Framework
NIST Cybersecurity Framework 2.0
Does your customer or insurer ask about the NIST Cybersecurity Framework? Complass guides you through the profile process: from scope to your current state, target and action plan, using evidence you can reuse from ISO 27001, NIS2 or IEC 62443.
What is NIST CSF 2.0?
The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary framework of the US National Institute of Standards and Technology. In six functions (Govern, Identify, Protect, Detect, Respond, Recover), 22 categories and 106 subcategories it describes the outcomes effective cybersecurity risk management should achieve. It is used worldwide, whatever the sector or size. There is no certificate.
Complass is not affiliated with NIST. The English outcome wording is taken from NIST CSWP 29, a freely usable work of the US federal government.
Content as of:
Does it apply to me?
The CSF concerns companies whose customers, parent groups or cyber insurers want their security described in CSF terms: suppliers to international groups, software and service providers, operators of connected plants and organisations that need one consistent picture of their position.
The CSF is not mandatory and does not replace legal duties such as NIS2. It complements them as a common language; you already have many outcomes if you work to ISO 27001 or NIS2.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Basis
- NIST CSWP 29The NIST Cybersecurity Framework (CSF) 2.0, published 26 February 2024
Key dates
There are no statutory deadlines for the CSF; your customers or insurers set the timetable. The profile is a living document; we recommend reviewing it whenever things change and at least once a year.
How Complass helps
- 5phases
- 10guided steps
- 3document templates
- 106requirements in the catalogue
Profile process in five phases
Scope, current profile, target profile with tier, gap analysis and action plan, implementation and updates, guided step by step.
106 subcategories with official identifiers
Each outcome with applicability, status, justification and evidence. Titles and hints in our own words, the NIST wording alongside in the original.
Templates
Organisational profile for current and target state, tier assessment and action plan.
Implement once, evidence many times
Complass suggests adopting measures you have already assessed for ISO 27001, NIS2 or IEC 62443.
The phases in the module
- Starting point and scope
- Create the current profile
- Define the target profile and tier
- Gap analysis and action plan
- Implement and keep up to date
Catalogue: NIST CSF 2.0 Core – 106 subcategories
Matching modules
Compliance management
Implement frameworks with guidance: phases, templates, document pyramid, catalogues, gap analysis, objectives and action plan up to the audit in the auditor portal.
Learn moreRisk management
Risk register with qualitative or quantitative assessment, risk appetite and treatment plan, linked to assets, vulnerabilities and incidents.
Learn moreAsset management
IT and OT assets in one place, agentless capture, with SBOM, vendor advisories, end of support, licence reconciliation, identities, relationships and zones per IEC 62443-3-2.
Learn moreFrequently asked questions
Is there a CSF certificate?
No. The CSF cannot be certified. Complass helps you describe and evidence your position as a profile; no certificate or label results.
What is a tier?
The four tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how established your governance and risk management are overall. You record the current and target tier in a template.
We already work to ISO 27001. Do we have to record everything again?
No. Through the shared controls, Complass suggests adopting assessments and evidence. You check each suggestion on its merits before confirming it.
Does the CSF replace NIS2 or ISO 27001?
No. It complements them as a way to present your position to customers and insurers. Legal duties remain.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.