and see the Tier the rated outcomes indicate for governance and management beside them.
SP 800-53 crosswalk
Each outcome lists its SP 800-53 Rev 5 controls; status from the 800-53 module is shown as evidence, with a suggestion you confirm or reject.
Owners, KRIs and reports
Assign category owners, track key risk indicators tied to outcomes, and export a Word report of the profile and the gaps.
NIST CSF 2.0 frequently asked questions
Is NIST CSF 2.0 mandatory?
No. CSF is voluntary and risk-based, and it does not certify anything. It is widely adopted because regulators, customers and boards recognise its outcomes, and several sector rules reference it.
How is CSF different from NIST SP 800-53?
CSF lists 106 outcomes an organisation should achieve; SP 800-53 is a catalogue of over a thousand controls and enhancements that achieve them. GRCLens assesses them separately and joins them with a crosswalk.
What changed from CSF 1.1?
CSF 2.0 added the Govern Function, broadened the scope from critical infrastructure to all organisations, reorganised several categories (supply chain risk moved into Govern) and reduced the Core from 108 to 106 outcomes.
What are CSF Tiers?
Tiers 1 to 4 — Partial, Risk Informed, Repeatable, Adaptive — describe how rigorous an organisation's cybersecurity risk governance and management practices are. They are not a certification level.
One platform, many obligations
Talk to us about NIST CSF 2.0
Security Solution Consultants provides NIST framework advisory services alongside the platform, so you can combine tooling with hands-on expertise.