NIST Cybersecurity Framework 2.0
The current CSF, including the GOVERN function. Used as the hub other frameworks crosswalk through, so evidence you map once counts in more than one place.
What NIST Cybersecurity Framework 2.0 is
CSF 2.0, published in February 2024, is the first substantial revision of the Cybersecurity Framework since 1.1. The headline change is GOVERN, a sixth function sitting alongside Identify, Protect, Detect, Respond and Recover, which pulls organisational context, risk strategy, roles, policy and supply-chain risk management out of Identify and gives them their own home. The second change is scope: 1.1 was written for critical infrastructure, 2.0 is explicitly written for every organisation.
CSF is not a control catalogue and never was. Its subcategories are outcomes — "Improvements are identified from evaluations", "Authorized users, services, and hardware are managed by the organization" — which is what makes it a poor certification target and an excellent common language. It is the framework you use to talk to a board, and the framework other frameworks map through.
That mapping role is why CSF matters operationally even to organisations with no intention of "doing CSF". If your ISO 27001, SOC 2, HIPAA and PCI programmes each map to CSF, they transitively map to each other.
Who it applies to
- Any organisation that needs a defensible security programme structure without a certification driver.
- Boards and executives, who get five or six functions instead of hundreds of controls.
- Organisations running several frameworks at once, for whom CSF is the cheapest way to see where they overlap.
- US federal contractors and critical-infrastructure operators, where CSF alignment is frequently referenced in contracts.
How it is structured in CMDash
CMDash seeds the CSF 2.0 subcategories, grouped by function. Subcategories are the level at which the framework states an outcome, so they are the level at which evidence attaches.
| Govern (GV) | 31 |
| Identify (ID) | 21 |
| Protect (PR) | 22 |
| Detect (DE) | 11 |
| Respond (RS) | 13 |
| Recover (RC) | 8 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
The control text
106 of the 106 seeded controls carry the publisher’s own wording, taken from NIST Cybersecurity Framework (CSF) 2.0. It is public-domain content, so CMDash reproduces it rather than paraphrasing — you assess against what the publisher wrote.
What CMDash does for NIST Cybersecurity Framework 2.0
- Every subcategory carries verbatim CSF 2.0 text. The publication is US-government public domain, so nothing is paraphrased.
- CSF 2.0 is the crosswalk hub. It has the largest number of seeded control-to-control mappings of any framework in the catalogue, including a direct mapping to CSF 1.1 for organisations still reporting against the older version during a migration.
- A dedicated function-level dashboard scores each function from your control statuses, so the board view and the control detail are the same data rather than two spreadsheets.
- The regulatory radar maps both NIS2 and the SEC cyber-disclosure rules onto specific CSF 2.0 subcategories, turning your control state into a readiness percentage against each.
- A maturity pack for the CSF 2.0 Implementation Tiers ships alongside the control set, so tier assessment sits next to the subcategory evidence rather than in a separate document.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to NIST Cybersecurity Framework 2.0’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- CSF is not certifiable. No auditor issues a CSF certificate, and CMDash does not pretend otherwise.
- The Informative References that map CSF to 800-53, ISO 27001 and others in NIST's own published crosswalks are not imported wholesale. CMDash ships its own curated mappings, which are narrower and confidence-scored.
- Organisational Profiles and Community Profiles are not modelled as a distinct object.
Common questions
Should we move from CSF 1.1 to 2.0?
For a new programme, yes, unequivocally — 1.1 is superseded. For an existing programme mid-assessment, CMDash seeds both and a direct 1.1-to-2.0 crosswalk, so you can report against 1.1 while building 2.0 rather than doing a hard cutover.
What is actually new in GOVERN?
Mostly relocation rather than invention: organisational context, risk management strategy, roles and responsibilities, policy, oversight and cybersecurity supply-chain risk management. If you already did those under Identify in 1.1 you have the substance; what changes is that they are now reported on their own rather than buried.
Does CSF replace ISO 27001?
No. CSF describes outcomes; 27001 certifies a management system. Organisations that need a certificate need 27001. Organisations that need a way to explain their programme use CSF. Many run both, which is why the crosswalk between them is one of the largest CMDash seeds.
Also in Security Programs
Paid plans cap how many frameworks you run at once, never which ones — NIST Cybersecurity Framework 2.0 is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.