NIST Cybersecurity Framework Explained

What is NIST Cybersecurity Framework? It is a free, voluntary structure for organizing a cybersecurity program, published by the U.S. National Institute of Standards and Technology. The current version, CSF 2.0, groups everything a security program does into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not tell you which products to buy or which settings to use.

What it gives you is a common language to describe what you do today, what you want to do, and the gap between the two, in a form that maps cleanly onto SOC 2, HIPAA, CMMC and ISO 27001. That is why a company of any size can use it, and why so many customer questionnaires are built around it. This is general information, not legal advice.

The NIST Cybersecurity Framework functions

CSF 2.0 has six functions, each broken into categories and then subcategories (specific outcomes such as “assets are inventoried” or “backups are tested”). The functions are not steps in a sequence; they run at the same time, and Govern wraps around the other five.

Govern

New in version 2.0. Govern covers organizational context, risk management strategy, roles and responsibilities, policy, oversight and cybersecurity supply chain risk management. In plain terms: someone is accountable, the company has decided how much risk it will accept, policies exist, leadership reviews results, and vendors are part of the picture. This function exists because the most common failure in smaller companies is not a missing tool but a missing owner.

Identify

Know what you have and what could go wrong. Categories: asset management (hardware, software, data, services, people), risk assessment, and improvement (learning from assessments, tests and incidents). An IT risk assessment is the core activity here.

Protect

The safeguards. Categories: identity management, authentication and access control; awareness and training; data security; platform security (hardening, configuration, patching, software integrity); and technology infrastructure resilience (backups, redundancy, capacity). Most of the fifteen controls that matter for a small business live in this function.

Detect

Find incidents quickly. Categories: continuous monitoring of networks, systems, people and vendors, and adverse event analysis, meaning the ability to tell a real incident from noise and understand what happened.

Respond

Act on a detected incident. Categories: incident management, incident analysis, incident response reporting and communication (including to customers, regulators and insurers), and incident mitigation (containing and eradicating the problem).

Recover

Get back to normal. Categories: recovery plan execution and recovery communication. The practical test is whether you have restored from backup recently and whether anyone would know what to say to customers while you did.

Tiers and profiles

The functions describe what to do. Two other pieces of the framework describe how well you do it and which parts matter to you.

Tiers

Tiers describe the rigor of your risk management practices, from Tier 1 to Tier 4.

Tier	Name	What it looks like
1	Partial	Security is ad hoc and reactive; risk is handled case by case; little awareness of supply chain risk
2	Risk Informed	Leadership approves practices but they are not organization-wide policy; risk is considered but inconsistently
3	Repeatable	Practices are formal policy, updated as risks change; the organization works with suppliers on risk
4	Adaptive	Practices improve continuously from lessons learned and predictive indicators; risk management is part of culture and decisions

Tiers are not maturity grades to chase. NIST is explicit that a higher tier is only worth the cost if your risk, regulatory environment or customers call for it. Many small companies are well served at Tier 2 or 3.

Profiles

An Organizational Profile is the framework applied to you: for each category or subcategory in scope, what you do today (the Current Profile) and what you intend to do (the Target Profile). The gap between them is your roadmap. NIST also publishes Community Profiles for particular sectors and use cases, which give you a starting target rather than a blank sheet.

The framework is published with Informative References that map each subcategory to specific controls in other standards, and with Quick Start Guides, including one for small business, on the NIST CSF site.

How the NIST CSF maps to SOC 2, HIPAA, CMMC and ISO 27001

The same control usually satisfies several frameworks. This high-level table shows where each CSF function lands in the others; use NIST’s official references for subcategory-level mapping.

CSF function	SOC 2 (Trust Services Criteria)	HIPAA Security Rule	CMMC (NIST SP 800-171 families)	ISO/IEC 27001
Govern	CC1 control environment, CC2 communication, CC3 risk assessment, CC9 risk mitigation and vendors	Security management process, assigned security responsibility, policies and procedures, business associate contracts	Policy and plan requirements across families; System Security Plan	Clauses 4 to 10: context, leadership, planning, support, performance evaluation, improvement
Identify	CC3 risk assessment, CC6.1 asset identification	Risk analysis, risk management, information system activity review	Risk Assessment (RA), Security Assessment (CA)	Risk assessment and treatment; asset management controls
Protect	CC5 control activities, CC6 logical and physical access, CC8 change management	Access control, workforce training, device and media controls, transmission security, encryption	Access Control (AC), Awareness and Training (AT), Identification and Authentication (IA), Configuration Management (CM), Media Protection (MP), Physical Protection (PE), System and Communications Protection (SC)	Access control, cryptography, physical, operations and communications controls
Detect	CC7.1 and CC7.2 monitoring and anomaly detection	Audit controls, information system activity review, security incident procedures	Audit and Accountability (AU), System and Information Integrity (SI)	Logging, monitoring and vulnerability management controls
Respond	CC7.3 and CC7.4 incident evaluation and response	Security incident procedures; Breach Notification Rule	Incident Response (IR)	Information security incident management controls
Recover	CC7.5 recovery; Availability criteria (A1)	Contingency plan: data backup, disaster recovery, emergency mode operation, testing	Incident Response (IR) recovery; backup protection (MP)	Business continuity and ICT readiness controls

Two practical consequences. If a customer sends you a questionnaire organized by CSF function, your SOC 2 or HIPAA work already answers most of it. And if you are starting from nothing, building your program on the CSF first means every later audit is a mapping exercise rather than a new project. Our SOC 2 readiness checklist shows what that mapping looks like from the other side.

Using the NIST CSF in a small company

You do not need a consultant to start, and you do not need to cover every subcategory. Five steps, each of which fits in a working session or two:

1. Set the scope. Decide what the profile covers: the whole company, or one product and the systems behind it. Write down who owns the exercise (Govern starts here).
2. Build the Current Profile. Go through the categories and score each one on a simple scale, for example 0 (nothing), 1 (informal), 2 (documented), 3 (documented and checked). Be honest; the profile is for you.
3. Choose the Target Profile. Pick targets based on what your customers, insurer, regulators and risk assessment actually require. Not everything needs to be a 3.
4. Turn the gaps into a plan. Each gap becomes an action with an owner and a quarter. Put the cheap, high-impact items first: MFA, backups, patching, an incident contact list, a vendor list.
5. Review on a schedule. Re-score quarterly or after any major change. The second profile is where the framework starts paying off, because you can show progress to a board, a customer or an insurer in one page.

A simple profile template looks like this:

Function	Category	Current (0 to 3)	Target (0 to 3)	Gap action	Owner
Govern	Policy	1	2	Write and approve the core policy set	Operations lead
Protect	Identity and access	1	3	Enforce MFA on email, VPN and admin accounts; quarterly access review	IT manager
Recover	Recovery plan execution	0	2	Document restore procedure; test a full restore	IT manager

A ten-person company might have twelve rows. A division of a larger group might have sixty and a corporate target profile handed to it. The method is the same.

Where PS3G fits

PS3G uses the NIST CSF as the backbone of its cybersecurity consulting work for organizations of every size: we build the Current and Target Profiles with you, run the risk assessment that feeds Identify, prioritize the gap plan, and help implement the controls in Protect, Detect, Respond and Recover. When the same work has to satisfy SOC 2, HIPAA, ISO 27001 or CMMC, our IT compliance consulting handles the mapping and the evidence, and we coordinate with your auditor or assessor. We prepare you for the assessment; the report or certificate comes from them.

Related reading

• Cybersecurity for Small Business: The 15 Controls That Matter Most
• IT Risk Assessment Template: How to Run One in a Week
• SOC 2 Readiness Checklist: What to Do Before You Call an Auditor
• Cybersecurity consulting and information security services

Frequently asked questions

Is the NIST Cybersecurity Framework mandatory?

No. It is voluntary for private companies. Federal agencies and some contractors are required to follow related NIST publications, and regulators and insurers in several sectors refer to the CSF as a benchmark, so it can become a practical requirement through contracts and questionnaires. Check the current requirements that apply to your industry and customers rather than assuming either way.

What changed in NIST CSF 2.0?

The biggest change was the addition of the Govern function, which pulls organizational context, risk strategy, roles, policy, oversight and supply chain risk into one place. The scope also widened from critical infrastructure to all organizations of any size and sector, and NIST added Quick Start Guides, Community Profiles and an online tool with Informative References to make the framework easier to adopt.

Is NIST CSF a certification?

No. There is no NIST certification for the Cybersecurity Framework, and NIST does not accredit assessors. You self-assess, or have a consultant assess you, and you can show the resulting profile to customers. If you need an independent attestation or certificate, SOC 2 and ISO 27001 are the usual routes, and your CSF profile maps directly onto both.

How is NIST CSF different from NIST SP 800-53 and 800-171?

The CSF is a high-level organizing framework of outcomes. SP 800-53 is a detailed catalog of security and privacy controls used mainly by federal systems, and SP 800-171 is the subset of requirements for protecting controlled unclassified information in non-federal systems, which CMMC assesses. The CSF tells you what outcomes to aim for; the special publications tell you specific controls to implement.

How long does it take a small company to adopt the CSF?

Building a first Current and Target Profile is a matter of a few working sessions once the right people are in the room. Closing the gaps takes as long as the gaps are large; the useful habit is quarterly re-scoring, so the framework becomes a routine rather than a one-time project. Companies that already have SOC 2 or HIPAA programs usually find the profile is mostly a re-labeling of work already done.