The NIST CSF 2.0 Software That Drives the Framework's Six Functions

No. The five original functions stay in place, so most of the work already done on Identify, Protect, Detect, Respond and Recover carries over. The changes to handle are specific: the new Govern function, which takes in the governance and supplier risk outcomes previously attached to Identify, and the renumbering of some categories and subcategories. The sensible route is to map your existing assessment onto the 2.0 subcategories, then reassess only the ones that genuinely moved.

ISO/IEC 27001 is a certifiable standard: it requires an information security management system, with a defined scope, a policy, management review and an audit by an accredited certification body. The NIST CSF describes expected security outcomes, organised into functions and subcategories, without imposing a management system and without granting any certificate. The two combine well: the CSF gives you a reading and communication grid, ISO 27001 gives you the proof a customer or an insurer will accept.

Govern deals with what frames security rather than what implements it: organisational context, risk management strategy, roles and responsibilities, policy, oversight of results, and cybersecurity supply chain risk management. It is the function that ties security to business priorities and names who decides, who arbitrates and who answers for the outcome. It is also the hardest one to hold in a spreadsheet, because its outputs are decisions and trade-offs rather than ticked boxes.

The Tiers, from Partial to Adaptive, describe how rigorously an organisation governs and manages its cyber risk: how formalised the practices are, how third-party risk is taken into account, how far security is integrated into wider decisions. They are neither a per-control maturity score nor a target to push to the maximum: the Tier you aim for follows your context, your obligations and your means. Read them alongside profiles, not instead of them: the profile says where you stand subcategory by subcategory, the Tier says how you steer the whole.

No. NIS2 and DORA set their own legal obligations: risk management measures, incident reporting, oversight of third-party providers, accountability for management bodies. The CSF is not a compliance framework recognised by those texts, and no profile creates a presumption of conformity. It still works as a backbone: structuring your measures across the six functions, then mapping each subcategory onto the applicable requirements, lets you handle the shared ground once and isolate what belongs to each text.

To get started, yes. The limit arrives quickly: every subcategory carries a current state, a target state, a rationale, evidence, an owner and a due date, and you need the history to show a trajectory. Add the mapping onto ISO 27001 or SP 800-53 and you are maintaining a matrix by hand every time a control changes. A spreadsheet does not record who changed what, does not tie a subcategory to dated evidence, and cannot replay the gap after a reorganisation.

Through documentation rather than a certificate: a dated current profile backed by evidence attached to each subcategory, an owned target profile, and a tracked action plan. An independent third-party assessment remains possible, but it does not commit NIST and produces no official label. If the person asking wants proof they can rely on contractually, an ISO 27001 certificate or an audit report is what you hand over, with the CSF profile used to explain the trajectory.