NIST Cybersecurity Framework: Functions, Tiers and Profiles

The framework usually arrives sideways. A cyber insurance application asks which framework you follow. A customer's questionnaire has a column headed CSF Function and expects something in every row. A board member reads an article and asks whether the company is NIST compliant. None of those has a clean yes or no answer, because the thing being asked about was built to be something other than a test you pass or fail.

What the National Institute of Standards and Technology publishes is a shared vocabulary for cybersecurity outcomes, given away free, by an agency with no authority to make anyone use it. That is not a weakness in the design. It is the design, written into law, and knowing it changes how you answer all three questions.

What Is the NIST Cybersecurity Framework?

NIST is a non-regulatory agency of the US Department of Commerce, and the current edition of its framework is NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0, published on February 26, 2024. It runs to about thirty pages, which surprises people expecting a standard. Most of that length is a list of outcomes.

The document describes itself as a taxonomy of high-level cybersecurity outcomes usable by any organization regardless of size, sector or maturity, and it is explicit that it does not prescribe how those outcomes should be achieved. That is the whole character of the thing. It tells you suppliers should be known and prioritized by criticality. It does not tell you to buy a vendor risk platform, review suppliers quarterly, or score them out of ten.

Three components make it up, and confusing them is the most common source of nonsense in vendor questionnaires: the CSF Core, a hierarchy of Functions, Categories and Subcategories written as outcomes; CSF Organizational Profiles, which describe where you are and where you intend to be in the Core's language; and CSF Tiers, four descriptions of how rigorous your risk practices are.

The Six Functions of the NIST CSF

The Functions are the level everyone quotes and the level a non-technical executive can hold in their head. Each is named after a verb, and NIST writes each one as a state of affairs rather than an activity.

Read down the middle column and you can see why the framework survived. Nothing in it is a product category. Protect covers multi-factor authentication under PR.AA without naming it, because the outcome NIST wants is that identities are managed and access is granted appropriately, and a company running hardware keys and a company running an authenticator app can both claim it honestly. Respond assumes an incident response plan you can execute under pressure, and RS.MA-01 says only that the plan is executed in coordination with relevant third parties once an incident is declared.

Govern sits at the center of NIST's own diagram, because it informs how an organization implements the other five. That is where the framework quietly disagrees with how most companies buy security. Detection tooling is a purchase. Deciding who is accountable, what risk the business will tolerate and which suppliers matter is not, and CSF 2.0 puts 31 of its 106 outcomes in Govern to make the point.

What Changed in NIST CSF 2.0

Two of the three highest ranking explainers for this topic still describe five functions, which tells you how quietly the 2024 revision landed. The changes matter because they alter what an honest answer to a questionnaire looks like.

Govern is the headline, and the retitling is the underrated part. Before 2.0 the document was called the Framework for Improving Critical Infrastructure Cybersecurity, and a dentist or a software startup reading it had to translate. NIST dropped that title and now addresses industry, government, academia and nonprofits of any size directly.

Supply chain was promoted at the same time. In version 1.1 it was a category inside Identify. In 2.0 it is GV.SC, sits under Govern, and carries ten subcategories running from GV.SC-01, establishing a program, to GV.SC-10, which covers what happens after a supplier relationship ends. The reasoning is visible in the incident data: the 2026 Verizon Data Breach Investigations Report found third-party involvement in breaches up 60 percent, with breaches involving a third party now accounting for 48 percent of all breaches. Roughly half of incidents arrive through somebody else's environment, which is a governance problem before it is a technical one, and supply chain attacks do not respect the boundary of your own network.

What Are the CSF Implementation Tiers?

Tiers describe the rigor of an organization's cybersecurity risk governance and risk management practices. There are four, and NIST's names for them are Partial, Risk Informed, Repeatable and Adaptive.

• Tier 1, Partial. Risk strategy is applied ad hoc, prioritization is not formally based on objectives or the threat environment, and the organization is generally unaware of the risks its suppliers carry.
• Tier 2, Risk Informed. Management has approved risk practices but they are not organization-wide policy, and risk assessment happens without being repeatable or recurring.
• Tier 3, Repeatable. Practices are formally approved and expressed as policy, methods for responding to changes in risk are consistent, and senior executives communicate regularly about cybersecurity risk.
• Tier 4, Adaptive. Cybersecurity risk is monitored in the same context as financial risk, and the budget follows an understanding of the current and predicted risk environment.

Nobody assigns you a tier. You select one, you can select different tiers for governance and for management, and the honest use of them is internal: a shared benchmark that stops a security conversation from becoming an argument about adjectives.

What Is a CSF Organizational Profile?

A profile is the framework applied to one organization, written in the Core's language, and it comes in two halves. A Current Profile records the outcomes you are achieving now and to what extent. A Target Profile records the outcomes you have prioritized, allowing for changes you can see coming, such as a new product, a new regulator or a technology you are about to adopt.

The gap between the two is the point. NIST sets out five steps: scope the profile, gather the information, create it, analyze the gaps between current and target and turn them into a prioritized action plan, then implement that plan and update the profile. A profile can cover the whole organization or one system, and you can hold as many as you find useful.

A Community Profile is a baseline of CSF outcomes published for a sector, a technology or a threat type. Where one exists for your industry it saves you the argument about which outcomes matter most, because a group of peers has already had it. NIST hosts them, with profile templates and quick start guides, on the CSF website.

Is the NIST Cybersecurity Framework Mandatory?

For a private company in the United States, no. Not by law, not by any regulator, and not in a way that produces a fine. The reason is unusually well documented, because Congress wrote the limits into the statute that authorizes the work.

One group is bound. Executive Order 13800 of May 11, 2017, at Section 1(c)(ii), tells each federal agency head that effective immediately they shall use the framework, or any successor document, to manage the agency's cybersecurity risk. Federal agencies use the CSF because a president ordered them to. A private company faces no equivalent instruction.

The Federal Trade Commission has been direct about what that means. In a 2016 post on its business blog the FTC wrote that "there's really no such thing as 'complying with the Framework'", and explained that the things the framework asks an organization to evaluate are the things the FTC has evaluated for years under Section 5 of the FTC Act when deciding whether a company's data security was reasonable. The framework is not the standard the FTC enforces. It is a decent map of the territory the FTC looks at.

The pressure comes instead from contracts, insurance applications, and requirements that genuinely do bind. HIPAA's Security Rule is federal law for covered entities and their business associates. PCI DSS is not law but is enforced through card brand agreements with real financial consequences. State breach notification statutes are law in every state. The CSF sits underneath all of them as a way of arranging the work, and satisfies none of them by itself.

How to Implement the NIST Cybersecurity Framework

Starting at the top of the Core and working down reads as an enormous undertaking. NIST publishes a shorter route for smaller organizations: the CSF 2.0 Small Business Quick-Start Guide, NIST SP 1300, which selects a handful of outcomes per function and tags each with its subcategory identifier so you can find the full text later.

Do not start by buying a CSF platform. The first pass costs nothing but attention, and a tool that automates evidence collection has no idea which of your suppliers is critical.

NIST CSF vs ISO 27001 and SOC 2

These three come up in the same procurement conversations and answer different questions. Reading the table in the wrong direction is how a company pays for an audit nobody asked for.

The CSF is the map and the other two are the exams. A company that has organized its program around the six functions arrives at either engagement with most of the thinking done, because the evidence an auditor wants is generated by the same outcomes. If a customer is asking for a SOC 2 report, a CSF profile is not a substitute, and the way ISO 27001 and SOC 2 differ decides which one to work toward first.

Who Uses the NIST Cybersecurity Framework?

Federal agencies use it because Executive Order 13800 requires it. Everyone else uses it because it is free, because it is written in language an executive can follow, and because it structures a security conversation without depending on what anyone is selling.