Current Edition Checked October 24, 2026
Version 2.0 added the Govern function and widened the scope from critical infrastructure to every organization.
What It Covers
A common language for managing cybersecurity risk, organized into six functions with categories and subcategories of outcomes.
Who It Applies To
Any organization, of any size or sector, as a voluntary framework; often named by customers, insurers, and regulators.
Key Requirements
- Six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
- Current and target profiles that show where the organization is and where it needs to be.
- Tiers that describe the rigor of cybersecurity risk governance and management.
- Supply chain risk management folded into the Govern function.
What an Auditor Asks to See
- The current and target profiles, and the plan to close the gap.
Where Systems Fall Short
- Profiles produced once for a board meeting and never updated.
How QES Helps
Through QES’s risk and cybersecurity partner: CSF 2.0 profiles linked to the enterprise risk register.
Related Standards
Sources. NIST — Cybersecurity Framework (opens in a new tab). Status checked October 24, 2026. This page summarizes NIST CSF 2.0; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.