NIST CSF Compliance

NIST CSF 2.0 introduced a sixth Function alongside the original five. The six Functions are: Govern (establish and monitor cybersecurity risk strategy, policy, and accountability), Identify (understand your assets and risks), Protect (implement safeguards), Detect (identify cybersecurity events), Respond (contain and manage incidents), and Recover (restore capabilities after an incident). Govern is the new addition in version 2.0, recognizing that executive leadership and board accountability are foundational to effective security.

NIST CSF is a voluntary framework developed by the US National Institute of Standards and Technology. However, it is widely recognized globally and used by EU organizations as a structured approach to risk-based security management. For EU organizations, NIS2 and DORA impose mandatory requirements - and NIST CSF maps closely to both, making it a practical implementation vehicle for achieving NIS2 and DORA compliance.

The most significant change in CSF 2.0 is the addition of the Govern Function, which centralizes cybersecurity governance, policy, roles, and risk management strategy. Version 2.0 also broadened the target audience beyond critical infrastructure to all organizations regardless of size or sector, enhanced supply chain risk management guidance, added implementation examples for each subcategory, and introduced Community Profiles for sector-specific guidance.

NIST CSF 2.0 uses Implementation Tiers (1 through 4) to describe the degree to which an organization's cybersecurity risk management practices are integrated and adaptive. Tier 1 (Partial) means ad-hoc, reactive practices. Tier 4 (Adaptive) means continuous improvement informed by lessons learned and predictive indicators. We assess your current tier through document review, technical interviews, and control testing, then build a roadmap to your target tier.