Information SecurityUnited States
NIST Cybersecurity Framework 2.0
What is NIST Cybersecurity Framework 2.0?
Voluntary framework for managing and reducing cybersecurity risk, organized around six core functions. It comprises 106 controls organised across 7 domains, published by NIST, and applies in the United States.
How NIST Cybersecurity Framework 2.0 maps to other frameworks
All 106 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 7 domains NIST Cybersecurity Framework 2.0 groups its controls into
ID - Identify
Recover
Respond
Detect
Protect
Where NIST Cybersecurity Framework 2.0 overlaps with the standards you already hold
Step-by-step implementation of NIST Cybersecurity Framework 2.0
More NIST Cybersecurity Framework 2.0 comparisons
NIST Cybersecurity Framework 2.0 vs ISO 27001:2022View comparison →NIST Cybersecurity Framework 2.0 vs SOC 2View comparison →NIST Cybersecurity Framework 2.0 vs GDPRView comparison →NIST Cybersecurity Framework 2.0 vs HIPAAView comparison →NIST Cybersecurity Framework 2.0 vs PCI DSS 4.0View comparison →NIST Cybersecurity Framework 2.0 vs NIST 800-53View comparison →
Analysis of NIST Cybersecurity Framework 2.0
How to Execute Cross-Framework Control Mapping Between NIST CSF 2.0 and CIS Controls v8 for Enterprise Cybersecurity StrategyEnterprise organizations need systematic approaches to align NIST CSF 2.0's six functions with CIS Controls v8's safeguards for comprehensive cybersecurity strategy implementation. This technical guide provides detailed control mapping methodologies and practical implementation steps for compliance teams managing multiple framework requirements.
How to Execute NIST CSF 2.0 Govern Function Requirements with ASD Essential Eight Maturity Model Integration for Government Agency Cyber ResilienceThe NIST Cybersecurity Framework 2.0 introduced a dedicated Govern function that requires systematic organizational context and risk management capabilities. Government agencies can achieve comprehensive cyber resilience by mapping these governance requirements to the ASD Essential Eight's maturity levels, creating measurable security outcomes that satisfy both frameworks simultaneously.
How to Execute Third-Party Risk Management Integration with NIST Cybersecurity Framework 2.0 Govern Function for Supply Chain Security GovernanceNIST CSF 2.0's new Govern function emphasizes organizational cybersecurity governance, including supply chain risk management requirements. Integrating comprehensive third-party risk management with CSF 2.0 Govern creates systematic approaches to vendor security oversight and supply chain resilience.
How to Execute Supply Chain Cyber Risk Assessment Integration with NIST Cybersecurity Framework 2.0 Govern Function for Critical Infrastructure SuppliersCritical infrastructure organizations must systematically assess cybersecurity risks across complex supply chains involving hundreds of third-party suppliers. This guide details implementation strategies for integrating supply chain cyber risk assessment with NIST CSF 2.0 Govern function requirements, including supplier classification, risk scoring methodologies, and continuous monitoring frameworks.
Training that covers NIST Cybersecurity Framework 2.0
Where to get trained on NIST Cybersecurity Framework 2.0
2 courses in the catalogue cover NIST Cybersecurity Framework 2.0 directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
NIST Cybersecurity Framework 2.0 Compliance Playbook for Education$249 USDAI-Driven NIST Cybersecurity Framework 2.0 Implementation Guide for Education$299 USD
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What NIST Cybersecurity Framework 2.0 means in your sector
NIST Cybersecurity Framework 2.0 for Healthcare→NIST Cybersecurity Framework 2.0 for Financial Services→NIST Cybersecurity Framework 2.0 for Technology→NIST Cybersecurity Framework 2.0 for Government→NIST Cybersecurity Framework 2.0 for Manufacturing→NIST Cybersecurity Framework 2.0 for Energy→NIST Cybersecurity Framework 2.0 for Retail→NIST Cybersecurity Framework 2.0 for Education→
What NIST Cybersecurity Framework 2.0 means for your job
Questions people ask about NIST Cybersecurity Framework 2.0
What is NIST Cybersecurity Framework 2.0?
Voluntary framework for managing and reducing cybersecurity risk, organized around six core functions.
How many controls does NIST Cybersecurity Framework 2.0 have?
NIST Cybersecurity Framework 2.0 contains 106 controls organized across 7 domains.
Where does NIST Cybersecurity Framework 2.0 apply?
NIST Cybersecurity Framework 2.0 is applicable in United States. Organizations operating in or serving customers in this jurisdiction should evaluate its requirements.
What frameworks does NIST Cybersecurity Framework 2.0 map to?
NIST Cybersecurity Framework 2.0 has control-to-control mappings with 251 other compliance frameworks in our database. Use our compliance platform to explore these mappings interactively.
How do I get started with NIST Cybersecurity Framework 2.0 compliance?
Start by understanding the framework's key controls and domains. Our compliance platform provides AI-powered gap analysis and mapping tools to help you assess your current posture and build a remediation plan.
Query NIST Cybersecurity Framework 2.0 programmatically
NIST Cybersecurity Framework 2.0, its 106 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
NIST Cybersecurity Framework 2.0 API reference and MCP config →What NIST Cybersecurity Framework 2.0 requires, control by control
Each page carries the requirement text for one NIST Cybersecurity Framework 2.0 control and what an assessor expects to see as evidence.
- NIST-CSF-DE-AE-02 Potentially adverse events are analyzed to better understand associated activities
- NIST-CSF-DE-AE-03 Information is correlated from multiple sources
- NIST-CSF-DE-AE-04 The estimated impact and scope of adverse events are understood
- NIST-CSF-DE-AE-06 Information on adverse events is provided to authorized staff and tools
- NIST-CSF-DE-AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis
- NIST-CSF-DE-AE-08 Incidents are declared when adverse events meet the defined incident criteria
- NIST-CSF-DE-CM-01 Networks and network services are monitored to find potentially adverse events
- NIST-CSF-DE-CM-02 The physical environment is monitored to find potentially adverse events
- NIST-CSF-DE-CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
- NIST-CSF-DE-CM-06 External service provider activities and services are monitored to find potentially adverse events
How much of another standard NIST Cybersecurity Framework 2.0 already covers
Each crosswalk is judged control by control, and the mappings that were rejected are kept alongside the ones that held.
- ACSC Essential Eight to NIST Cybersecurity Framework 2.0 crosswalk
- ANSSI Guide d'hygiene informatique (42 mesures, v2.0) to NIST Cybersecurity Framework 2.0 crosswalk
- APRA CPS 220 Risk Management to NIST Cybersecurity Framework 2.0 crosswalk
- APRA CPS 230 Operational Risk Management to NIST Cybersecurity Framework 2.0 crosswalk
- APRA CPS 234 to NIST Cybersecurity Framework 2.0 crosswalk
- ASD Strategies to Mitigate Cyber Security Incidents to NIST Cybersecurity Framework 2.0 crosswalk
- Australia Consumer Data Right - Banking (CDR) to NIST Cybersecurity Framework 2.0 crosswalk
- Australia My Health Records Act 2012 to NIST Cybersecurity Framework 2.0 crosswalk
How ready are you for NIST Cybersecurity Framework 2.0?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.
Written and maintained by Gerard Blokdyk, The Art of Service.Last updated .