NIST CSF NIST Cybersecurity Framework.

What the NIST CSF is, and what it is not

The NIST Cybersecurity Framework is a structured way to organise a cybersecurity programme around outcomes rather than products. It does not tell you which firewall to buy or which control to deploy. Instead it describes what good looks like, grouping cybersecurity activity into a small set of functions and breaking each function into categories and subcategories that read as plain-language outcomes: assets are inventoried, access is managed, anomalies are detected, response plans are executed. That outcome orientation is why it travels so well across sectors and sizes. A hospital, a manufacturer, and a software vendor can all use the same vocabulary to describe where they stand and where they want to be.

The most important thing to understand is what the framework is not. It is not a certifiable standard. There is no NIST CSF certificate, no accredited body that issues a pass, and no audit that ends in a registered mark on your website. It is a voluntary reference you use to assess maturity, set targets, and communicate posture, both internally to a board and externally to partners. Treat a vendor claim of being "NIST CSF certified" as a red flag, because no such certification exists.

The functions: from five to six

The framework is built around functions that together cover the full lifecycle of managing cyber risk. The original five were Identify, Protect, Detect, Respond, and Recover. The 2.0 revision published in 2024 added Govern, raising the total to six and placing governance at the centre of the model rather than treating it as an afterthought. Govern covers the organisational context, risk management strategy, roles and responsibilities, policy, and oversight that should shape how the other five functions are prioritised and resourced. Adding it formalised what mature programmes already did: technical controls only work when someone owns the risk decisions behind them.

In practice a team scores its current state against each category, defines a target profile that reflects its risk appetite and obligations, and works the gap between the two. The framework deliberately leaves the how to you, which is why it pairs naturally with prescriptive catalogues such as the CIS Controls or NIST 800-53 that supply the concrete safeguards underneath each outcome.

Why it sits next to ISO 27001

NIST CSF and ISO 27001 are not competitors, and many transatlantic organisations run both. ISO 27001 certifies that you operate an information security management system, with a risk assessment, a Statement of Applicability, and continual improvement, and it produces an auditable certificate that customers recognise worldwide. The NIST CSF gives you a flexible maturity language and a way to express posture to a US-leaning audience or to map against US federal expectations.

A common pattern is to certify the management system under ISO 27001 for the credential, then use the CSF profile to communicate maturity and to align with frameworks and customers that speak in NIST terms. NIST publishes informative references that map CSF subcategories to ISO 27001 and other standards, so the work rarely needs to be done twice.