NIST CSF 2.0 (Cybersecurity Framework) is the voluntary US framework for managing cybersecurity risk, published by the National Institute of Standards and Technology. Version 2.0 was released February 26, 2024 and reorganized the core into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern is new in 2.0.
What changed between NIST CSF 1.1 and 2.0?
Version 2.0 added a new top-level Govern function that pulls cybersecurity policy, roles, oversight, and supply-chain risk out of Identify.
The 2024 release also expanded scope beyond critical infrastructure to all organizations, added implementation examples, and shipped a public Reference Tool for mapping informative references (NIST CSWP 29).
How does NIST CSF relate to NIST 800-171 and CMMC?
CSF is a strategy framework. NIST 800-171 is a control catalog for Controlled Unclassified Information. CMMC certifies contractors against 800-171.
Most teams treat NIST CSF as the org-wide map and NIST 800-171 plus CMMC as the implementation track for any line of business that touches DoD contracts.
Why does NIST CSF show up in security questionnaires?
Buyers ask for CSF mapping because it is a common denominator across regulators, sector frameworks, and internal risk committees.
The 2025 SIG added refreshed CSF 2.0 mappings, and the HITRUST CSF and ISO 27001 control sets ship with NIST CSF crosswalks. We see most teams over-invest in writing a fresh CSF profile and under-invest in keeping the mapping current after any control change.
Related terms
These neighbors describe the framework's audit cousins and the standards CSF 2.0 most often gets crosswalked against in vendor reviews.
- NIST 800-171 - the control catalog for non-federal systems handling Controlled Unclassified Information
- CMMC - the DoD audit program that certifies contractors against 800-171
- ISO 27001 - the international ISMS standard most commonly mapped against CSF
- TPRM - the third-party risk practice CSF 2.0's Govern function pulls into scope