NIST Cybersecurity Framework
S. National Institute of Standards and Technology that helps organizations manage and reduce cybersecurity risk through a common, flexible structure.
Definition
The NIST Cybersecurity Framework (CSF) is a voluntary framework developed by the U.S. National Institute of Standards and Technology that helps organizations manage and reduce cybersecurity risk through a common, flexible structure.
Overview
First released in 2014 for critical infrastructure and updated multiple times since (notably CSF 2.0 in 2024), the framework is organized around core functions that describe the full lifecycle of managing cyber risk: Govern, Identify, Protect, Detect, Respond, and Recover. Each function breaks down into categories and subcategories of outcomes, giving organizations a common vocabulary to describe their current security posture and target state, without prescribing specific tools or technologies. Unlike prescriptive standards, the CSF is intentionally flexible — it can be adopted by organizations of any size or sector and mapped to other frameworks such as ISO 27001 or industry-specific regulations like HIPAA. Organizations typically use it to assess their current risk profile, set improvement priorities, and communicate cybersecurity posture to executives, boards, and partners in consistent language. Because it underpins so much of U.S. public and private-sector risk management guidance, the CSF is a foundational reference in Governance, Compliance & Career Readiness.
Key Features
- Developed and maintained by NIST, a U.S. federal standards agency
- Organized around six core functions: Govern, Identify, Protect, Detect, Respond, Recover
- Voluntary and technology-agnostic, applicable to any organization size or sector
- Provides a common vocabulary for describing cybersecurity posture
- Maps to other frameworks and regulatory requirements
- CSF 2.0 (2024) added the Govern function to emphasize risk oversight