Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is the NIST Cybersecurity Framework (CSF 2.0)?

Definition

The NIST Cybersecurity Framework (CSF) is a free, voluntary guide from the U.S. National Institute of Standards and Technology for managing cybersecurity risk. Version 2.0, released February 26, 2024, organizes security into six functions and is written for organizations of any size, not just critical infrastructure.

How It Works

The CSF 2.0 Core is a list of security outcomes grouped into six Functions: "GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER."

  • Govern: strategy, roles, policy, and oversight of suppliers. New in 2.0.
  • Identify: knowing your assets, data, and risks.
  • Protect: access control, training, data security, and patching.
  • Detect: spotting attacks and unusual activity.
  • Respond: acting on an incident.
  • Recover: restoring operations and learning from it.

The CSF says what to achieve, not which product to buy. Businesses use it through Organizational Profiles. NIST's Small Business Quick-Start Guide explains that a Current Profile "specifies the desired outcomes an organization is currently achieving" and a Target Profile "specifies the outcomes an organization has selected and prioritized." The gap between the two becomes the work plan.

For small firms, NIST publishes the CSF 2.0 Small Business Quick-Start Guide (SP 1300), which turns each function into short checklists and questions an owner can work through without a security team. The CSF also maps to other standards, such as the CIS Controls and NIST SP 800-171, so work done for one counts toward others.

Real-World Example

Ohio's Data Protection Act, effective November 2, 2018, gives businesses a legal reason to follow a framework. Under Ohio Revised Code 1354.02, a business that maintains a written cybersecurity program that "reasonably conforms to an industry recognized cybersecurity framework" can claim an affirmative defense to tort claims alleging that a failure to implement reasonable security caused a data breach. Section 1354.03 lists qualifying frameworks, starting with NIST's "framework for improving critical infrastructure cybersecurity," the CSF's original name. The program's scale must fit factors including "the size and complexity of the covered entity."

Why It Matters for a Small Business

Most small businesses do not need a heavy compliance standard, but they do need a way to show their security is organized and reasonable. The CSF provides a common language that insurers, customers, auditors, and lawyers recognize. It helps an owner see gaps in plain terms, prioritize a short list of improvements, and report progress. In states like Ohio, documented alignment can also carry legal weight after a breach. Because CSF 2.0 is free and vendor-neutral, it also keeps the plan focused on outcomes rather than on whichever product is being sold that month.

How to Spot It / How DTS Handles It

Warning signs: no way to describe the security program beyond a list of tools, insurance and customer questionnaires answered differently each time, and no record of what was planned or completed.

DTS can assess a business against NIST CSF 2.0: building a simple Current and Target Profile with the owner, turning the gaps into a prioritized plan, and reviewing progress on a schedule. NIST's own FAQ says it "does not offer certifications or endorsements of CSF-related products, implementations, or services," so treat any claim of a NIST CSF certification with caution. Ask your counsel about legal safe harbors such as Ohio's. See our vCISO service, or our managed IT service for the hands-on fixes.

Related Terms

  • CIS Controls: a more prescriptive companion to the CSF.
  • Risk register: where CSF gaps become tracked risks.
  • Security policy: a core Govern outcome.
  • NIST SP 800-171: NIST's requirements for contractors handling CUI.
  • Risk assessment: the Identify step in practice.
  • Incident response: the Respond function in action.
  • Zero trust: an architecture that supports many CSF outcomes.

Sources

  • NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (February 26, 2024): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
  • NIST, NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide, SP 1300 (February 2024): https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf
  • Ohio Revised Code, Chapter 1354: Ohio Data Protection Act (Sections 1354.02 safe harbor and 1354.03 reasonable conformance; effective November 2, 2018): https://codes.ohio.gov/ohio-revised-code/chapter-1354
  • NIST, Cybersecurity Framework: Frequently Asked Questions ("How can we obtain NIST certification for our CSF products and implementations?"): https://www.nist.gov/cyberframework/faqs

Last updated October 14, 2026.