Skip to main content
Get Started ↗
NIST CSF 2.0

The NIST Cybersecurity Framework,
Actually Running

Six functions, one program, and somebody whose job it is to keep it going. We build the framework into how your business already works, then operate it.

Talk to a Compliance Expert ↗ Get My Free Assessment ↗
WHY FRAMEWORKS STALL

Where a Framework Becomes a Spreadsheet

There is no auditor to fail, no certificate to lose and no deadline, so the work is only as durable as the person who started it. It sits inside our wider IT compliance services.

What we find when we are called back in:

  • A framework adopted with nobody accountable for it
  • An asset inventory that stopped being true months ago
  • Controls chosen from a list, not from a risk
  • Logging switched on that nobody actually reads
  • A response plan that has never been walked through
  • Backups nobody has restored from
  • A profile filled in once, for a questionnaire
Talk to a Compliance Expert Read the Framework Explainer
Value of Compliance

What a Framework Is Actually Worth

NIST CSF is voluntary, so it has to earn its place. Three reasons businesses keep it, and only one of them is about security.

One Answer to Every Form
Insurers, customers and questionnaires all ask the same things differently. A framework gives you one program to answer from.
A Named Owner for Security
The GOVERN function exists because programs die without one. ITS carries that role, with decisions written down and reviewed on a schedule.
Controls Somebody Operates
Access reviews, logging, patching, backup tests and training, done on schedule. Evidence exists because the work actually happened.
Talk to a Compliance Expert
THE SIX FUNCTIONS

The Six Functions of NIST 2.0

Version 2.0 of the framework added a sixth function, and it went first for a reason: nothing in the other five survives without somebody accountable for it. Here is the whole shape of it.

GOVERN

New in version 2.0, and the one most programs skip. Who owns security, what risk the business is willing to carry, which policies exist, how suppliers are held to account, and when any of it gets reviewed.

IDENTIFY

What you actually have and what could go wrong with it. Assets, data, suppliers and the risks attached to them, kept current rather than inventoried once.

PROTECT

The safeguards themselves. Identity and access, training, data security, configuration and maintenance, and the platform work that makes the rest of it possible.

DETECT

Noticing. Continuous monitoring and analysis that produces something a human reads, because logging nobody looks at is a cost rather than a control.

RESPOND

What happens next. Incident management, analysis, reporting and communication, decided in advance so the decisions are not being made at 2am for the first time.

RECOVER

Getting back. Restoration planning and the communication around it, tested by actually restoring something rather than by owning a document that says you could.

HOW TO START

Three Steps to a Framework That Sticks

The same order every time, and you can stop after any of them.

STEP 1

Agree the Scope and Who Owns It

What the program covers, what risk the business is prepared to carry, and who is accountable. This is the GOVERN work, and skipping it is why frameworks stall.

STEP 2

Profile Where You Are, Then Where You Want to Be

An honest read of your current state against the six functions, then a target that reflects your actual risk rather than a maximum score. You get both in writing.

STEP 3

Close the Gap, Then Keep Profiling

Controls go in, in priority order, and the profile gets revisited on a schedule you agree. A framework is a cycle, not a project with an end date.

Talk to a Compliance Expert
CLIENT RESULTS

What Clients Say About Working With Us

Two ITS clients on what changed after they handed the technology over.

We always get a technician or an engineer that can solve the problem remotely and we have very little downtime. We’ve had a couple of times where we have had an employee that is prevented from working, and when we call in and we escalate quickly, we always have someone readily available to solve the problem.

Kathy Mickelson Office Manager, Tower Arch Capital
Kathy Mickelson on working with ITS
Talk to a Compliance Expert
FAQ

What Businesses Ask Before Adopting NIST CSF

1. What is the NIST Cybersecurity Framework?

It is a voluntary framework published by the National Institute of Standards and Technology that organizes cybersecurity work into functions, then categories and subcategories beneath them. It does not tell you which products to buy. It tells you what outcomes you need and leaves the how to you, which is why it works for a ten-person firm and a large manufacturer alike. Version 2.0, published in February 2024, groups everything under six functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER.

Source: the NIST Cybersecurity Framework 2.0, National Institute of Standards and Technology, February 2024.

2. How many functions does the framework have, five or six?

Six. It was five for a decade, which is why most summaries you will find online, including older articles of our own, still say Identify, Protect, Detect, Respond and Recover. Version 2.0 added GOVERN and put it first: who is accountable, what risk the business accepts, which policies exist, and how suppliers are held to it. If a checklist you have been handed shows five functions, it predates February 2024.

Source: the NIST Cybersecurity Framework 2.0, February 2024.

3. Is NIST CSF the same thing as NIST 800-171?

No, and this is the confusion we untangle most often. They are different NIST publications with different jobs. The Cybersecurity Framework is a voluntary way to organize a security program for any organization. NIST SP 800-171 is a specific control set, 110 practices in 14 families, required of you by contract when you handle controlled unclassified information for the federal government. If a prime or a contracting officer named a NIST document at you, it is almost certainly 800-171.

4. Can we get certified in NIST CSF?

No, and nobody can sell you that. There is no NIST CSF certificate and no accredited body that issues one, because the framework is a voluntary structure rather than a standard you are audited against. What you can do is show your work: a defined scope, a current profile, a target profile, and evidence that the controls are running. If a customer needs a formal report or certificate, they are asking for SOC 2 or ISO 27001.

5. Which framework should we choose?

Whichever one your obligations point at, and if nothing points anywhere, the Cybersecurity Framework is the usual answer because it is broad, free and maps to most of the others. Working to a recognized framework such as CIS Controls, NIST CSF or NIST 800-53 gives you a defensible program to show a regulator that expects one without naming it. It does not by itself satisfy any regulator's requirements. The same logic holds for most regulators that expect a program without naming one.

6. Is NIST CSF mandatory for us?

On its own, no. Nobody fines you for not using it. What makes it feel mandatory is second-hand: an insurer asks how you manage cyber risk, a customer sends a security questionnaire, a regulator expects a program without naming one, or a contract references it. Those are real deadlines, they just belong to somebody else. Worth knowing before you budget, because it changes who inside the business owns the project and how it gets justified.

Find Out Where You Sit Against All Six Functions

An honest read of your current state against the framework, a target that matches your actual risk, and the gaps in priority order. Written down and yours to keep, with no obligation.

Talk to a Compliance Expert ↗ Get My Free Assessment ↗