NIST Cybersecurity Framework 2.0

NIST CSF 2.0, mapped function by function

The six CSF 2.0 functions and their 106 subcategories, mapped in SmartAssessor’s standards library.

NIST CSF 2.0

NIST CSF 2.0 describes cyber security outcomes in six functions, from governance to recovery.

NIST CSF 2.0 is mapped in SmartAssessor; assessments are in development. SmartAssessor doesn’t provide certification or accreditation.

HOW IT’S STRUCTURED

The framework, function by function

Six functions, each broken into categories and subcategories.

GVGovern
31 subcategories
IDIdentify
21 subcategories
PRProtect
22 subcategories
DEDetect
11 subcategories
RSRespond
13 subcategories
RCRecover
8 subcategories

Common NIST CSF 2.0 assessment challenges

Outcomes, not controls

CSF says what to achieve, not how, so evidence varies widely.

The new Govern function

Governance evidence is new to many teams.

Profiles and tiers

Current and target profiles need consistent judgment.

Mapping to other standards

Most organizations assess to CSF alongside something else.

Subcategories, marked

An illustrative example of how a few subcategories look once marked.

GV.OC-01Mission understood and informs cybersecurity risk managementMet
PR.AA-01Identities and credentials managedPartly met
DE.CM-01Networks and network services monitoredNot met

For assessors

  • Every subcategory marked, with reasons
  • Each subcategory mapped to the evidence that supports it
  • Shared evidence with ISO 27001:2022 and PCI DSS v4.0.1

For organizations

  • See which evidence each subcategory needs
  • Evidence from connected systems
  • Gaps prioritized by function
Maps toISO 27001:2022 →PCI DSS v4.0.1 →Shares 101 evidence artefacts with ISO 27001:2022 and 70 with PCI DSS v4.0.1

See what an AI-marked assessment looks like

See an assessment Book a demo