"Please describe how your security practices map to the NIST CSF." Questions like this turn up in overseas customers' supplier questionnaires, parent companies' annual self-assessments and auditor interviews. The NIST Cybersecurity Framework (CSF) is a cybersecurity risk management framework published by the US National Institute of Standards and Technology (NIST). It lists the cybersecurity outcomes an organization should achieve, but it does not prescribe how to achieve them[1]. NIST is not a regulator and most organizations use the CSF voluntarily; however, an executive order made it mandatory for US federal agencies, and some companies require it of their customers or across their supply chain[2], which is how Taiwanese companies end up meeting it in customer or parent-company requirements.

This article is for managers and IT leads who keep hearing "NIST CSF", want to understand what it is, and do not want to launch a big consulting project to find out. It covers what version 2.0 is and how it is structured, how Organizational Profiles and Tiers work, how the CSF fits with ISO 27001, and finally, using a 50 to 300 person company as the example, how to complete a first cycle in 12 months.

What CSF 2.0 is and what changed from 1.1

NIST published CSF 2.0 on February 26, 2024 as NIST CSWP 29[1], the framework's first major update since it was created in 2014[3]. CSF 2.0 is designed for organizations of any size, sector and maturity, and it can be adopted voluntarily or through government policies and mandates[1]. Compared with version 1.1, the two most important changes are:

  • The audience widened from critical infrastructure to all organizations: before version 2.0 the framework was titled "Framework for Improving Critical Infrastructure Cybersecurity", a title CSF 2.0 no longer uses[1]. NIST says CSF 2.0 now explicitly aims to help all organizations, not just critical infrastructure, its original target audience[3].
  • A new Govern Function: Govern was added to the existing five Functions (Identify, Protect, Detect, Respond and Recover), making six[3]. NIST explains that governance activities used to sit inside Identify, which limited visibility into how governance supports the whole cybersecurity program; elevating activities such as setting risk tolerances, defining roles and responsibilities and establishing policies promotes clearer alignment between cybersecurity, enterprise risk management and legal obligations[2].

Other structural changes: the business environment, risk management strategy and supply chain risk management parts of Identify moved to Govern (as GV.OC, GV.RM and GV.SC); Identify gained a new Improvement (ID.IM) Category; Protect gained Platform Security (PR.PS) and Technology Infrastructure Resilience (PR.IR); and Respond now centers on the broader Incident Management (RS.MA) Category[2]. No 1.1 content was removed; it was relocated within 2.0[2].

CSF 2.0 has an official Chinese translation, titled 《NIST 網路安全框架(CSF) 2.0》. Its cover states that it was translated by Taiwan's Bureau of Standards, Metrology and Inspection with NIST's permission and is an official US government translation[4]. It renders the six Functions as 治理, 識別, 保護, 偵測, 回應 and 復原, Profile as 剖繪 and Tier as 層級[4]; the Chinese edition of this article uses those terms so readers can match them to the translation.

Status as of November 2026: the framework is still 2.0, the resources keep growing

In NIST's CSF updates archive, every item from 2025 and 2026 is a companion resource; there is no new version of the framework itself[5]. Final publications this year include the Informative References Quick-Start Guide (SP 1347, August 2026)[6] and the ransomware risk management CSF 2.0 Community Profile (NIST IR 8374 Rev. 1)[5]. The following are still drafts that may change, so do not cite them as final:

  • Cyber AI Profile (Cybersecurity Framework Profile for Artificial Intelligence): a preliminary draft; NIST held workshops and virtual working sessions on it through 2026[5].
  • Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting (SP 1353): an initial public draft; the comment period closed on October 15, 2026[5].
  • Semiconductor Manufacturing Profile (NIST IR 8546): initial public draft published on February 27, 2025; comments closed on July 30, 2025 and it is still a draft[7]. For other standards that chip makers and their equipment supply chain are often asked about, see IEC 62443 and SEMI E187.

Structure: six Functions, 22 Categories and 106 Subcategories

The CSF Core is a set of cybersecurity outcomes arranged by Function, then Category, then Subcategory[1]. The outcomes are not a checklist of actions, and how each is achieved varies by organization; the order and size of Functions, Categories and Subcategories do not imply sequence or importance[1]. The six Functions are[1]:

  • Govern (GV): the organization's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored, covering organizational context, risk management strategy, roles and responsibilities, policy, oversight and supply chain risk management. Govern sits at the center of the Functions wheel because it informs how the organization implements the other five.
  • Identify (ID): the organization's current cybersecurity risks are understood, including assets (data, hardware, software, systems, facilities, services, people), suppliers and related risks, plus improvement opportunities for policies, processes and practices.
  • Protect (PR): safeguards are used to manage cybersecurity risk, including identity management, authentication and access control, awareness and training, data security, platform security and technology infrastructure resilience.
  • Detect (DE): possible attacks and compromises are found and analyzed, through timely discovery of anomalies, indicators of compromise and other potentially adverse events.
  • Respond (RS): actions are taken on a detected cybersecurity incident, covering incident management, analysis, mitigation, reporting and communication.
  • Recover (RC): assets and operations affected by an incident are restored, with appropriate communication during recovery.

The Functions should be addressed concurrently: Govern, Identify, Protect and Detect run continuously, while Respond and Recover should be ready at all times and come into play when incidents occur[1]. The Core applies to all information and communications technology an organization uses, including IT, the Internet of Things (IoT) and operational technology (OT), and to cloud, mobile and AI systems[1].

Counting from Appendix A of CSF 2.0, the Core has 22 Categories and 106 Subcategories: Govern has 6 Categories and 31 Subcategories, Identify 3 and 21, Protect 5 and 22, Detect 2 and 11, Respond 4 and 13, and Recover 2 and 8[1]. Subcategory numbering is intentionally not sequential; gaps mark CSF 1.1 Subcategories that were relocated[1]. A Subcategory reads like this: GV.OC-03, "Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed"[1].

Implementation Examples, Informative References and lookup tools

The CSF document says what to achieve; the how lives in online resources that can be updated more often than the document[1]. Implementation Examples give short, action-oriented, notional ways to achieve each Subcategory, and they are neither a complete list nor a required baseline; Informative References are mappings between CSF outcomes and other standards, guidelines and regulations, produced by NIST or other organizations; Quick-Start Guides are short documents on specific topics or for specific audiences, each revised on its own schedule[1].

There are three ways to look them up[6]: download a single Excel file with all Informative References; filter the references you want in the web-based CSF 2.0 Reference Tool and export to Excel or JSON; or compare across documents in the catalog of NIST's Online Informative References (OLIR) Program. NIST's Cybersecurity and Privacy Reference Tool (CPRT) also offers the CSF 2.0 and other NIST guidance in a browsable, downloadable form[3].

Organizational Profiles and Tiers: map where you are, then set where you are going

An Organizational Profile describes an organization's current and/or target cybersecurity posture in terms of the CSF Core's outcomes[1]. The official Chinese translation renders Current Profile and Target Profile as 現行剖繪 and 標的剖繪[4]; the Chinese edition of this article uses more conversational wording.

  • Current Profile: the outcomes the organization is currently achieving (or attempting to achieve), and how or to what extent each is achieved[1].
  • Target Profile: the outcomes the organization has selected and prioritized to meet its cybersecurity risk management objectives, taking into account anticipated new requirements, new technology adoption and threat intelligence trends[1].

CSF 2.0 describes five steps: scope the Profile; gather the information needed, such as organizational policies, risk management priorities and resources, business impact analysis registers, and the cybersecurity requirements and standards the organization follows; create the Profile; analyze the gaps between the Current and Target Profiles and create a prioritized action plan, such as a risk register or a Plan of Action and Milestones (POA&M); and implement the plan and update the Profile[1]. An organization can have several Profiles with different scopes, for example the whole organization, its financial systems, or ransomware threats against those financial systems[1].

NIST provides an Organizational Profile template as an Excel spreadsheet that puts Current and Target Profiles side by side[8]. The current-state columns include Practices (which can include artifacts that evidence the outcome), Status and Rating, where the rating can be high/medium/low, 1 to 5, a percentage or red/yellow/green; the target-state columns include Priority and Goals[8]. Columns can be added or removed, and the Current and Target Profiles do not need the same columns[8]. The action plan that comes out of the gap analysis should at least state the action, priority, owner, deadline and resources[8].

Profiles also work externally: a Current Profile can document and communicate the organization's capabilities and known improvement opportunities to business partners or prospective customers, and a Target Profile can express your requirements and expectations to suppliers and partners[1]. When a customer asks how you map to the CSF, an honest Current Profile with an improvement plan is usually more convincing than "we follow the CSF". A Target Profile does not have to start from scratch either: a Community Profile is a baseline of outcomes created for organizations that share a sector, technology, threat type or use case, and it can serve as the starting point[1]; the ransomware Community Profile mentioned above is one example[5].

The four Tiers are not a maturity score

Tiers characterize the rigor of an organization's cybersecurity risk governance and management practices, and there are four[1]:

  • Tier 1, Partial: the risk strategy is applied in an ad hoc, case-by-case way, prioritization is not formally based on objectives or the threat environment, and awareness of cybersecurity risk at the organizational level is limited[1].
  • Tier 2, Risk Informed: risk management practices are approved by management but may not be organization-wide policy; the organization is aware of cybersecurity risks but has not established an organization-wide approach to managing them[1].
  • Tier 3, Repeatable: risk management practices are formally approved and expressed as policy and are regularly updated as business requirements, threats and technology change; there is an organization-wide approach[1].
  • Tier 4, Adaptive: the organization adapts its practices based on previous and current cybersecurity activities, including lessons learned and predictive indicators, and executives monitor cybersecurity risk in the same context as financial and other organizational risks[1].

In CSF 2.0, NIST says Tiers should complement an organization's risk management methodology rather than replace it, and it encourages progression to higher Tiers when risks or mandates are greater or when a cost-benefit analysis shows a cost-effective reduction in risk[1]. NIST's CSF FAQ states plainly that the Tiers are not intended to be maturity levels (that FAQ answer was originally written for the earlier version of the framework)[9]. The Tiers Quick-Start Guide adds that leadership generally selects the Tiers; selecting them overall or per Function or Category gives a better sense of actual practice than selecting them per Subcategory; and organizations can reuse the Appendix B descriptions, customize them or use descriptions they already have[10].

In practice that means three things: do not average 106 Subcategory scores into "Tier 2.6"; you do not need Tier 4 in every Function; and when reporting to the board, explaining why each Function has its target Tier is more useful than a single number.

Using the CSF with ISO 27001 and other frameworks

The fundamental difference between the CSF and ISO/IEC 27001 is that the CSF cannot be certified: NIST does not offer certifications and has no plans to develop a conformity assessment program[2]. ISO/IEC 27001, by contrast, can be audited and certified by a certification body, and in Taiwan the accreditation fields of the Taiwan Accreditation Foundation (TAF) for management system certification bodies include ISO/IEC 27001 information security management system certification[11]. For implementation and the certification process see our ISO 27001 article; if a customer wants a report or a certificate, first work out which one, as explained in What to do when a customer asks for "security certification".

The two are not mutually exclusive. The CSF links its outcomes to other standards through Informative References[1]. NIST's Informative References page lists mappings to CSF 2.0 from ISO/IEC 27001:2022, CIS Controls 8.1, PCI DSS 4.0.1, the Cloud Controls Matrix (CCM) 4.0 and NIST SP 800-53, among others[12]. Note that some mappings are produced by NIST and others are submitted by outside organizations; NIST conducts only limited conformance testing against its submission guidance (IR 8278A Rev. 1), does not test the correctness of non-NIST mappings, and listing in the catalog does not imply NIST endorsement[12].

SP 1347 walks through one scenario: an organization already using the CSF that wants to adopt ISO/IEC 27001 filters the CSF 2.0 Reference Tool for the ISO/IEC 27001:2022 reference, exports it, asks which requirements are already met, which are not, which conflict and what resources the gaps need, and uses the results to build a Target Profile[6]. Going the other way, a company that already holds ISO 27001 can use the same mapping to fill its Current Profile with existing ISMS evidence, then report to management and customers in the language of the six Functions (this is our advice).

In Taiwan the CSF does not replace legal obligations either. Government agencies and specific non-government agencies must comply with the Cyber Security Management Act and its subsidiary regulations (see the Cyber Security Management Act overview), and listed companies also have the Taiwan Stock Exchange's cybersecurity control guideline for listed companies. A workable approach is to treat those requirements as inputs to GV.OC-03 and track them in the Target Profile; NIST itself points to GV.OC-03 as the Subcategory relevant to compliance[2]. But any mapping between CSF Subcategories and Taiwanese legal provisions has to be judged clause by clause, and having a CSF Profile is not a basis for claiming legal compliance.

How smaller companies can start: a first cycle in 12 months

Read these Quick-Start Guides first

NIST has a series of CSF 2.0 Quick-Start Guides that distill parts of the framework into actionable first steps[1]. The most relevant for small and mid-sized companies are[13]:

  • Small Business Quick-Start Guide (SP 1300): written for small and medium-sized businesses with modest or no cybersecurity plans; for each Function it lists actions under Understand, Assess, Prioritize and Communicate, each tagged with the relevant Subcategory[14].
  • Quick-Start Guide for Creating and Using Organizational Profiles (SP 1301): the steps for building Profiles and how to use the template[8].
  • Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM) (SP 1305): uses the GV.SC Category in Govern to establish C-SCRM, prioritize suppliers by criticality and put requirements into contracts, or create a Target Profile for each supplier criticality level to share with suppliers[15]. For the technical side of supply chain attacks, see supply chain attacks.

The Tiers guide (SP 1302) and Informative References guide (SP 1347) mentioned above are on the same page, along with guides on enterprise risk management and the cybersecurity workforce; the guide to creating Community Profiles still links to an initial public draft[13].

The small business guide's actions are concrete, for example: require multi-factor authentication on every account that offers it and consider password managers; change default manufacturer passwords; enable automatic updates; back up data regularly and test the backups; turn on full-disk encryption for laptops and tablets; assess supplier risk before entering formal relationships; prepare an incident response plan with a contact list; and verify the integrity of backups before restoring from them[14]. The guide also suggests that any activity you do not understand or feel comfortable handling can serve as a discussion prompt with a managed security service provider (MSSP)[14]. NIST also states that you do not need a consultant to implement the CSF, and it does not recommend consultants or assessors[2].

Practical walkthrough (our advice, not NIST's text)

The following is our suggested approach for a 50 to 300 person company. Points taken from NIST documents are footnoted, and the Subcategory IDs in parentheses follow Appendix A of CSF 2.0[1].

  1. Month 1, set the scope: SP 1301 suggests first answering a few questions: why you are creating the Profile, whether it covers the whole organization or specific divisions and systems, whether it addresses all threats or only some, who develops and reviews it, and who sets expectations for the target[8]. Profiles can also be scoped by technology category (IT or OT), data type or users[8]. We suggest the first Profile cover company-wide IT (email, identity systems, ERP, file servers, remote access and cloud services) plus the service the customer questionnaire asks about; a company with a factory should build a separate OT Profile in year two. Appoint a senior executive as owner, in line with "organizational leadership is responsible and accountable for cybersecurity risk" (GV.RR-01).
  2. Months 1 to 2, build the Current Profile: download the NIST template, use the small business guide's actions as the first-pass list, then add other Subcategories relevant to your scope. Run two or three workshops with the IT, finance, HR and operations leads, and record current practice, the evidence you can produce and a rating for each item. Write "partially achieved" rather than overstate.
  3. Months 2 to 3, set the Target Profile and action plan: treat customer contracts and questionnaires, parent-company requirements, applicable regulations and insurance conditions as inputs to GV.OC-03, then adjust for the threats you care about most, for example by starting from the ransomware Community Profile[5]. Give each outcome a priority and have leadership pick a target Tier for each Function[10]. Then turn each gap into an action with a priority, owner, deadline and resources[8]. Obvious gaps such as MFA and backup testing do not have to wait for the Profile; start them now.
  4. Months 4 to 6: complete inventories of hardware and of software and services (ID.AM-01, ID.AM-02); turn on MFA for email, remote access and administrator accounts (PR.AA-03), as covered in the MFA rollout guide, and look to zero trust for the longer-term identity and access architecture.
  5. Months 7 to 9: move to regular restore tests and keep an offline or immutable backup copy (PR.DS-11, see the 3-2-1 backup rule); set up patching and log collection processes (PR.PS-02, PR.PS-04, see logging and retention).
  6. Months 10 to 12: list suppliers and prioritize them by criticality (GV.SC-04) and put security requirements into contracts (GV.SC-05); run an incident response tabletop exercise and feed its findings into improvements (ID.IM-02); finally reassess the Current Profile, report to leadership and set next year's targets.

The CSF treats Profiles as a continuous improvement cycle, and the steps can be repeated as often as needed[1]. From year two, the scope can expand to OT or subsidiaries, and target Tiers can be adjusted as risk changes.

Action checklist

  • Find out who is asking you to "map to the NIST CSF", what they want delivered (a questionnaire, a self-assessment or a Profile), and which services and sites it covers.
  • Download the CSF 2.0 document (or the official Chinese translation), the Small Business Quick-Start Guide and the Organizational Profile template, and name an executive owner.
  • Scope the first Profile (company-wide IT plus the services customers care about, with OT as a separate Profile), and build a first-pass Current Profile from the small business guide's actions, with evidence and a rating for every item and no overstatement.
  • Treat customer, parent-company, regulatory and insurance requirements as inputs to GV.OC-03, and set a Target Profile and a target Tier for each Function.
  • Turn the gaps into a 12-month plan with owners, deadlines and resources; start obvious gaps such as MFA and backup testing immediately.
  • Never claim to be "NIST CSF certified"; when a customer needs certifiable assurance, consider ISO/IEC 27001.
  • Redo the Current Profile every year and report progress to leadership; if you need outside help with the first assessment, see our security health check.