NIST Cybersecurity Framework (CSF) 2.0: Core Functions

The CSF core presents a structured set of cybersecurity outcomes organized into functions, categories, and subcategories, covering governance, identify, protect, detect, respond, and recover.

Governance in the csf 2.0 establishes the organization's cybersecurity strategy, policies, roles, and oversight to manage risks, including supply chain, and align with enterprise risk management and stakeholder expectations.

Identify function assesses cybersecurity risks by cataloging assets, suppliers, and their risks. It prioritizes resources per risk, aligns with risk management and governance, and reveals improvement opportunities across policies.

Implement safeguards to manage risks and protect assets. Include identity management, authentication and access control, data security with encryption and DLP, platform security, and backups for disaster recovery testing.

Detect potential cybersecurity attacks and compromises promptly by analyzing anomalies and indicators of compromise to enable rapid, coordinated incident response and recovery.

Contain the effects of detected cybersecurity incidents by analyzing their nature, scope, and root cause, while mitigating impacts, reporting details, and communicating with internal teams and stakeholders.

Restore assets and operations under the NIST Cybersecurity Framework Recover RC function, prevent recurrence, and communicate recovery to stakeholders to minimize long-term impacts on operations and reputation.

Explore how the NIST CSF core weaves identify, protect, detect, respond, and recover into a governance-driven wheel guiding asset protection across ICT, IoT, OT, cloud, mobile, and artificial intelligence systems.

Csf profiles describe an organization's current and target cybersecurity posture to tailor, assess, prioritize, and communicate security efforts. Use scoping, gap analysis, and action planning to improve continually.

Organizations use the CSF tiers to guide current and target profiles, moving from partial to adaptive risk governance and management practices.

Explore online resources that supplement the NIST cybersecurity framework CSF 2.0 core, including informative references, implementation examples, and quick start guides in machine readable formats.

Leverage the NIST CSF 2.0 core to align governance, risk appetite, and stakeholder expectations. Prioritize actions and expenditures, using risk-handling options like mitigating or transferring negative risks.

Improve risk management communication within the csf 2.0 core by enabling bidirectional information flow among executives, managers, and practitioners. Build and update risk-informed organizational profiles and governance with risk registers.

Apply the NIST CSF 2.0 to a retail model, using Greenleaf Retailers to identify assets, protect data, detect threats, respond, and recover, aligning risk with business objectives.

Explore the CSF 2.0 core, detailing six functions—governance, identify, protect, detect, respond, recover—along with categories, subcategories, and practical implementation via the CSF 2.0 reference tool.

CSF 2.0 core introduces governance-driven realignments from CSF 1.1, adds improvement Idim, and expands platform security and technology infrastructure resilience, reorganizing identify, protect, detect, respond, and recover for deeper integration.

Explore the governance function of the NIST CSF 2.0, detailing how organizational context, risk management strategy, roles and responsibilities, policy, oversight, and supply chain risk shape cybersecurity risk management.

Align your cybersecurity risk management with the organization's mission and stakeholder expectations under CSF 2.0 governance, considering dependencies, legal and regulatory requirements, and critical services.

Align cybersecurity risk management with the organizational mission to safeguard core objectives, prioritize risks, and communicate purpose to stakeholders for resilient operations.

Identify and balance internal and external stakeholders' needs and expectations for cybersecurity risk management to align strategy with confidentiality, integrity, availability, resilience, privacy, compliance, and ethics.

Establish a process to track and manage legal, regulatory, and contractual cybersecurity requirements, including HIPAA, GDPR, CCPA, and privacy and civil liberties obligations.

Identify and communicate the critical objectives, capabilities, and services stakeholders rely on, establish criteria for criticality, perform a business impact analysis, and set resilience and recovery time objectives.

Identify and map organizational dependencies on external resources, then communicate outcomes and services to stakeholders. Document potential failure points and plan mitigations.

Explain the csf 2.0 risk management strategy within the gv governance function, detailing establishing objectives, risk appetite and tolerance, integrating with enterprise risk management, and communicating strategic risk responses.

Establish and agree on organizational risk management objectives with stakeholders to guide cybersecurity risk management strategy, and measure progress with near-term and long-term objectives including training.

Establish and communicate risk appetite and risk tolerance statements to guide cybersecurity risk management, translating appetite into measurable tolerance and refining objectives as risk landscapes evolve.

Integrate cybersecurity risk management into enterprise risk management by aggregating, assessing, and prioritizing cybersecurity risks with other risks; include cybersecurity risk managers and clear escalation thresholds for timely action.

Establish and communicate a strategic direction for risk response options aligned with the risk management strategy, including criteria for accepting and avoiding risk across data classifications and cybersecurity insurance.

Establish and maintain organization-wide lines of communication for cybersecurity risks, including suppliers and third parties, with regular briefings to senior leadership and cross-departmental updates.

Establish a standardized method for calculating and prioritizing cybersecurity risks. Define quantitative criteria for probability and impact, use risk registers, and apply consistent risk categories for organization-wide risk management.

Identify and integrate strategic opportunities or positive risks into cybersecurity risk discussions using swot analysis, guiding growth, stretch goals, and prioritized risk decisions for Greenleaf retailers.

Identify, manage, and monitor cyber supply chain risks by establishing a cybersecurity supply chain risk management program with strategy, objectives, policies, and processes agreed by stakeholders.

Establish a comprehensive cybersecurity supply chain risk management program with a strategy, objectives, policies, and processes agreed by organizational stakeholders, enabling cross-functional collaboration and supplier security oversight.

Establish and communicate cybersecurity roles and responsibilities for suppliers, customers, and partners, then document them and create supply chain responsibility matrices to ensure coordinated risk management.

Integrate cybersecurity supply chain risk management into cybersecurity and enterprise risk management, risk assessment, and improvement processes, aligning vendor risk assessments and escalating significant risks to senior management.

Identify and prioritize Greenleaf retailers' suppliers by their criticality to operations, using data sensitivity, access level, and mission impact to guide cybersecurity risk management.

Establish, prioritize, and integrate supplier and third-party cybersecurity requirements into contracts to manage supply chain risks, including disclosures of cybersecurity features and vulnerabilities, inventory of components, and ISO 27,001 compliance.

Plan and perform due diligence to reduce risk in supplier and third-party relationships, evaluating cybersecurity capabilities, risk management, and product integrity.

Manage supplier and third-party risks through ongoing assessment, contractual security requirements, and transparent disclosures, with slas, audits, and monitoring to protect data, systems, and supply chains.

Explore how relevant suppliers and third parties integrate into incident planning, response and recovery, with defined roles, reporting protocols, exercises, and joint lessons learned to boost resilience.

Integrate supply chain security practices into cybersecurity and enterprise risk management, maintain provenance records for acquired products, report risks to leadership, and ensure upgrades and patches come from approved providers.

Implement post-partnership cyber supply chain risk plans that terminate access, dispose assets securely, and mitigate data leakage while transitioning services with resilient security for supplier handoffs.

Define and communicate cybersecurity roles, responsibilities, and authorities to drive accountability and continuous improvement, while leadership allocates resources and embeds security into human resources practices like screening and onboarding.

Organizational leadership bears responsibility and accountability for cybersecurity risk, fostering a risk-aware, ethical culture and guiding governance, strategy, and annual or post-event reviews for continuous improvement.

Define and enforce cybersecurity roles, responsibilities, and authorities through policy, personnel descriptions, and performance goals, ensuring clear accountability across board, leadership, IT security, HR, legal, operations, and internal audit.

Allocate resources commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies; support with periodic management reviews to ensure authority aligns with responsibilities and risk tolerance.

Integrate cybersecurity into human resources practices by embedding cybersecurity risk management into screening, onboarding, change notification, and offboarding, and prioritize cybersecurity knowledge through hiring preferences, training, and access control alignment.