Menu
Key facts
- Controls
- 6 Functions (Govern, Identify, Protect, Detect, Respond, Recover), 23 Categories, 106 Subcategories (CSF 2.0)
- Recertification cycle
- Voluntary maturity benchmark (no certification, no expiry)
- Common gap categories
- Govern function (GV, new in CSF 2.0); Asset management (ID.AM); Supply chain risk (GV.SC); Detection processes (DE); Recovery planning (RC.RP)
- Related standards
What is NIST CSF?
The NIST Cybersecurity Framework 2.0 (National Institute of Standards and Technology, US Department of Commerce, released February 26, 2024) is a voluntary, outcome-based framework covering six functions (Govern, Identify, Protect, Detect, Respond, Recover) applicable to organizations of any size or sector globally.
Is NIST CSF a certification or an attestation?
NIST CSF has no certification and no issuing body that grants attestations. It is a voluntary framework. Third-party maturity assessments can be commissioned from assessor firms, which produce a scored report, but NIST itself issues nothing.
Who needs NIST CSF?
Commonly used as a board-level governance baseline in financial services, critical infrastructure, and large enterprise. Increasingly requested in vendor security questionnaires and cyber insurance underwriting as a maturity benchmark.
What does NIST CSF cost and how long does it take?
No certification fee. Third-party maturity assessments: $12K–$80K over 5–10 weeks. Implementation and remediation to reach a meaningful maturity level adds $50K–$500K+ depending on starting posture.
Distinguish assessment cost (the third-party scored report) from implementation cost (remediating gaps). Conflating them produces wildly different numbers.