NIST CSF 2.0: What’s New, Components, Functions, and Best Practices

What Is the NIST Cybersecurity Framework (NIST CSF)? 

The NIST Cybersecurity Framework (NIST CSF) helps organizations manage cybersecurity risks. Developed by the National Institute of Standards and Technology (NIST), it provides industry standards and best practices to help organizations identify, assess, and mitigate risks in cybersecurity.

Initially introduced in 2014, the NIST CSF addresses critical infrastructure sectors, providing structured methodologies for improving cybersecurity resilience. It organizes cybersecurity activity into core functions and aligns them with specific outcomes to guide organizations toward desired security states. The framework’s adaptability makes it useful for organizations of all sizes, while aligning with existing business strategies and goals.

This is part of a series of articles about cybersecurity frameworks

What’s New in NIST 2.0? 

NIST CSF 2.0 introduces several enhancements aimed at improving its effectiveness and adaptability to a broader range of organizations:

• Expanded scope: While the original version was primarily focused on critical infrastructure sectors like energy, healthcare, and finance, version 2.0 broadens the framework’s applicability to organizations of all sizes and industries. This makes it more relevant to businesses that may not have been the primary audience for earlier versions.
• CSF 2.0 reference tool: A customizable platform that allows organizations to interact with and tailor the framework to their needs. This tool provides easier access to the framework’s components, enabling the development of security strategies that are comprehensive and customized to different operational landscapes.
• Emphasis on enhanced clarity and usability: The framework’s guidelines have been refined to make them easier to interpret, broadening accessibility for organizations that might lack dedicated cybersecurity resources. This simplification helps a wider range of users implement the framework.
• Evolving threat landscape: NIST 2.0 places a new focus on emerging threats. The updated framework addresses challenges related to cloud security, supply chain risks, and newer technologies such as artificial intelligence (AI), the Internet of Things (IoT), and identity-based threats. This reflects a shift toward securing not just traditional IT systems, but also the expanding range of connected devices and technologies that organizations are increasingly reliant on.
• Expanded set of functions: The framework has an addition of a sixth core function: “Govern.” This new function aims to enhance governance, risk management, and decision-making processes, helping organizations better operationalize their cybersecurity efforts.
• A proactive, continuous improvement mindset: Recognizing the changing nature of cybersecurity risks, the framework encourages organizations to regularly review and update their practices, staying ahead of potential threats. This focus on continuous evolution ensures that security measures remain aligned with emerging risks.
• Integration of privacy and cybersecurity: The updated framework acknowledges the increasingly interconnected nature of data security and privacy concerns. By including privacy considerations, NIST CSF 2.0 promotes a more holistic approach to protecting sensitive information.
• Stronger emphasis on cyber resilience: The framework encourages organizations to not only prevent attacks but also to build systems that can quickly recover from incidents, ensuring operational continuity and minimizing the impact of security breaches. This approach helps organizations focus on the full lifecycle of cybersecurity, from threat detection to incident response and recovery.

Components of the NIST CSF 2.0

CSF Core

The CSF Core is the foundational element of the NIST Cybersecurity Framework 2.0, guiding organizations in managing cybersecurity risks. It provides an organized set of desired cybersecurity outcomes that can be applied universally, regardless of an organization’s size, sector, or cybersecurity maturity.

The Core is structured into three key components: functions, categories, and subcategories. Each function represents a high-level cybersecurity goal, which is further broken down into categories, grouping related cybersecurity outcomes. These categories are then subdivided into more specific subcategories, which describe precise outcomes that organizations should aim to achieve.

CSF Organizational Profiles

CSF Organizational Profiles help organizations describe and manage their current and target cybersecurity postures. A Current Profile outlines the cybersecurity outcomes an organization is currently achieving, while a Target Profile defines the desired outcomes aligned with the organization’s cybersecurity risk management objectives. These profiles facilitate the assessment of gaps between current and desired states, enabling the development of action plans for improvement.

CSF Tiers

The CSF tiers in NIST Cybersecurity Framework 2.0 represent different levels of an organization’s cybersecurity maturity. They aim to help organizations assess how well they manage cybersecurity risks and align their cybersecurity activities with risk management goals.

There are four tiers:

1. Tier 1: Partial – Organizations at this level have limited awareness of cybersecurity risks and typically take reactive approaches to addressing issues. Cybersecurity risk management practices are not formalized, and information sharing tends to be minimal.
2. Tier 2: Risk-Informed – At this level, organizations begin to understand their cybersecurity risks and may have some risk management processes in place. While they have some awareness of external threats, cybersecurity efforts are not yet integrated into broader risk management strategies.
3. Tier 3: Repeatable – Organizations in this tier have established and documented risk management practices. Cybersecurity is treated as an integral part of overall risk management, and organizations regularly update their strategies based on lessons learned and evolving risks.
4. Tier 4: Adaptive – The most advanced level, where organizations proactively manage cybersecurity risks through continuous improvement, automation, and integration of threat intelligence. Cybersecurity strategies are dynamic, and the organization is highly resilient to emerging threats.

These tiers are not meant to be prescriptive but offer a way for organizations to gauge their cybersecurity maturity and improve over time.

NIST Cybersecurity Framework 2.0 Functions

Govern (GV)

The “Govern” function in the NIST Cybersecurity Framework 2.0 is centered around establishing, communicating, and monitoring an organization’s cybersecurity risk management strategy, expectations, and policies. This function supports the other five functions by setting the strategic direction and ensuring that cybersecurity activities align with the organization’s mission and stakeholder expectations. 

The Govern function addresses aspects such as understanding the organizational context, defining roles and responsibilities, establishing policies, and overseeing the cybersecurity strategy. Governance is crucial for incorporating cybersecurity into the broader enterprise risk management strategy.

Identify (ID)

The “Identify” function focuses on understanding the organization’s current cybersecurity risks. This involves identifying and managing assets, such as data, hardware, software, and people, that are critical to achieving the organization’s objectives. 

By thoroughly understanding these assets and associated risks, the organization can prioritize its cybersecurity efforts in line with its risk management strategy. This function also includes identifying opportunities for improving policies, plans, and processes that support cybersecurity risk management.

Protect (PR)

The “Protect” function is about implementing safeguards to ensure the security of the organization’s assets against cybersecurity risks. After identifying and prioritizing assets and risks, the “Protect” function focuses on securing these assets to prevent or reduce the impact of cybersecurity incidents.

This includes activities related to identity management, access control, awareness and training, data security, and platform security. The function also emphasizes resilience, ensuring that the organization’s technology infrastructure can withstand and recover from adverse events.

Detect (DE)

The “Detect” function is designed to ensure that organizations can identify cybersecurity events in a timely manner. It involves continuous monitoring of assets to detect anomalies, indicators of compromise, and other potentially adverse events. 

This function is critical for early detection of cybersecurity incidents, enabling organizations to respond promptly and effectively. The detection process includes analyzing events, correlating information from multiple sources, and providing actionable insights to authorized personnel.

Respond (RS)

The “Respond” function addresses the actions taken once a cybersecurity incident has been detected. It involves managing the response to ensure that the incident is contained and its effects are mitigated. This function includes incident management, analysis, reporting, and communication with stakeholders. 

Effective response plans are crucial for minimizing the damage caused by cybersecurity incidents and preventing their spread. The “Respond” function also supports ongoing improvement by analyzing incidents to understand their root causes and to refine response strategies.

Recover (RC)

The “Recover” function focuses on restoring the organization’s systems and operations after a cybersecurity incident. It includes executing recovery plans, verifying the integrity of restored systems, and communicating progress to stakeholders. 

The goal is to restore normal operations as quickly as possible while minimizing the impact on the organization’s mission and stakeholders. Recovery efforts are guided by pre-established criteria and aim to ensure that all affected systems are securely and efficiently restored to their operational states.

Best Practices for Implementing NIST Cybersecurity Framework 2.0 

Creating a Baseline Profile

Creating a baseline profile is the first step in implementing the NIST CSF 2.0, marking the starting point for cybersecurity initiatives. This profile offers a snapshot of the organization’s current cybersecurity posture, identifying existing capabilities and vulnerabilities. It aims to align the organization’s cybersecurity practices with its business objectives, forming a foundation for improving security measures.

Establishing this baseline involves assessing current systems and practices, comparing them against industry benchmarks to identify gaps. The resultant profile serves as a reference point, guiding the development of more robust risk management strategies. It enables organizations to track progress and measure the impact of their cybersecurity initiatives against established goals.

Risk Mapping and Analysis

Risk mapping and analysis involve plotting identified risks against business objectives to understand potential impacts and prioritize mitigation strategies. This step provides insight into the interdependencies within cybersecurity operations, allowing organizations to develop an understanding of their risk landscapes. It aids in visualizing risk exposure and understanding threats within wider operational contexts.

Through careful mapping and analysis, organizations can better predict potential scenarios and outcomes. This process facilitates informed strategic planning, enabling organizations to focus on high-value risk mitigation efforts. By understanding the connections between risks and business functions, organizations can develop targeted strategies that effectively mitigate vulnerabilities and support cybersecurity defenses.

Developing and Implementing the Target Profile

Developing and implementing the target profile involves setting achievable cybersecurity goals aligned with organizational objectives. This profile represents the desired future state of the organization’s cybersecurity posture, considering its risk tolerance, business needs, and resource constraints. It serves as a roadmap for transitioning from the current baseline profile to a more secure and resilient state.

This process requires strategic planning and resource allocation to ensure that improvements align with the organization’s long-term goals. Implementing the target profile involves a mix of technological, procedural, and policy changes designed to elevate cybersecurity measures.

Integration With Existing Security Programs

Integration with existing security programs is vital for the implementation of the NIST CSF 2.0. Organizations should align the framework’s components with pre-existing cybersecurity efforts, ensuring that implementation complements established practices. This integration enhances organizational responsiveness to threats without disrupting ongoing operations or incurring excessive transition costs.

It also involves harmonizing cybersecurity protocols with broader enterprise risk management strategies, promoting consistency in security management. Through effective integration, organizations can leverage existing strengths while addressing gaps identified during framework implementation.

Continuous Monitoring and Improvement

Continuous monitoring and improvement are essential components of the NIST CSF 2.0 implementation, ensuring that cybersecurity defenses remain effective against evolving threats. This approach involves regularly reviewing and updating security measures based on threat intelligence, organizational changes, and technological advancements. Continuous improvement ensures that the framework remains adaptable and relevant over time.

Regular assessments identify areas for enhancement, promoting a proactive cybersecurity stance. By embracing a cycle of continuous feedback and adaptation, organizations can maintain a robust security posture, effectively balancing risk management with resource allocation. This cycle encourages a culture of vigilance and resilience.

How Sternum Can Close NIST Security Gaps

Sternum is an IoT security and observability platform, which lets you meet and exceed the security requirements of standards and regulations such as UL 2900, TIR 57, and the FDA Cybersecurity Guidance.

Embedded in the device itself, Sternum provides deterministic security with runtime protection against known and unknown threats; complete observability that provides data about individual devices and the entire device fleet; and anomaly detection powered by AI to provide real-time operational intelligence.

Sternum operates at the bytecode level, making it universally compatible with any IoT device or operating system including RTOS, Linux, OpenWrt, Zephyr, Micrum, and FreeRTOS. It has low overhead of only 1-3%, even on legacy devices. 

Here is how Sternum can help you improve IoT security to meet regulatory requirements:

• Agentless security – integrates directly into firmware, making it a part of the core build. This ensures that the solution cannot be externally compromised and leveraged as a point of failure.
• Automatic mitigation of known and zero-day threats – prevents 96.5% attacks in benchmark (RIPE) security tests. Its vulnerability-agnostic approach makes it equally effective in dealing with known and zero-day threats. This not only improves security but can also cut security patch management costs by as much as 60%.
• Supply chain protection – relies on binary instrumentation, making it able to protect all running code. This extends to 3rd party and operating system libraries, effectively preventing all supply chain exploit attempts. 
• Protection of isolated devices – does not rely on external communication to secure devices, making it equally effective for connected and isolated devices.
• Live attack information with zero false positives – real-time alert system notifies about all blocked attacks, providing – for each – detailed logs and attack path analysis. The deterministic nature of EIV’s integrity checks ensures that all alerts are always valid.
   
• Streamlined compliance – helps meet the latest cyber regulations for IoT devices (IEC 62443, FDA, NIST, etc) and the most current FBI recommendations for Internet of Medical Things (IoMT) endpoint protection.

Learn more about Sternum embedded security