NIST CSF 2.0 Functions Explained — Intuitive Cyber Security

What is NIST CSF 2.0?

The NIST Cybersecurity Framework (CSF) is developed by the United States National Institute of Standards and Technology. Originally released for critical infrastructure, Version 2.0 (released in early 2024) expanded the framework to apply to organizations of all sizes, sectors, and maturity levels globally.

Unlike prescriptive compliance checklists, NIST CSF is outcome-based: it describes what security results your organization should achieve, leaving the choice of specific technologies to your leadership.

The Six Core Functions of CSF 2.0

Version 2.0 introduced a major evolution by adding Govern (GV) as the central overarching pillar, elevating cybersecurity from an IT problem to an executive board responsibility.

                  ┌──────────────────────┐
                  │     GOVERN (GV)      │
                  └──────────┬───────────┘
                             │
     ┌─────────────┬─────────┴─────────┬─────────────┐
     ▼             ▼                   ▼             ▼
IDENTIFY (ID)  PROTECT (PR)       DETECT (DE)   RESPOND (RS)
                                                     │
                                                     ▼
                                                RECOVER (RC)

1. GOVERN (GV) — The Strategic Anchor

Focus: Establishing and monitoring your organization's cybersecurity risk management strategy, policies, and executive oversight.
Key Categories: Organizational context, risk management strategy, roles and responsibilities, policy suite, and supply chain risk oversight (GV.SC).

2. IDENTIFY (ID) — Understanding Your Attack Surface

Focus: Determining current cybersecurity risks to systems, people, assets, data, and capabilities.
Key Categories: Asset management (hardware, software, cloud services), risk assessment, and improvement feedback.

3. PROTECT (PR) — Safeguarding Critical Workloads

Focus: Deploying safeguards to manage risk and prevent unauthorized intrusion or accidental data leakage.
Key Categories: Identity management, authentication and access control (PR.AA), awareness training, data security (encryption), and platform security.

4. DETECT (DE) — Finding Anomalies Fast

Focus: Discovering and analyzing potential cybersecurity attacks and compromises before significant damage occurs.
Key Categories: Continuous security monitoring, anomaly analysis, and alert triage.

5. RESPOND (RS) — Containing the Impact

Focus: Taking swift action upon discovery of an active cybersecurity incident.
Key Categories: Incident management, internal/external communication, technical analysis, and mitigation/containment.

6. RECOVER (RC) — Restoring Normal Business

Focus: Restoring assets, systems, and operations affected by a cybersecurity event.
Key Categories: Incident recovery execution and public/customer communications.

Practical Application

Start with a Current Profile vs. Target Profile assessment. Rate your maturity in each function on a scale from Tier 1 (Partial) to Tier 4 (Adaptive), identify the largest operational gaps, and invest resources where business impact is highest.