Menu
NIST CSF
Bottom line
NIST CSF is a voluntary framework, not a certification. NIST issues nothing. Organizations use it as a maturity benchmark, often validated by a third-party scored assessment. Assessment cost runs $12K–$80K over 5–10 weeks, with implementation remediation typically adding $50K–$500K+.
One of 10 compliance framework explainers we maintain.
Key facts
- Controls
- 6 Functions (Govern, Identify, Protect, Detect, Respond, Recover), 23 Categories, 106 Subcategories (CSF 2.0)
- Recertification cycle
- Voluntary maturity benchmark (no certification, no expiry)
- Common gap categories
- Govern function (GV, new in CSF 2.0); Asset management (ID.AM); Supply chain risk (GV.SC); Detection processes (DE); Recovery planning (RC.RP)
- Related standards
- NIST SP 800-53NIST SP 800-171ISO 27001CIS ControlsCOBIT
What is NIST CSF?
The NIST Cybersecurity Framework 2.0 (National Institute of Standards and Technology, US Department of Commerce, released February 26, 2024) is a voluntary, outcome-based framework covering six functions (Govern, Identify, Protect, Detect, Respond, Recover) applicable to organizations of any size or sector globally.
Is NIST CSF a certification or an attestation?
NIST CSF has no certification and no issuing body that grants attestations. It is a voluntary framework. Third-party maturity assessments can be commissioned from assessor firms, which produce a scored report, but NIST itself issues nothing.
Who needs NIST CSF?
Commonly used as a board-level governance baseline in financial services, critical infrastructure, and large enterprise. Increasingly requested in vendor security questionnaires and cyber insurance underwriting as a maturity benchmark.
What does NIST CSF cost and how long does it take?
Range
$12K–$80K assessment / 5–10 weeks
No certification fee. Third-party maturity assessments: $12K–$80K over 5–10 weeks. Implementation and remediation to reach a meaningful maturity level adds $50K–$500K+ depending on starting posture.
One thing to watch
Distinguish assessment cost (the third-party scored report) from implementation cost (remediating gaps). Conflating them produces wildly different numbers.
Sources
Last verified 2026-05-13. Found a stale or wrong source? Email hello@soc2auditors.org.