Withdrawn Draft
Warning Notice
The attached draft document has been withdrawn and is provided solely for historical purposes.
It has been followed by the document identified below.
Withdrawal Date February 26, 2024
Original Release Date August 8, 2023

The attached draft document is followed by:
Status Final
Series/Number NIST CSWP 29
Title The NIST Cybersecurity Framework (CSF) 2.0
Publication Date February 26, 2024
DOI https://doi.org/10.6028/NIST.CSWP.29
CSRC URL https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurityframework-csf-20/final
Additional Information https://www.nist.gov/cyberframework

Public Draft: The NIST Cybersecurity Framework 2.0
National Institute of Standards and Technology
Released August 8, 2023

Note to Reviewers
This is the public draft of the NIST Cybersecurity Framework (CSF or Framework) 2.0.
The Framework has been used widely to reduce cybersecurity risks since its initial publication in 2014. Manyorganizations have told NIST that CSF 1.1 remains an effective framework for addressing cybersecurity risks.
There is also widespread agreement that changes are warranted to address current and future cybersecurity
challenges and to make it easier for organizations to use the Framework. NIST is working with the community
to ensure that CSF 2.0 is effective for the future while fulfilling the CSF’s original goals and objectives.
NIST seeks feedback on whether this draft revision addresses organizations’ current and anticipated future
cybersecurity challenges, is aligned with leading practices and guidance resources, and reflects comments
received so far. In addition, NIST requests ideas on the best way to present the modifications from CSF 1.1 to
CSF 2.0 to support transition. NIST encourages concrete suggestions for improvements to the draft, including
revisions to the narrative and Core.
This draft includes an updated version of the CSF Core, reflecting feedback on the April discussion draft. Thispublication does not contain Implementation Examples or Informative References of the CSF 2.0 Core, given
the need to frequently update them. Draft, initial Implementation Examples have been released under separate
cover for public comment. NIST seeks feedback on what types of Examples would be most beneficial to
Framework users, as well as what existing sources of implementation guidance might be readily adopted assources of Examples (such as the NICE Framework Tasks, for example). NIST also seeks feedback on how
often Implementation Examples should be updated and whether and how to accept Implementation Examples
developed by the community.
As the CSF 2.0 is finalized, the updated Implementation Examples and Informative References will bemaintained online on the NIST Cybersecurity Framework website, leveraging the NIST Cybersecurity andPrivacy Reference Tool (CPRT). Resource owners and authors who are interested in mapping their resources tothe final CSF 2.0 to create Informative References should reach out to NIST.
Feedback on this CSF 2.0 Public Draft, as well as the related Implementation Examples draft, may besubmitted to cyberframework@nist.gov by Friday, November 4, 2023.
All relevant comments, including attachments and other supporting material, will be made publicly available on
the NIST CSF 2.0 website. Personal, sensitive, confidential, or promotional business information should not be
included. Comments with inappropriate language will not be considered.
This draft will be discussed at the third CSF workshop, which will be held this fall. NIST does not plan torelease another draft of CSF 2.0 for comment. Feedback on this draft will inform development of the
final CSF 2.0 to be published in early 2024.

The modifications between Version 1.1 and this version are based on community input through:•The 57 responses to the Discussion Draft of the NIST Cybersecurity Framework 2.0 Core•

The 92 written responses to the January 2023 CSF 2.0 Concept Paper•

The February 2023 In-Person Working Sessions (attended by approximately 250 participants)•

The “Journey to the NIST Cybersecurity Framework 2.0” February 2023 Workshop #2 (attended virtually
by more than 2,000 participants from 69 countries)•

The “Journey to the NIST Cybersecurity Framework 2.0” August 2022 Workshop #1 (attended virtually byapproximately 4,000 participants from 100 countries)•

The 134 written responses to the February 2022 NIST Cybersecurity RFI•

Feedback from organizations that have leveraged the CSF over the years•

NIST participation at conferences, webinars, roundtables, and meetings around the world

Cherilyn Pascoe
NIST Cybersecurity Framework Program Leadcyberframework@nist.gov

Summary of selected Framework changes from version 1.1 to this draft:•

Recognize broad use of the Framework:o Title changed to the commonly used name, “Cybersecurity Framework” from the original“Framework for Improving Critical Infrastructure Cybersecurity.”o Scope of the Framework has been updated to reflect use by all organizations; the original emphasison critical infrastructure application in the narrative and Core has been modified to focus on allorganizations.
o Original emphasis on securing U.S. critical infrastructure has been modified to focus onorganizations all around the world to reflect the broad and international use of the Framework.

•

Relate CSF to other Frameworks and resources:o NIST reviewed updates to resources published in recent years to identify changes to the narrativeand Core; this includes new references to the NIST Privacy Framework, NICE Workforce
Framework for Cybersecurity (SP 800-181), Secure Software Development Framework (SP 800218), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (SP800-161r1), Performance Measurement Guide for Information Security (SP 800-55), Integrating
Cybersecurity and Enterprise Risk Management (NIST IR 8286) series, and the Artificial
Intelligence Risk Management Framework (AI 100-1).
o While not included in this draft, in the future NIST will release an online tool on the NIST CSF
website to host the CSF 2.0 Core, with human- and machine-readable formats. This new tool willallow organizations to see the relationships online between the Core and updatable Informative
References.

•

Increase guidance on CSF implementation:o Implementation Examples added to provide notional examples of action-oriented processes toachieve CSF Subcategories.
o Framework Profiles guidance revised significantly and expanded to provide guidance on the steps
for using Profiles and to illustrate several purposes for Profiles.
o Notional templates developed that organizations can use or adapt for creating their Profiles andaction plans.

•

Emphasize cybersecurity governance:o New Function, Govern, added to cover organizational context; risk management strategy;
cybersecurity supply chain risk management; roles, responsibilities, and authorities; policies,
processes, and procedures; and oversight.
o New guidance offered on integrating the Framework with the NIST Privacy Framework and withenterprise risk management as discussed in NIST IR 8286.
o Focus on people, process, and technology expanded throughout the implementation of the
Framework.

•

Emphasize cybersecurity supply chain risk management:o New Category in Govern focused on cybersecurity supply chain risk management.

o Content updated to reflect the latest NIST guidance and Framework practices related tocybersecurity supply chain risk management and secure software development.
•

Clarify understanding of cybersecurity measurement and assessment:o Information on cybersecurity assessment updated, with new pointers to NIST SP 800-55.
o Tiers clarified to focus on cybersecurity governance, risk management, and third-party
considerations.

o Importance of continuous improvement is emphasized through a new Improvement Category in the
Identify Function, as well as improvements in guidance on developing and updating Profiles andaction plans.

The NIST Cybersecurity
Framework 2.0
Initial Public Draft

National Institute of Standards and Technology

This publication is available free of charge from:https://doi.org/10.6028/NIST.CSWP.29.ipd

August 8, 2023

Initial Public Draft

The NIST Cybersecurity Framework 2.0

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified inthis paper in order to specify the experimental procedure adequately. Such identification does not imply
recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or
equipment identified are necessarily the best available for the purpose.
NIST Technical Series Policies
Copyright, Use, and Licensing Statements
NIST Technical Series Publication Identifier Syntax
How to Cite this NIST Technical Series Publication:
National Institute of Standards and Technology (2023) The NIST Cybersecurity Framework 2.0. (National Instituteof Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 29 ipd.
https://doi.org/10.6028/NIST.CSWP.29.ipd
Public Comment Period
August 8, 2023 – November 4, 2023
Submit Comments
cyberframework@nist.gov
National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000
All comments are subject to release under the Freedom of Information Act (FOIA).

Initial Public Draft

The NIST Cybersecurity Framework 2.0

1

Abstract

2
3
4
5
6
7
8
9

The NIST Cybersecurity Framework 2.0 provides guidance to industry, government agencies,
and other organizations to reduce cybersecurity risks. It offers a taxonomy of high-levelcybersecurity outcomes that can be used by any organization — regardless of its size, sector, or
maturity — to better understand, assess, prioritize, and communicate its cybersecurity efforts.
The Framework does not prescribe how outcomes should be achieved. Rather, it maps toresources that provide additional guidance on practices and controls that could be used to achieve
those outcomes. This document explains Cybersecurity Framework 2.0 and its components anddescribes some of the many ways that it can be used.

10

Keywords

1112
13

cybersecurity; Cybersecurity Framework; cybersecurity risk governance; cybersecurity risk
management; cybersecurity supply chain risk management; enterprise risk management; Privacy
Framework; Profiles.

14

Acknowledgments

15
16
17
18

This Framework is the result of a collaborative effort across industry, academia, and government
in the United States and around the world. NIST acknowledges and thanks all of those who havecontributed to this revised Framework. Information on the Framework development process,including workshops and drafts, can be found on the NIST Cybersecurity Framework website.

19
20

Lessons learned on the use of the Framework can always be shared with NIST throughcyberframework@nist.gov.

iInitial Public Draft

The NIST Cybersecurity Framework 2.0

21

Table of Contents

22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

Executive Summary .................................................................................................................... 1

47

List of Tables

48
49
50
51
52
53
54
55
56
57

Table 1. Notional organizational profile template ........................................................................ 23
Table 2. Notional action plan template ........................................................................................ 25
Table 3. Framework Tiers ........................................................................................................... 26
Table 4. CSF 2.0 Core Function and Category Names and Identifiers ....................................... 29
Table 5. GOVERN (GV): Establish and monitor the organization’s cybersecurity risk
management strategy, expectations, and policy ......................................................................... 30
Table 6. IDENTIFY (ID): Help determine the current cybersecurity risk to the organization ....... 33
Table 7. PROTECT (PR): Use safeguards to prevent or reduce cybersecurity risk ................... 36
Table 8. DETECT (DE): Find and analyze possible cybersecurity attacks and compromises .... 40
Table 9. RESPOND (RS): Take action regarding a detected cybersecurity incident .................. 41

Introduction ......................................................................................................................... 2
Audience ........................................................................................................................... 3
Document Structure .......................................................................................................... 4
Understanding the Framework Core ................................................................................. 4
Functions, Categories, and Subcategories ....................................................................... 5
Implementation Examples and Informative References .................................................... 7
Using the Framework .......................................................................................................... 8
Creating and Using Framework Profiles to Understand, Assess, Prioritize, andCommunicate ................................................................................................................................ 8
Assessing and Prioritizing Cybersecurity Outcomes With the Framework...................... 12
Using Framework Tiers to Characterize Cybersecurity Risk Management Outcomes ... 13
Improving Communication With Internal and External Stakeholders Using the
Framework .................................................................................................................................. 14
Managing Cybersecurity Risk in Supply Chains With the Framework ............................ 16
Integrating Cybersecurity Risk Management With Other Risk Management Domains
Using the Framework ............................................................................................................... 18
Integrating the Cybersecurity Framework With the Privacy Framework ......................... 19
Integrating the Cybersecurity Framework With Enterprise Risk Management ................ 20
Next Steps .......................................................................................................................... 21
Appendix A.

Templates for Profiles and Action Plans..................................................... 23

A.1.

Notional Organizational Profile Template ........................................................................ 23

A.2.

Notional Action Plan Template ........................................................................................ 24

Appendix B.

Framework Tier Descriptions ....................................................................... 26

Appendix C.

Framework Core ............................................................................................ 29ii

Initial Public Draft

The NIST Cybersecurity Framework 2.0

58
59

Table 10. RECOVER (RC): Restore assets and operations that were impacted by acybersecurity incident ................................................................................................................. 43

60

List of Figures

61
62
63
64
65
66
67
68

Fig. 1. Cybersecurity Framework Core ......................................................................................... 5
Fig. 2. Framework Functions ........................................................................................................ 6
Fig. 3. Cybersecurity Framework Profiles ..................................................................................... 9
Fig. 4. Steps for creating and using Cybersecurity Framework Profiles ..................................... 10
Fig. 5. Cybersecurity Framework Tiers ....................................................................................... 13
Fig. 6. Using the Cybersecurity Framework to improve communication ..................................... 15
Fig. 7. Integrating cybersecurity and privacy risks ...................................................................... 19
Fig. 8. Cybersecurity Framework and Privacy Framework alignment ......................................... 20

iii

Initial Public Draft

The NIST Cybersecurity Framework 2.0

69

Executive Summary

70
71
72
73

Cybersecurity risks are a fundamental type of risk for all organizations to manage. Potential
impacts to organizations from cybersecurity risks include higher costs, lower revenue,
reputational damage, and the impairment of innovation. Cybersecurity risks also threaten
individuals’ privacy and access to essential services and can result in life-or-death consequences.

74
75
76

The NIST Cybersecurity Framework (Framework or CSF) 2.0 provides guidance for reducing
cybersecurity risks by helping organizations to understand, assess, prioritize, and communicate
about those risks and the actions that will reduce them.

77
78
79
80
81
82
83

Those actions are intended to address cybersecurity outcomes described within the CSF Core.
These high-level outcomes can be understood by a broad audience, including executives,
government officials, and others who may not be cybersecurity professionals. The outcomes aresector- and technology-neutral, so they provide organizations with the flexibility needed toaddress their unique risk, technology, and mission considerations. These outcomes can be used tofocus on and implement strategic decisions that improve cybersecurity postures (or state) while
also considering organizational priorities and available resources.

84
85
86
87
88

The CSF Core also includes examples of how each outcome can be achieved along withreferences to additional guidance. Together these help an organization address its cybersecurity
priorities. The CSF also describes the concepts of Profiles and Tiers, which are tools to helporganizations put the CSF into practice and set priorities for where they need or want to be interms of reducing cybersecurity risks.

89
90
91

The CSF is a foundational resource that is adopted voluntarily and through governmental
policies and mandates. Its enduring and flexible nature transcends sectors, technologies, andnational borders. The updates in CSF 2.0 address changes in technologies and cybersecurity risk.

92
93
94
95

The CSF should be used in conjunction with other resources (e.g., frameworks, standards,
guidelines, and leading practices) to better manage cybersecurity risks and to inform overallmanagement of cybersecurity and other risks at an enterprise level. Supplemental guidance tothis Framework will be developed and available on the NIST Cybersecurity Framework website.

1

Initial Public Draft
96

The NIST Cybersecurity Framework 2.0

Introduction

97
98
99
100
101
102

The NIST Cybersecurity Framework (Framework or CSF) describes essential cybersecurity
outcomes that can help an organization reduce its cybersecurity risk. The voluntary Framework
is not a one-size-fits-all approach to managing cybersecurity risks. Organizations will continue tohave unique risks — including different threats, vulnerabilities, and risk tolerances, as well as
unique mission objectives and requirements across sectors. Thus, organizations’ implementationsof the Framework, and approaches to managing risk, will vary.

103
104

This collection of cybersecurity outcomes creates a taxonomy and structure that can be used tounderstand, assess, prioritize, and communicate about cybersecurity risks.

105•

Understand and Assess:

106
107

o Describe an organization’s current or target cybersecurity posture within and acrossorganizations, sectors, or business units.

108
109
110

o Determine where an organization may have cybersecurity gaps, including withrespect to existing or emerging threats or technologies, and assess progress toward
addressing those gaps.

111
112
113

o Align policy, business, and technological approaches to managing cybersecurity risks
across an entire organization or in a more focused area, such as a portion of theorganization, a specific technology, or technology suppliers.

114

•

115

o Prioritize opportunities to improve cybersecurity risk management.

116
117
118

o Identify, organize, and prioritize actions for reducing cybersecurity risks that alignwith the organization’s mission, legal and regulatory requirements, and risk
management and governance expectations.

119
120

Prioritize:o Inform decisions about cybersecurity-related workforce needs and capabilities.
•

Communicate:

121
122

o Provide a common language for communicating with internal and external parties
about cybersecurity risks, capabilities, needs, and expectations.

123
124
125
126

o Complement an organization’s risk management process by presenting a concise wayfor executives and others to distill the fundamental concepts of cybersecurity risk sothat they express at a high level risks to be managed and how their organization uses
cybersecurity standards, guidelines, and practices.

127
128
129
130
131
132

The Framework can be used by organizations whose cybersecurity programs are at different
stages of maturity. An organization with an existing cybersecurity program can leverage theFramework to identify opportunities to strengthen and communicate its management ofcybersecurity risk while considering its existing practices and needed changes. An organization
without an existing cybersecurity program can use the Framework as a starting point andreference to establish one.

2

Initial Public Draft

The NIST Cybersecurity Framework 2.0

While many cybersecurity risk management activities focus on conditions that may prevent
mission objectives from being achieved, it is important to also note conditions that may
enable or accentuate mission achievement. Actions to reduce cybersecurity risk might benefit
the organization in other ways, like increasing revenue (e.g., offering excess facility space to
a commercial hosting provider for hosting their own and other organizations’ data centers,then moving a major financial system from the organization’s in-house data center to thehosting provider to reduce cybersecurity risk).
133
134
135
136
137
138
139
140
141
142
143
144

The Framework should be used in conjunction with other resources to better manage
cybersecurity risks. The outcomes are based on and are mapped to existing global standards,
guidelines, and practices. Organizations can use the Framework to efficiently scale theircybersecurity programs, address the dynamic and global nature of cybersecurity risks, and adapt
to technological advances and business and legal requirements. The Framework applies to all
information and communications technology (ICT), including information technology (IT), theInternet of Things (IoT), and operational technology (OT) used by an organization. It also
applies to all types of technology environments, including cloud, mobile, and artificial
intelligence systems. The Framework is forward-looking and is intended to apply to futurechanges in technologies and environments.
Audience

145
146
147
148
149

The Framework is designed to be used by organizations of all sizes and sectors, including
industry, government, academia, and non-profit organizations. The Framework’s taxonomy andreferenced standards, guidelines, and practices are not country-specific, and previous versions of
the Framework have been successfully leveraged by many governments and other organizations
outside of the United States.

150
151
152
153
154

The primary audience for the Framework consists of those responsible for developing andleading a cybersecurity program. The Framework can also be used by others involved inmanaging risk — including executives, boards of directors, acquisition professionals, technology
professionals, risk managers, lawyers, human resources specialists, and cybersecurity and risk
management auditors — to guide their cybersecurity-related decisions.

155
156
157

Additionally, the Framework can be useful to policymakers (such as associations, professionalorganizations, and regulators) to set and communicate priorities for cybersecurity risk
management.

3

Initial Public Draft

The NIST Cybersecurity Framework 2.0

Executive Order 13636, Improving Critical Infrastructure Cybersecurity, issued in February
2013, directed NIST “to lead the development of a framework to reduce cyber risks to criticalinfrastructure.” The Cybersecurity Enhancement Act of 2014 directed NIST to “on an
ongoing basis, facilitate and support the development of a voluntary, consensus-based,industry-led set of standards, guidelines, best practices, methodologies, procedures, andprocesses to cost-effectively reduce cyber risks to critical infrastructure.” NIST published
Framework Version 1.0 in 2014 and updated the Framework to 1.1 in 2018.
Since then, Congress has explicitly directed NIST to consider small business concerns (in the
NIST Small Business Cybersecurity Act) and the needs of institutions of higher education (inthe CHIPS and Science Act) in the Framework. While Version 2.0 can be used by anyorganization, NIST will continue to build additional resources to help implement the
Framework, including an updated NIST Special Publication (SP) 1271, Getting Started with
the NIST Cybersecurity Framework: A Quick Start Guide. All resources will be publicly
available on the NIST Cybersecurity Framework website.
158
Document Structure

159
160

This document contains the following sections and appendices:

161
162

•

Section 2 explains the basics of the Framework Core: Functions, Categories,
Subcategories, Implementation Examples, and Informative References.

163
164
165
166

•

Section 3 provides an overview of common uses for the Framework, including throughCurrent and Target Profiles, as well as guidance on using the Framework to understand,assess, prioritize, and communicate cybersecurity efforts and cybersecurity supply chain
risk management efforts.

167
168

•

Section 4 discusses using the Framework to help integrate cybersecurity risk managementwith other types of risk management.

169•

Section 5 briefly outlines next steps for readers who want to use the Framework.

170•

Appendix A offers notional templates for Framework Profiles and action plans.

171•

Appendix B describes the Framework Tiers.

172•

Appendix C provides the Framework Core.

173

Understanding the Framework Core

174
175
176
177
178
179
180

The Framework Core provides a set of cybersecurity outcomes (arranged by Function, Category,and Subcategory), examples of how those outcomes might be achieved (Implementation
Examples), and references to additional guidance on how to achieve those outcomes(Informative References), as depicted in Fig. 1. The cybersecurity outcome statements in theCore reflect activities across sectors and are technology-neutral. They are not a checklist ofactions to perform; the specific actions taken to achieve a cybersecurity outcome will vary byorganization and use case, as will the individual responsible for those actions. Additionally, the4Initial Public Draft

The NIST Cybersecurity Framework 2.0

181
182
183
184

order of Functions, Categories, and Subcategories in the Core is not intended to imply thesequence by which they should be implemented or their relative importance. The ordering of theCore is intended to resonate most with those charged with operationalizing risk management
within an organization.

185
186

This section explains the basics of the Framework Core. See Appendix C for the FrameworkCore’s descriptions of the Functions, Categories, and Subcategories.

187
188

Fig. 1. Cybersecurity Framework Core

Functions, Categories, and Subcategories

189
190
191

The Framework Core Functions — GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and
RECOVER — organize cybersecurity outcomes at their highest level.

192
193
194
195
196
197
198
199
200

•

GOVERN (GV) – Establish and monitor the organization’s cybersecurity risk management
strategy, expectations, and policy. The GOVERN Function is cross-cutting and provides
outcomes to inform how an organization will achieve and prioritize the outcomes of theother five Functions in the context of its mission and stakeholder expectations.
Governance activities are critical for incorporating cybersecurity into an organization’s
broader enterprise risk management strategy. GOVERN directs an understanding oforganizational context; the establishment of cybersecurity strategy and cybersecurity
supply chain risk management; roles, responsibilities, and authorities; policies, processes,
and procedures; and the oversight of cybersecurity strategy.

201
202
203
204
205
206
207

•

IDENTIFY (ID) – Help determine the current cybersecurity risk to the organization.
Understanding its assets (e.g., data, hardware, software, systems, facilities, services,people) and the related cybersecurity risks enables an organization to focus and prioritize
its efforts in a manner consistent with its risk management strategy and the mission needs
identified under GOVERN. This Function also includes the identification of improvements
needed for the organization’s policies, processes, procedures, and practices supporting
cybersecurity risk management to inform efforts under all six Functions.

5Initial Public Draft

The NIST Cybersecurity Framework 2.0

208
209
210
211
212
213
214

•

PROTECT (PR) – Use safeguards to prevent or reduce cybersecurity risk. Once assets andrisks are identified and prioritized, PROTECT supports the ability to secure those assets toprevent or lower the likelihood and impact of adverse cybersecurity events. Outcomescovered by this Function include awareness and training; data security; identity
management, authentication, and access control; platform security (i.e., securing the
hardware, software, and services of physical and virtual platforms); and the resilience oftechnology infrastructure.

215
216
217
218

•

DETECT (DE) – Find and analyze possible cybersecurity attacks and compromises.
DETECT enables timely discovery and analysis of anomalies, indicators of compromise,and other potentially adverse cybersecurity events that may indicate that cybersecurity
attacks and incidents are occurring.

219
220
221
222

•

RESPOND (RS) – Take action regarding a detected cybersecurity incident. RESPOND
supports the ability to contain the impact of cybersecurity incidents. Outcomes within thisFunction cover incident management, analysis, mitigation, reporting, andcommunication.

223
224
225

•

RECOVER (RC) – Restore assets and operations that were impacted by a cybersecurity
incident. RECOVER supports timely restoration of normal operations to reduce the impact
of cybersecurity incidents and enable appropriate communication during recovery efforts.

226
227
228
229
230
231

Fig. 2 shows the CSF Functions as a wheel because all Framework Functions relate to one
another. For example, an organization will categorize assets under IDENTIFY and take steps tosecure those assets under PROTECT. Investments in planning and testing in the GOVERN and
IDENTIFY Functions will support timely incident response and recovery actions for cybersecurity
incidents in the RESPOND and RECOVER Functions. GOVERN is in the center of the wheel because
it informs how an organization will implement the other five Functions.

232
233
234
235

Fig. 2. Framework Functions

To form and maintain a culture that addresses dynamic cybersecurity risk, the Functions should
be addressed concurrently. Actions supporting GOVERN, IDENTIFY, PROTECT, and DETECT should

6

Initial Public Draft

The NIST Cybersecurity Framework 2.0

236
237
238
239
240

all happen continuously, and actions supporting RESPOND and RECOVER should be ready at all
times and happen when cybersecurity incidents occur. All Functions have vital roles related toincidents; GOVERN, IDENTIFY, and PROTECT outcomes help prevent and prepare for cybersecurity
incidents, while GOVERN, DETECT, RESPOND, and RECOVER outcomes help discover and manage
cybersecurity incidents.

241

Categories are the subdivisions of a Function into groups of related cybersecurity outcomes.

242
243

Subcategories further divide a Category into specific outcomes of technical and management
activities. They are not exhaustive, but they help to achieve the outcomes in each Category.
Implementation Examples and Informative References

244
245
246

The Framework Core also provides two types of additional resources with information to help
achieve the outcomes described in the Core’s Functions, Categories, and Subcategories.

247
248
249
250
251
252
253
254
255

•

Informative References are standards, guidelines, regulations, and other resources tohelp inform how an organization achieves the Functions, Categories, and Subcategories.
In some cases, the Informative Reference is more specific than a Subcategory, such as acontrol from SP 800-53, Security and Privacy Controls for Information Systems andOrganizations. In that case, more than one control would be used to achieve the outcome
described in one Subcategory. In other cases, organizations may leverage higher-level
policies or requirements that address one or more Subcategories. Informative References
can also be sector- or technology-specific. In using the Framework, each organization
will identify applicable Informative References.

256
257
258
259
260

•

Implementation Examples provide notional examples of concise, action-oriented steps
to help achieve the outcomes of the Subcategories in addition to the guidance provided byInformative References. The examples are not a comprehensive list of all actions that
could be taken by an organization to achieve an outcome, nor do they represent a baselineof required actions to address cybersecurity risk.

261
262
263
264
265

While Informative References and Implementation Examples are considered part of the Core,
they will be maintained separately in an online format on the NIST Cybersecurity Framework
website (leveraging the NIST Cybersecurity and Privacy Reference Tool [CPRT]) to allow for
more frequent updates. Informative References may be submitted at any time through the NIST
National Online Informative References (OLIR) program.

266
267
268
269
270
271
272
273
274

The Framework Core can be used to identify opportunities for new or revised standards,
guidelines, or practices where additional Informative References would help organizations
address emerging needs. An organization implementing a given Subcategory might discover that
there are few Informative References, if any, for a specific activity. In that case, the organization
might collaborate with technology leaders and standards bodies to draft, develop, and coordinate
standards, guidelines, or practices. Similarly, an organization might determine that additional
Implementation Examples would help others better understand an emerging need. NIST
encourages submissions of new Examples for consideration at any time. Suggestions may be sent
to cyberframework@nist.gov.

7

Initial Public Draft
275
276
277
278
279
280
281
282

The NIST Cybersecurity Framework 2.0

Using the Framework
The Framework can be used in numerous ways. Its use will vary based on an organization’s
unique mission and risks. With an understanding of stakeholder expectations and risk appetiteand tolerance (such as outlined in GOVERN), organizations can prioritize cybersecurity activities,
enabling them to make informed decisions about cybersecurity expenditures and actions.
Organizations may choose to handle risk in different ways — including mitigating, transferring,
avoiding, or accepting the risks — depending on the potential impacts. Importantly,
organizations can use the Framework both internally and to oversee third parties.
The Cybersecurity Framework provides a flexible and risk-based implementation that can beused with a broad array of cybersecurity risk management processes, such as International
Organization for Standardization (ISO) 31000:2018; ISO/International ElectrotechnicalCommission (IEC) 27005:2022; SP 800-37, Risk Management Framework for Information
Systems and Organizations: A System Life Cycle Approach for Security and Privacy; and theElectricity Subsector Cybersecurity Risk Management Process (RMP) guideline.

283
284

This section explains several ways that organizations can use the Framework:

285
286
287
288

•

Create and use Framework Profiles to understand, assess, and communicate theorganization’s current or target cybersecurity posture in terms of the Framework Core’s
cybersecurity outcomes, and prioritize outcomes for achieving the target cybersecurity
posture. (Section 3.1)

289•

Assess the organization’s achievement of cybersecurity outcomes. (Section 3.2)

290
291

•

Characterize cybersecurity risk management outcomes with Framework Tiers. (Section
3.3)

292
293

•

Improve cybersecurity communication with internal and external stakeholders. (Section
3.4)

294

•

Manage cybersecurity risk throughout supply chains. (Section 3.5)

295
296
297
298
299
300

Regardless of the application of the Framework, organizations likely will find it helpful to thinkof the Framework as guidance to help them to understand, assess, prioritize, and communicate
about those cybersecurity risks and the actions that will reduce those risks. The outcomes which
are selected can be used to focus on and implement strategic decisions to improve anorganization’s cybersecurity posture (or state), taking into account its priorities and available
resources.

301
302

Creating and Using Framework Profiles to Understand, Assess, Prioritize,
and Communicate

303
304

The Framework’s mechanism for describing an organization’s current or target cybersecurity
posture in terms of the Core’s outcomes is called a Framework Profile (Profile).

305
306
307

Profiles are used to understand, assess, prioritize, and tailor the sector- and technology-neutral
Core outcomes (i.e., Functions, Categories, and Subcategories) based on an organization’s
mission objectives, stakeholder expectations, threat environment, and requirements and leading
8

Initial Public Draft

The NIST Cybersecurity Framework 2.0

308
309
310

practices, including those for specific sectors or technologies, as Fig. 3 illustrates. Organizations
then can prioritize their actions to achieve specific outcomes and communicate that information
to internal and external stakeholders. Appendix A provides a notional Profile template.

311
312

Fig. 3. Cybersecurity Framework Profiles

313

There are two types of Profiles:

314
315
316

•

A Current Profile covers the Core’s outcomes that an organization is currently achieving(or attempting to achieve) and characterizes how or to what extent each outcome is being
achieved.

317
318
319
320
321

•

A Target Profile covers the desired outcomes that an organization has selected andprioritized from the Core for achieving its cybersecurity risk management objectives. A
Target Profile takes into account anticipated changes to the organization’s cybersecurity
posture, such as new requirements, new technology adoption, and cybersecurity threat
intelligence trends.

322
323
324
325
326

Some organizations prefer to create a Current Profile first — for example, an organization thatwants to review its current efforts first and then think about areas for improvement. Others preferto start with a Target Profile to work toward. For example, an organization that needs to meet a
set of new requirements might focus on developing its Target Profile first and in the course of
doing so, also determine its current cybersecurity posture for its Current Profile.
A Community Profile is a Target Profile created to address shared interests and goals among agroup of organizations. Organizations can consider using it as the basis for their own Target
Profile. An example of a Community Profile is one developed for a sector or subsector, or fora specific use case or technology. A Community Profile could be developed by organizations
collaboratively, or it could be developed by one organization for others to use. Examples of
CSF 1.1 Community Profiles can be found on the NIST Cybersecurity Framework website,which NIST will update as new Community Profiles are developed for CSF 2.0.

327

9

Initial Public Draft

The NIST Cybersecurity Framework 2.0

328

3.1.1. Ways to Use Profiles

329
330
331
332

Organizations can create and use Profiles to utilize the full capabilities of the Framework (asdiscussed in Section 1). While organizations can use the Framework without Profiles, they
provide the opportunity to develop a prioritized roadmap to achieve the cybersecurity outcomesof the Framework. There are many ways to use Profiles, including to:

333
334

•

Compare current cybersecurity practices to sector-specific standards and regulatory
requirements

335
336

•

Document the Informative References (e.g., standards, guidelines, and policies) and thepractices (e.g., procedures and safeguards) currently in place and planned in the future

337
338

•

Set cybersecurity goals for the organization, identify gaps between current practices andthe goals, and plan how to address the gaps in a cost-effective manner339•

Prioritize cybersecurity outcomes

340•

Assess progress toward achieving the organization’s cybersecurity goals

341
342

•

Determine where the organization may have cybersecurity gaps with respect to an
emerging threat or a new technology

343
344
345

•

Communicate about the cybersecurity capabilities an organization provides — forexample, to business partners or to prospective customers of the organization’s
technology products and services

346
347

•

Express the organization’s cybersecurity requirements and expectations to suppliers,
partners, and other third parties

348
349

•

Integrate cybersecurity and privacy risk management programs by analyzing gaps
between NIST Cybersecurity and Privacy Framework Profiles

350

3.1.2. Steps for Creating and Using Profiles

351
352

The steps described below and summarized in Fig. 4 illustrate one way an organization could use
Current and Target Profiles to help inform continuous improvement of its cybersecurity:

353
354

Fig. 4. Steps for creating and using Cybersecurity Framework Profiles

10Initial Public Draft
355
356
357

The NIST Cybersecurity Framework 2.0

1. Define the use case for the Profiles. The use case defines the high-level facts andassumptions on which the Profiles will be based, as a way of scoping the Profiles. Thiscan include:358•

The reason for creating the Profiles

359
360

•

The organization’s divisions, information and technology assets, services, and otherelements that are in scope for these Profiles

361•

Those who will develop, review, and operationalize the Profiles

362
363

•

The individuals who will set expectations for actions to achieve the cybersecurity
outcomes

364
365
366
367
368
369

2. Gather the information needed to prepare the Profiles. An organization can gather
relevant resources prior to preparing the Profiles, such as organizational policies, risk
management priorities and resources, cybersecurity requirements and standards followedby the organization, and work roles. Understanding cybersecurity governance — such as
identifying the organization’s mission, its stakeholders, and their needs and expectations,as outlined in the GOVERN Function — is generally needed for preparing a Target Profile.

370
371
372
373
374
375
376
377
378
379
380
381
382

3. Create Current and Target Profiles. Determine what types of supporting information(also known as elements) each Profile should include for each of the selected Frameworkoutcomes, and fill in the elements for each selected outcome. Consider the risk
implications of the current state to inform target state planning and prioritization.
Appendix A provides a notional template for Current and Target Profiles and examples ofcommon elements that organizations can choose to use. Examples of elements in a Profile
for each outcome Category or Subcategory include the outcome’s priority compared toother outcomes; current status in achieving the outcome; policies, processes, andprocedures; practices, including tools and responsibilities; metrics and measurements;
informative references; and any other supporting information that an organizationconsiders helpful. Organizations documenting responsibilities may employ the
Workforce Framework for Cybersecurity (NICE Framework), which provides a common
lexicon for describing cybersecurity work.

383
384
385
386
387
388
389

4. Analyze the Profiles and create an action plan. Identifying and analyzing thedifferences between the Current and Target Profiles enables an organization to identify
gaps and develop a prioritized action plan for addressing those gaps to improvecybersecurity. This plan should consider mission drivers, benefits, risks, and necessary
resources (e.g., staffing, funding). Using Profiles in this manner helps an organization
make better-informed decisions about how to improve cybersecurity risk management ina cost-effective manner. Appendix A provides a notional action plan template.

390
391
392
393
394
395
396

5. Implement the action plan and update the Profiles. The organization follows theaction plan to adjust its cybersecurity practices to address gaps and move toward theTarget Profile. Improving an organization’s cybersecurity program is a continuous effort,
and implementing an action plan can take months or years. At frequencies defined by theorganization, the Current Profile should be updated to assess progress and the Target
Profile should be updated to reflect changes in the organization and its cybersecurity risk.
Over time, changes in either or both Profiles will require revising the action plan and11

Initial Public Draft

The NIST Cybersecurity Framework 2.0

397
398

repeating these steps. Given the importance of continual improvement, an organization
can repeat the steps as often as needed.

399
400
401
402
403
404
405
406
407

Profile development can be improved through communication across an organization, including
but not limited to key stakeholders from executive leadership, risk management, security, legal,
human resources, acquisition, and operations. For example, Profile developers can reach out toleaders within the organization to confirm which resources (e.g., facilities, personnel, systems)
are most relevant to achieving the objectives (e.g., for a business unit). Those leaders can thenshare their risk-related expectations for the selected resources with the implementers. By using
Current and Target Profiles, cybersecurity planning and monitoring are tightly tied toorganizational objectives, and mission-level planners can understand the residual risk of
uncertainty in terms of likelihood and impact to the mission.

408
409
410
411
412

An organization may choose to develop multiple Profiles that each address a different use caseand scope. This can enable better prioritization of activities and outcomes where there may bediffering degrees of cybersecurity risk while still allowing an organization to use the overarching
Framework structure for consistency across use cases. Examples include describing acybersecurity outcome posture for:413•

An entire enterprise

414•

Each of an organization’s major business units

415•

Business partners or suppliers

416•

Each of an organization’s most critical systems

417•

Products or services with cybersecurity requirements

418

Assessing and Prioritizing Cybersecurity Outcomes With the Framework

419
420
421
422
423
424

Step 3, “Create Current and Target Profiles” in Section 3.1 mentions that creating Profiles means
filling in the elements for each selected Core outcome. Each organization needs to determine thevalues to enter into its own Profiles. The Framework does not prescribe specific standards,
guidelines, or practices to meet the outcomes. Rather, it gives organizations the flexibility toassess their own cybersecurity outcomes in different ways and does not prescribe a single
approach.

425
426
427
428
429

For organizations that already assess their cybersecurity risk management practices on a regularbasis, the results from recent self-assessments or third-party assessments may provide much of
the data needed to create Current Profiles, which capture the as-implemented state of Frameworkoutcomes. Organizations that use the Framework are encouraged to begin with their existing
cybersecurity risk assessments and risk management processes.

430
431
432

An organization may choose to conduct an assessment and document the results by comparing
the Current and Target Profiles. Assessment results can help to determine if practices are in placeand identify and prioritize opportunities for improvement in Profiles.

433
434
435

Organizations can identify metrics to help prioritize and demonstrate progress from Current toTarget Profiles. Organizations are encouraged to innovate and customize how they incorporate
measurement into their application of the Framework. See the NIST Cybersecurity Measurement

12Initial Public Draft

The NIST Cybersecurity Framework 2.0

436
437

project page for more information, including a pointer to the latest version of SP 800-55,
Performance Measurement Guide for Information Security.

438
439
440
441
442
443
444

The Framework offers an opportunity to explore or adjust methodologies for measurement andassessment. 1 For example, key stakeholders could discuss what to include in the organization’s
Current and Target Profiles, such as selected Informative References, roles and responsibilities,
tools, and policies, processes, procedures, and practices. The stakeholders could also discuss
what assessment and measurement approaches can be used for those topics, and how theapproaches can provide information to support decisions about the organization’s cybersecurity
posture.
Using Framework Tiers to Characterize Cybersecurity Risk Management
Outcomes

445
446
447
448
449
450
451
452

The selection of Framework Tiers (Tiers) helps set the overall tone for how cybersecurity risks
will be managed within the organization, and determine the effort required to reach a selected
Tier. Organizations can choose to use the Tiers found in Appendix B to inform their Current andTarget Profiles. Tiers characterize the rigor of an organization’s cybersecurity risk governanceand management outcomes, and they provide context on how an organization views
cybersecurity risks and the processes in place to manage those risks.

453
454

Fig. 5. Cybersecurity Framework Tiers

455
456
457

The Tiers capture an organization’s outcomes over a range, from Partial (Tier 1) to Adaptive(Tier 4), as Fig. 5 depicts. They reflect a progression from informal, ad hoc responses toapproaches that are agile, risk-informed, and continuously improving.

458
459
460

Tiers should be used to complement an organization’s cybersecurity risk management
methodology rather than take its place. For example, an organization can use the Tiers tocommunicate internally as a benchmark for a more organization-wide approach to managing

Many cybersecurity risk assessment or analysis methodologies are available, such as the example detailed in NIST
SP 800-30 Rev.1, Guide for Conducting Risk Assessments; the Open Group’s Open Factor Analysis of Information
Risk (OpenFAIR) standard; and others described in International Electrotechnical Commission (IEC) 31010, Risk
management – Risk assessment techniques.
1

13

Initial Public Draft

The NIST Cybersecurity Framework 2.0

461
462
463
464

cybersecurity risks as necessary to progress to a higher Tier. Not all organizations need to be at aparticular Tier (e.g., Tier 3 or 4). Progression to higher Tiers is encouraged when risks or
mandates are greater or when a cost-benefit analysis indicates a feasible and cost-effective
reduction of cybersecurity risks.

465
466
467
468
469
470
471
472
473
474
475

As Framework Profiles are created or updated, the Tier descriptions (as listed in Appendix B)
can be considered for guidance. An organization may want to include Tier values (1 through 4)
in its Current and Target Profiles. For example, if leadership has determined that the organization
should be at Tier 3 (Repeatable), then the Current Profile will reflect how well the Tier 3
governance and management characteristics have been achieved. The Target Profile will reflect
any additional outcomes needed to fully achieve the Tier 3 description. Selecting Tiers overall orat the Function or Category level instead of the Subcategory level will provide a better sense of
the organization’s current cybersecurity risk management practices. Alternatively, anorganization can apply the Tiers exclusively to the GOVERN Function to describe the rigor of theorganization’s risk management as demonstrated by the risk management strategy, expectations,and policy since GOVERN is cross-cutting.

476
477
478
479
480
481

When selecting Tiers, the organization should consider its current risk management practices,
threat environment, legal and regulatory requirements, information sharing practices, businessand mission objectives, supply chain requirements, and organizational constraints, including
resources. The organization should ensure that the selection and use of Tiers help to meetorganizational goals, are feasible to implement, and reduce cybersecurity risks to critical assets
and resources to levels that are acceptable to the organization.

482
483

Improving Communication With Internal and External Stakeholders Using
the Framework

484
485
486
487

One of the most common benefits of using the Framework is improving communication
regarding cybersecurity risks and posture with those inside and outside of an organization. Thissection explains how to use the Framework to facilitate communication and discusses many ofthe entities that may benefit.

488

3.4.1. Improving Communication Across the Organization

489
490
491
492
493
494
495
496
497

The Framework provides a basis for improved communication regarding cybersecurity
expectations, planning, and resources among executives, business process managers, andimplementation and operations practitioners across an organization. The Framework is best used
to foster bi-directional information flows (as shown in Fig. 6) between those who understand themission objectives and those who understand the specific cybersecurity risks that could hamper
the achievement of those objectives. This includes top-down dialogue (fostering understandingof priorities and strategic direction based on stakeholder needs and expectations) and bottom-up
reporting (informing decisions about and reporting on results of actions taken to implement the
Framework).

14

Initial Public Draft

The NIST Cybersecurity Framework 2.0

498
499

Fig. 6. Using the Cybersecurity Framework to improve communication

500
501
502
503
504
505
506
507
508

When implementing the Framework, the senior executive level will focus on organizational risk,
with actions to express mission priorities under the GOVERN Function and approve Framework
Tier selection. Discussions at this level involve strategy, particularly how cybersecurity-related
uncertainties might affect achieving the enterprise’s mission and objectives. From acybersecurity perspective, this entails understanding the needs of internal stakeholders (e.g.,shareholders, employees, business managers) and external stakeholders (e.g., customers,
regulators, citizens). As executives establish cybersecurity priorities and objectives based on
those needs, they develop a risk strategy that considers risk appetite and addresses expectations,accountability, and resources.

509
510
511
512
513
514
515
516

The overall cybersecurity objectives set at the senior executive level are informed by and cascadeto specific business process level objectives. In a commercial entity, these may apply to a lineof-business or operating division. For government entities these may be division- or branch-levelconsiderations. When implementing the Framework, business process managers will focus on
cybersecurity risk management, with actions to develop Framework Profiles and nominate
Framework Tiers. As risk priorities and appetite are translated into mission-level objectives,
business process managers can express their own cybersecurity expectations and performance
criteria in terms of how uncertainty created by risk may impact the business.

517
518
519
520
521
522
523
524
525

At the implementation or operations level, the focus in implementing the Framework includes
securing systems with the action to implement the Framework Profiles. Practitioners both informand fulfill expectations from the other levels and provide valuable information for planning,carrying out, and monitoring specific cybersecurity activities. Understanding organizational-level
priorities, strategies, and processes enables system-specific implementation. As controls are
implemented to manage risk to an acceptable level, implementation- and operations-level
practitioners provide business process managers and senior executives with the information theyneed to understand the organization’s cybersecurity posture, make informed decisions, andmaintain or adjust the risk strategy accordingly.

15

Initial Public Draft

The NIST Cybersecurity Framework 2.0

526
527
528
529

The Framework encourages and supports discussions about how well the organization’s
cybersecurity activities address various risks to mission objectives. Section 4.2 describes howorganizations can combine cybersecurity risk data with information about other risks to help
support better mission alignment across the organization.

530
531
532

At all levels, Framework Profiles are used to support effective enterprise decision-making. The
Framework enables those who make strategic decisions to convey expectations and those at thebusiness process and implementation/operations levels to share information with leaders.

533

3.4.2. Improving Communication With External Stakeholders

534
535

The Framework helps facilitate communications about cybersecurity with external parties,
including throughout an organization’s supply chain. An organization can use the Framework to:

536
537

•

Express its cybersecurity risk management requirements to an external service provider(e.g., a service provider with which it is exchanging data) through a Target Profile

538
539
540

•

Report on the status of cybersecurity requirements (e.g., to a government regulator),
which makes it easier to review requirements as part of a broader risk management
strategy541•

Better understand its cybersecurity posture in light of systemic risks

542•

Identify cybersecurity priorities for a sector

543
544

•

Determine the extent to which risk management processes, integration, and information
sharing fulfill stakeholders’ expectations

545
546
547

•

Share high-level information on cybersecurity practices with prospective customers,
business partners, and others who may need to understand the organization’s
cybersecurity posture before engaging with the organization

548•

Define shared responsibility models with cloud service providers

549

Managing Cybersecurity Risk in Supply Chains With the Framework

550
551
552
553
554
555
556
557
558

The Framework can be used to foster an organization’s oversight and communications related tocybersecurity risks with stakeholders across supply chains. All types of technology rely on acomplex, globally distributed, extensive, and interconnected supply chain ecosystem withgeographically diverse routes and multiple levels of outsourcing. This ecosystem is composed of
public- and private-sector entities (e.g., acquirers, suppliers, developers, system integrators,
external system service providers, and other technology-related service providers) that interact toresearch, develop, design, manufacture, acquire, deliver, integrate, operate, maintain, dispose of,and otherwise utilize or manage technology products and services. These interactions are shaped
and influenced by technologies, laws, policies, procedures, and practices.

559
560
561
562
563
564

Given the complex and interconnected relationships in this ecosystem, supply chain risk
management (SCRM) is critical for organizations. Cybersecurity SCRM (C-SCRM) is asystematic process for managing exposure to cybersecurity risk throughout supply chains anddeveloping appropriate response strategies, policies, processes, and procedures. See SP 800161r1 (Revision 1), Cybersecurity Supply Chain Risk Management Practices for Systems andOrganizations, for in-depth information on C-SCRM.

16

Initial Public Draft

The NIST Cybersecurity Framework 2.0

565
566
567
568
569
570
571
572
573
574
575
576

Today, nearly all organizations depend on supply chains. As such, it is increasingly importantthat they develop capabilities and implement practices to identify, assess, and respond to
cybersecurity risks throughout the supply chain. The primary objective of C-SCRM is to extend
appropriate first-party cybersecurity risk management considerations to third parties, supply
chains, and products and services an organization acquires, based on supplier criticality and risk
assessment. Examples of risks include products and services that may potentially contain or
become a vector for malicious functionality, are counterfeit, or are vulnerable due to poor
manufacturing and development practices within the supply chain. Effective C-SCRM requires
stakeholders to actively collaborate, communicate, and take actions to secure favorable C-SCRM
outcomes. It also requires an enterprise-wide cultural shift to a state of heightened awareness andpreparedness regarding the potential ramifications of cybersecurity risks throughout the supply
chain.

577
578
579
580
581
582
583
584

The Framework Core addresses cybersecurity supply chain risk management in two ways.
Within the GOVERN function, the Supply Chain Risk Management (GV.SC) Category and its
Subcategories provide outcomes for establishing, managing, monitoring, and improving anorganizational cybersecurity supply chain risk management capability or program. The GV.SC
Category and Subcategories are specific to C-SCRM and address outcomes such as establishinga cybersecurity supply chain risk management program [GV.SC-01], roles and responsibilities[GV.SC-02], and risk management processes [GV.SC-03] in a manner that is integrated withother related capabilities.

585
586
587
588
589
590
591
592

The Categories and Subcategories within the other Functions — IDENTIFY, PROTECT, DETECT,RESPOND, and RECOVER — provide a source for the organization to consider as a basis for
supplier cybersecurity requirements, both for direct suppliers and as flow-down requirements forlower-tier suppliers [GV.SC-05]. Which Categories or Subcategories are selected for inclusion incontractual requirements depends on the supplier criticality [GV.SC-04] and supplier risk
assessments [GV.SC-07]. Overall, cybersecurity risk in supply chains should be taken into
consideration as an organization performs all the Framework Functions. The following provide a
few examples across the Functions:

593
594

•

Identify: Identifying, validating, and recording vulnerabilities associated with the
supplier’s product or service [ID.RA-01]

595
596
597
598

•

Protect: Authenticating users, services, and hardware [PR.AA-03]; applying appropriate
configuration management practices [PR.PS-01]; generating log records and having thelogs available for continuous monitoring [PR.PS-04]; and integrating secure softwaredevelopment practices into the supplier’s software development life cycles [PR.PS-07]

599
600

•

Detect: Monitoring computing hardware and software for potentially adverse events[DE.CM-09]

601
602

•

Respond: Executing incident response plans when compromised products or services are
involved [RS.MA-01]

603
604
605

•

Recover: Executing the recovery portion of the organization’s incident response plan
when compromised products or services are involved [RC.RP-01], and restoring
compromised products or services and verifying their integrity [RC.RP-05]

17

Initial Public Draft

The NIST Cybersecurity Framework 2.0

Secure software development is an area that heavily overlaps with supply chain
considerations. C-SCRM includes software and software-based services that an organizationacquires from third parties, including open-source software, as well as software that anorganization creates or integrates for its customers to use. Organizations that acquire ordevelop software may follow secure software development practices, such as those describedin SP 800-218, Secure Software Development Framework (SSDF). Organizations that develop
software solely for their own use may benefit from adopting other C-SCRM practices, in
effect treating their software development units as part of their supply chain.
606
607
608
609
610

An organization can use Framework Profiles to delineate cybersecurity standards and practices toincorporate into contracts with suppliers and provide a common language to communicate thoserequirements to suppliers. Profiles can also be used by suppliers to express their cybersecurity
posture and related standards and practices.

611
612
613
614
615
616
617
618
619
620

Target Profiles can be used to inform decisions about buying products and services based onrequirements to address gaps. This often entails some degree of trade-off with otherrequirements, comparing multiple products or services and considering other needs such as cost,functionality, and supplier and supply chain risks. Once a product or service is purchased, theProfile can be used to track and address residual cybersecurity risk. For example, if the service or
product does not meet all of the cybersecurity objectives described in the Target Profile, theresidual risk can be addressed through other actions. The Profile also provides the organization
with a method for assessing whether the product meets cybersecurity outcomes through periodic
review and testing. A Profile can sharpen the organization’s focus on desired cybersecurity
outcomes throughout the supply chain.

621
622

Integrating Cybersecurity Risk Management With Other Risk Management
Domains Using the Framework

623
624
625
626
627
628
629

In addition to cybersecurity risks, every organization faces numerous other types of risk and may
use frameworks and management tools that are specific to them. Sometimes two types of risk
have commonalities, as Fig. 7 depicts through overlapping cybersecurity and privacy risks.
Cybersecurity and privacy risk management have some of the same objectives, so integrating
their approaches helps ensure that all risks are considered and that efforts are not duplicated.
Section 4.1 discusses an example of integrating risk management approaches — using the
Cybersecurity Framework and the Privacy Framework together.

630
631
632
633
634
635

Some organizations integrate all of their risk management efforts at a high level by using
enterprise risk management (ERM). Section 4.2 discusses using the Cybersecurity Framework as
part of ERM. (See NIST IR 8286, Integrating Cybersecurity and Enterprise Risk Management.)
The outer border of Fig. 7 indicates an organization’s full range of ERM risks, with examples ofrisks including financial, legal, operational, physical security, reputational, and safety — inaddition to cybersecurity and privacy risks.

18

Initial Public Draft

The NIST Cybersecurity Framework 2.0

636
637

Fig. 7. Integrating cybersecurity and privacy risks

638

Integrating the Cybersecurity Framework With the Privacy Framework

639
640
641
642
643

Cybersecurity and privacy are independent disciplines, but in certain circumstances theirobjectives overlap, as illustrated by Fig. 7. Cybersecurity risk management is essential for
addressing privacy risks related to the loss of confidentiality, integrity, and availability of
individuals’ data. For example, data breaches could lead to identity theft. However, privacy risks
can also be unrelated to cybersecurity incidents.

644
645
646
647
648
649
650
651
652
653
654

Organizations process data to achieve mission or business purposes, which can give rise to
privacy events whereby individuals may experience problems as a result of the data processing.
NIST describes these problems as ranging from dignity-type effects, such as embarrassment or
stigma, to more tangible harms, such as discrimination, economic loss, or physical harm. 2
Consequently, when organizations are processing data to conduct cybersecurity activities, they
can create privacy risks. For example, some types of incident detection or monitoring activities— particularly those conducted in a manner disproportionate to the intended purpose — maylead individuals to feel surveilled. Additionally, cybersecurity activities can result in the overcollection or over-retention of personal information or the disclosure or use of personal
information unrelated to cybersecurity activities. These activities can lead to problems such as
embarrassment, discrimination, and loss of trust.

655
656
657
658
659
660

The NIST Cybersecurity Framework and the NIST Privacy Framework can be used together tocollectively address cybersecurity and privacy risks, as illustrated by Fig. 8. As the right side of
the Venn diagram depicts, organizations using the Cybersecurity Framework to manage
cybersecurity risks can leverage the Privacy Framework Identify-P, Govern-P, Control-P, andCommunicate-P Functions to identify and manage privacy risks unrelated to cybersecurity
incidents, such as those described above. The Cybersecurity Framework DETECT, RESPOND, andNIST has created an illustrative catalog of problems for use in privacy risk assessment. See NIST Privacy Risk
Assessment Methodology. Other organizations may have created other categories of problems, or may refer to themas adverse consequences or harms.
2

19Initial Public Draft
661
662

RECOVER Functions and the Privacy Framework Protect-P Function can be collectively
leveraged to support the management of overlapping cybersecurity and privacy risks.

663
664
665
666

The NIST Cybersecurity Framework 2.0

Fig. 8. Cybersecurity Framework and Privacy Framework alignment

When reviewing cybersecurity programs for privacy risks, an organization can consider taking
actions such as the following:

667
668
669

•

Use both the Cybersecurity and Privacy Frameworks to consider the full spectrum ofprivacy risks associated with its cybersecurity program, including identity management
and access control

670
671

•

Ensure that individuals with cybersecurity-related privacy responsibilities report toappropriate management and are appropriately trained672•

Comply with applicable privacy statutes and regulations

673
674

•

Identify outcomes and activities in the Privacy Framework Core that can be integrated
into cybersecurity workforce awareness and training

675
676

•

Inform providers of cybersecurity-related products and services about the organization’s
applicable privacy policies

677
678

•

Conduct privacy reviews of an organization’s asset monitoring and detection of adverse
cybersecurity events and incidents, as well as its cybersecurity incident mitigation efforts

679
680
681

•

Put processes in place to assess and address whether, when, how, and the extent to which
individuals’ data is shared outside of the organization as part of cybersecurity
information-sharing activities

682

Integrating the Cybersecurity Framework With Enterprise Risk Management

683
684
685
686
687
688

Organizations can employ an enterprise risk management (ERM) approach to balance multiple
risk considerations, including cybersecurity. They can benefit from using the Framework tobetter harmonize cybersecurity risk management activities with other risk management domains(e.g., financial, legal, legislative, operational, privacy, reputational, safety). Enterprise leaders
receive significant input about current and planned risk activities as they integrate governanceand risk strategy with results from previous Framework cycles. Integrated data about a broad set
20

Initial Public Draft

The NIST Cybersecurity Framework 2.0

689
690
691

of risks, including cybersecurity risk data, helps leaders understand potential risk changes so thatthey can make informed decisions about the direction of the enterprise. Fig. 6 illustrates thisiterative cycle of risk communication at all organizational levels.

692
693
694
695
696
697

NIST IR 8286, Integrating Cybersecurity and Enterprise Risk Management, describes anexample approach. That report is part of a series of publications that describes the use of
cybersecurity risk management activities, in conjunction with the Cybersecurity Framework, tokeep leaders informed about cybersecurity risks in context with other risks. Specific activities for
integrating the CSF into ERM are described in the main report and provide additional details to
Cybersecurity Framework users.

698
699
700

Section 3.1 of this document presents five steps that an organization could take using Framework
Profiles to help inform continuous improvement of its cybersecurity posture. Organizations can
expand and enhance those steps to integrate ERM considerations, such as:

701
702

•

Ensuring that assets that are important to the enterprise are considered when defining the
Framework use case (step 1)

703
704

•

Including ERM-related input (e.g., enterprise risk categories, priorities, integrated risk
registers) when gathering information needed to prepare the Profiles (step 2)

705
706
707

•

Considering tangible and assessable representation of risks (risk scenarios) fromthroughout the enterprise when evaluating the risk implications of the current state anddefining the desired state that will address important risks (step 3)

708
709
710

•

Ensuring that expectations from those in ERM roles (e.g., enterprise risk steeringcommittee, senior executives, and officers) are included in the analysis and prioritization
to create an action plan (step 4)

711
712
713
714
715

•

Communicating results from action plan implementation (step 5) to those in ERM roles
to help monitor cybersecurity risk strategy results, adjust that strategy to pursue
opportunities, and reduce exposure throughout the enterprise. ERM stakeholders may
also recommend adjustments to the desired tier (and associated governance, management,
and third-party risk management activities) to improve achievement of enterprise goals.

716
717
718
719
720
721
722
723
724
725
726
727
728

As these steps are iteratively applied, they provide enterprise leaders with information to help
them understand what conditions might improve or impair the organization’s ability to achieve
its business objectives. The action plan should include metrics, such as key performanceindicators (KPIs) and key risk indicators (KRIs) that help monitor, evaluate, and adjust theenterprise risk strategy. As actions occur, results can be recorded (e.g., through aggregated andnormalized risk registers and profiles). Reviews of those results, expressed in terms of businessand enterprise objectives, help to maintain and adjust organizational strategy. This monitorevaluate-adjust cycle, executed through the Framework steps, aids in aligning cybersecurity risk
activity with management of the many other types of risk facing the enterprise.
Next Steps
Whether an organization is using the Cybersecurity Framework for the first time or it has used
the Framework previously, it is important to remember that the CSF is designed to be used inconjunction with other cybersecurity frameworks, standards, and guidance.

21

Initial Public Draft

The NIST Cybersecurity Framework 2.0

729
730
731
732
733
734

NIST provides many resources that are specific to the Framework and its use on the
Cybersecurity Framework website, as well as hundreds of cybersecurity publications and otherresources hosted on the NIST Computer Security Resource Center (CSRC) website and the NIST
National Cybersecurity Center of Excellence (NCCoE) website. While these resources are notpart of the Framework Core, they provide detailed information on cybersecurity risk
management that supports use of the Framework.

735
736

Since the Framework is technology-neutral, organizations should also look for resources that are
specific to their technologies, such as:

737•

NIST Artificial Intelligence Risk Management Framework (AI RMF)

738
739

•

SP 800-207, Zero Trust Architecture, and the NCCoE’s Implementing a Zero Trust
Architecture project

740•

NIST Cybersecurity for IoT Program

741
742

As organizations continue on their cybersecurity journey, NIST is committed to providing
guidance to address current and future cybersecurity challenges.

22Initial Public Draft

The NIST Cybersecurity Framework 2.0

743

Appendix A. Templates for Profiles and Action Plans

744
745
746

This appendix provides notional templates that organizations can choose to use and adapt for
their own Profiles and action plans. Organizations should not feel compelled to follow thesetemplates in terms of format, structure, or data representation.

747

A.1.

748
749

Table 1 depicts an excerpt of a blank template for an organization’s Profiles, as described in
Section 3.1. This notional template uses four groupings for its elements:

Notional Organizational Profile Template

750
751
752
753

•

Selected Framework Outcomes: The Functions, Categories, or Subcategories of the
Framework being included in the Profile. Profiles may be at any outcome level.
Organizations may downselect outcomes or add their own Functions, Categories, orSubcategories to address specific needs or unique organizational risks.

754
755

•

Current Profile: Elements chosen by the organization to characterize its current
cybersecurity risk management posture.

756
757

•

Target Profile: Elements chosen by the organization to characterize its cybersecurity
risk management goals and its plans for achieving those goals.

758•

Notes: A space for additional comments on each selected outcome.

759
760
761

As the notional template demonstrates, the Current Profile and the Target Profile do not need toinclude the same elements.
Table 1. Notional organizational profile template

Selected
Framework
Outcomes(Functions,Categories, orSubcategories)

Current
Policies,
Processes,
andProcedures

Current
Internal
Practices

TargetPriority

TargetPolicies,
Processes,
andProcedures

TargetRoles andResponsibilities

TargetSelected
Informative
References

Notes

762
763
764

Some organizations choose to express the desired outcomes as a series of interim milestones,
such as quarterly, annual, and five-year targets for improvement. In those cases, multiple interim
Target Profiles could be included in one table, each describing progress toward defined goals.

765

The following list provides examples of possible elements that could be included within Profiles:

766
767
768
769
770
771

•

Status: The current state or condition of an outcome, such as whether an organization isachieving it or the degree to which the organization is achieving it. This can use any
status scheme, such as a simple status (e.g., Achieved, Not Achieved) or a more granularscheme that indicates the degree of progress (e.g., Not Evaluated, Planned, Partially
Achieved, Fully Achieved). More detailed status values can provide more insights whencreating a gap analysis or action plan. An organization may also include its Tier selection.
23

Initial Public Draft

The NIST Cybersecurity Framework 2.0

772
773
774
775

•

Priority: The relative importance of an outcome compared to other outcomes.
Organizations can choose a simple prioritization schema (e.g., Prioritized/Not Prioritized)
or a multi-level schema (e.g., High, Moderate, Implement Later) to provide more insights
when creating a gap analysis or action plan.

776
777
778
779
780

•

Policies, Processes, and Procedures: Information on the organization’s policies,
processes, and procedures related to a particular outcome. For example, a policy mightstate that access to resources requires a certain degree of authorization and a supporting
procedure might specify the correct access control rules for requesting and approving
access to a specific software component.

781
782
783
784
785

•

Internal Practices: Information on how the organization implements its policies,
processes, and procedures for a particular outcome, as well as any other organizational
activities. The Internal Practices element could be divided into more granular elements,
such as the hardware and software tools and the methodologies used to perform thepractices.

786
787
788
789
790
791
792

•

Roles and Responsibilities: People, teams, or other organizations who help achieve theoutcome or who are responsible for ensuring that the outcome is achieved. This includes
shared responsibility models, such as specifying which aspects of an outcome an
outsourcer and the organization are each responsible for. This element could also include
Work Roles, Tasks, and Knowledge and Skills needed for achieving each outcome, suchas from SP 800-181r1, NIST Workforce Framework for Cybersecurity (NICE
Framework).

793
794

•

Selected Informative References: Applicable standards, guidance, requirements,organizational policies, and other references selected by the organization.

795
796

•

Measurements: Selected measurements. See Section 3.2 for more information on
measuring cybersecurity risk outcomes.

797
798
799
800

•

Artifacts and Evidence: Information on artifacts that contain evidence of achieving
particular outcomes. The Profile could include pointers to files, databases, and otherresources that contain the artifacts, or the Profile could characterize the artifacts andprovide a point of contact for each one.

801

A.2.

802
803
804

Table 2 illustrates an excerpt of a notional action plan template, as described in Section 3.1.
Organizations that choose to use this template should customize it to meet their needs andpriorities.

805
806
807
808
809

In this template, the action plan includes rows for the priority of each action item, a descriptionof the action item, the responsible party or department, the target completion date, and theresources required to accomplish the action item (e.g., personnel, budget, tools). This template
can be integrated with the Profiles or maintained separately. The action plan can be based on
outcomes at the Function, Category, or Subcategory level or a combination of those levels.

Notional Action Plan Template

24

Initial Public Draft
810

The NIST Cybersecurity Framework 2.0
Table 2. Notional action plan template

Selected Framework
Outcomes

Priority

Action Item

25

Responsible
PartiesTargetCompletion
Date

Resources
RequiredPublic Draft

The NIST Cybersecurity Framework 2.0

811

Appendix B. Framework Tier Descriptions

812
813
814

Table 3 describes the Framework Tiers discussed in Section 3.2. The Tiers characterize the typical rigor of the cybersecurity risk
governance and management practices throughout an organization, including third-party cybersecurity risks.
Table 3. Framework Tiers

Tier
Tier 1:
PartialTier 2: Risk
Informed

Cybersecurity Risk Governance

Cybersecurity Risk Management

Application of organizational
There is limited awareness of cybersecurity
cybersecurity risk strategy is managed in risks at the organizational level.
an ad hoc manner.
The organization implements cybersecurity
Prioritization is ad hoc and not formallyrisk management on an irregular, case-bycase basis.
based on objectives or threat
environment.
The organization may not have processes

Risk management practices areapproved by management but may not
be established as organizational-wide
policy.
Prioritization of cybersecurity activities
and protection needs is directly informedby organizational risk objectives, thethreat environment, or business/mission
requirements.

Third-Party Cybersecurity Risks
The organization is generally unaware of
the cybersecurity risks of the products
and services it provides and uses.
The organization does not understand its
role in the larger ecosystem with respect
to either its dependencies or dependents.

that enable cybersecurity information to beshared within the organization.

The organization has not formalized its
capabilities to internally manage
cybersecurity risks in its supply chains orwith its partners and may do these
activities in a one-off manner.

There is an awareness of cybersecurity
risks at the organizational level, but anorganization-wide approach to managing
cybersecurity risks has not been
established.

The organization understands thecybersecurity risks in its supply chainsthat are associated with the products andservices that either support the businessand mission functions of the organizationor are utilized in the organization’s
products or services.

Consideration of cybersecurity inorganizational objectives and programs
may occur at some but not all levels of theorganization. Cyber risk assessment oforganizational and external assets occurs,
but is not typically repeatable orreoccurring.
Cybersecurity information is shared within
the organization on an informal basis.

26

The organization is aware of thecybersecurity risks associated with the
products and services it provides anduses, but does not act consistently orformally in response to those risks.

Public Draft
Tier
Tier 3:
Repeatable

The NIST Cybersecurity Framework 2.0
Cybersecurity Risk Governance
The organization’s risk management
practices are formally approved andexpressed as policy.
Risk-informed policies, processes, andprocedures are defined, implemented asintended, and reviewed.
Organizational cybersecurity practices
are regularly updated based on theapplication of risk management
processes to changes inbusiness/mission requirements, threats,
and technological landscape.

Tier 4:Adaptive

There is an organization-wide approachto managing cybersecurity risks thatuses risk-informed policies, processes,
and procedures to address potential
cybersecurity events. The relationshipbetween cybersecurity risks andorganizational objectives is clearly
understood and considered when
making decisions. Senior executives
monitor cybersecurity risks in the samecontext as financial and otherorganizational risks. The organizational
budget is based on an understanding of
the current and predicted risk
environment and risk tolerance.
Business units implement executive
vision and analyze system-level risks inthe context of the organizational risk
tolerances.

Cybersecurity Risk Management

Third-Party Cybersecurity Risks

There is an organization-wide approach to
managing cybersecurity risks.

The organization risk strategy is informedby cybersecurity risks associated with the
products and services it provides anduses. Personnel formally act upon thoserisks, including through mechanisms suchas written agreements to communicate
baseline requirements, governancestructures (e.g., risk councils), and policy
implementation and monitoring.

Consistent methods are in place torespond effectively to changes in risk.
Personnel possess the knowledge andskills to perform their appointed roles andresponsibilities.
The organization consistently andaccurately monitors cybersecurity risks ofassets. Senior cybersecurity and noncybersecurity executives communicate
regularly regarding cybersecurity
risks. Senior executives ensure thatcybersecurity is considered through alllines of operation in the organization.

The organization adapts its cybersecurity
practices based on previous and current
cybersecurity activities, including lessons
learned and predictive indicators. Througha process of continuous improvement thatincorporates advanced cybersecurity
technologies and practices, theorganization actively adapts to a changing
technological landscape and responds in atimely and effective manner to evolving,sophisticated threats.

27

An organization-wide approach to
managing cybersecurity risks in its supply
chains is instantiated in the organization’s
enterprise risk management policies,
processes, and procedures, which are inturn implemented consistently and asintended and continuously monitored andreviewed.
The organization uses real-time or nearreal-time information to understand andconsistently act upon cybersecurity risks
associated with the products and services
it provides and uses.
The organization has a governancestructure (e.g., Risk Council) thatmanages the organizational risk silos aswell as up and down the supply chain andaddresses its supply chain security
requirements in tandem with other risks.
The organization collaborates with its
suppliers and proactively manages its
relationships with its suppliers anddownstream dependents (e.g.,customers).

Public Draft
Tier

The NIST Cybersecurity Framework 2.0
Cybersecurity Risk Governance

Cybersecurity Risk Management

Cybersecurity risk management is part ofthe organizational culture. It evolves
from an awareness of previous activities
and continuous awareness of activities
on organizational systems and networks.
The organization can quickly andefficiently account for changes tobusiness/mission objectives in how risk
is approached and communicated.

28

Third-Party Cybersecurity Risks

Public Draft

The NIST Cybersecurity Framework 2.0

815

Appendix C. Framework Core

816
817
818

This section presents the Functions, Categories, and Subcategories of the Framework Core. The
Implementation Examples and Informative References of the Core will be maintained online on
the NIST Cybersecurity Framework website to allow for more frequent updates.

819
820

Table 4 shows the CSF 2.0 Core Function and Category names and unique alphabetic identifiers.
Table 4. CSF 2.0 Core Function and Category Names and Identifiers

Function
Govern (GV)

Identify (ID)Protect (PR)

Detect (DE)Respond (RS)Recover (RC)

821
822
823

Category

Category Identifier

Organizational Context

GV.OC

Risk Management Strategy

GV.RM

Cybersecurity Supply Chain Risk Management

GV.SC

Roles, Responsibilities, and Authorities

GV.RR

Policies, Processes, and Procedures

GV.PO

Oversight

GV.OV

Asset Management

ID.AM

Risk Assessment

ID.RA

Improvement

ID.IM

Identity Management, Authentication, and Access Control

PR.AA

Awareness and Training

PR.AT

Data Security

PR.DS

Platform Security

PR.PS

Technology Infrastructure Resilience

PR.IR

Continuous Monitoring

DE.CM

Adverse Event Analysis

DE.AE

Incident Management

RS.MA

Incident Analysis

RS.AN

Incident Response Reporting and Communication

RS.CO

Incident Mitigation

RS.MI

Incident Recovery Plan Execution

RC.RP

Incident Recovery Communication

RC.CO

The remaining tables in this appendix show the CSF 2.0 Core Functions, Categories, andSubcategories with one table for each Function. Each table also identifies when a CSF 1.1
Category or Subcategory has been moved to one or more CSF 2.0 Subcategories for traceability.

29

824

Public Draft

The NIST Cybersecurity Framework 2.0

The following are links to each of the CSF 2.0 Function tables:
Table 5. GOVERN (GV): Establish and monitor the organization’s cybersecurity risk management strategy, expectations, and policy
Table 6. IDENTIFY (ID): Help determine the current cybersecurity risk to the organization
Table 7. PROTECT (PR): Use safeguards to prevent or reduce cybersecurity risk
Table 8. DETECT (DE): Find and analyze possible cybersecurity attacks and compromises
Table 9. RESPOND (RS): Take action regarding a detected cybersecurity incident
Table 10. RECOVER (RC): Restore assets and operations that were impacted by a cybersecurity incident

Table 5. GOVERN (GV): Establish and monitor the organization’s cybersecurity risk management strategy, expectations, and policy

Category

Subcategory

Organizational Context (GV.OC): The circumstances —mission, stakeholder expectations, and legal, regulatory, andcontractual requirements — surrounding the organization’s
cybersecurity risk management decisions are understood(formerly ID.BE)
GV.OC-01: The organizational mission is understood and informs cybersecurity risk management (formerly
ID.BE-02, ID.BE-03)
GV.OC-02: Internal and external stakeholders are determined, and their needs and expectations regarding
cybersecurity risk management are understood
GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy
and civil liberties obligations — are understood and managed (formerly ID.GV-03)
GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from theorganization are determined and communicated (formerly ID.BE-04, ID.BE-05)
GV.OC-05: Outcomes, capabilities, and services that the organization depends on are determined andcommunicated (formerly ID.BE-01, ID.BE-04)30

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory

Risk Management Strategy (GV.RM): The organization’s
priorities, constraints, risk tolerance and appetite statements,
and assumptions are established, communicated, and used tosupport operational risk decisions (formerly ID.RM)
GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders(formerly ID.RM-01)
GV.RM-02: Risk appetite and risk tolerance statements are determined, communicated, and maintained(formerly ID.RM-02, ID.RM-03)
GV.RM-03: Enterprise risk management processes include cybersecurity risk management activities andoutcomes (formerly ID.GV-04)
GV.RM-04: Strategic direction that describes appropriate risk response options is established andcommunicated
GV.RM-05: Lines of communication across the organization are established for cybersecurity risks,
including risks from suppliers and other third parties
GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing
cybersecurity risks is established and communicated
GV.RM-07: Strategic opportunities (i.e., positive risks) are identified and included in organizational
cybersecurity risk discussions
Cybersecurity Supply Chain Risk Management (GV.SC):
Cyber supply chain risk management processes are identified,established, managed, monitored, and improved byorganizational stakeholders (formerly ID.SC)
GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, andprocesses are established and agreed to by organizational stakeholders (formerly ID.SC-01)
GV.SC-02: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established,communicated, and coordinated internally and externally (formerly ID.AM-06)
GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk
management, risk assessment, and improvement processes (formerly ID.SC-02)
GV.SC-04: Suppliers are known and prioritized by criticality

31

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, andintegrated into contracts and other types of agreements with suppliers and other relevant third parties(formerly ID.SC-03)
GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier orother third-party relationships
GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are identified,recorded, prioritized, assessed, responded to, and monitored over the course of the relationship (formerly
ID.SC-02, ID.SC-04)
GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, andrecovery activities (formerly ID.SC-05)
GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management
programs, and their performance is monitored throughout the technology product and service life cycle
GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur
after the conclusion of a partnership or service agreement

Roles, Responsibilities, and Authorities (GV.RR):
Cybersecurity roles, responsibilities, and authorities to foster
accountability, performance assessment, and continuous
improvement are established and communicated (formerly
ID.GV-02)
GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters aculture that is risk-aware, ethical, and continually improving
GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established,communicated, understood, and enforced (formerly ID.AM-06, ID.GV-02, DE.DP-01)
GV.RR-03: Adequate resources are allocated commensurate with cybersecurity risk strategy, roles andresponsibilities, and policies
GV.RR-04: Cybersecurity is included in human resources practices (formerly PR.IP-11)
Policies, Processes, and Procedures (GV.PO):
Organizational cybersecurity policies, processes, andprocedures are established, communicated, and enforced(formerly ID.GV-01)

32

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
GV.PO-01: Policies, processes, and procedures for managing cybersecurity risks are established based onorganizational context, cybersecurity strategy, and priorities and are communicated and enforced (formerly
ID.GV-01)
GV.PO-02: Policies, processes, and procedures for managing cybersecurity risks are reviewed, updated,
communicated, and enforced to reflect changes in requirements, threats, technology, and organizational
mission (formerly ID.GV-01)

Oversight (GV.OV): Results of organization-wide
cybersecurity risk management activities and performance areused to inform, improve, and adjust the risk management
strategy
GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy
and direction
GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage oforganizational requirements and risks
GV.OV-03: Organizational cybersecurity risk management performance is measured and reviewed toconfirm and adjust strategic direction
Table 6. IDENTIFY (ID): Help determine the current cybersecurity risk to the organization

Category

Subcategory

Asset Management (ID.AM): Assets (e.g., data, hardware
software, systems, facilities, services, people) that enable theorganization to achieve business purposes are identified andmanaged consistent with their relative importance toorganizational objectives and the organization’s risk strategy
ID.AM-01: Inventories of hardware managed by the organization are maintained
ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained
ID.AM-03: Representations of the organization’s authorized network communication and internal andexternal network data flows are maintained (formerly ID.AM-03, DE.AE-01)
ID.AM-04: Inventories of services provided by suppliers are maintained33

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact on the mission
ID.AM-06: Dropped (moved to GV.RR-02, GV.SC-02)
ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained
ID.AM-08: Systems, hardware, software, and services are managed throughout their life cycle (formerly
PR.DS-03, PR.IP-02, PR.MA-01, PR.MA-02)

Business Environment (ID.BE): Dropped (moved to GV.OC)
ID.BE-01: Dropped (moved to GV.OC-05)
ID.BE-02: Dropped (moved to GV.OC-01)
ID.BE-03: Dropped (moved to GV.OC-01)
ID.BE-04: Dropped (moved to GV.OC-04, GV.OC-05)
ID.BE-05: Dropped (moved to GV.OC-04)
Governance (ID.GV): Dropped (moved to GV)
ID.GV-01: Dropped (moved to GV.PO)
ID.GV-02: Dropped (moved to GV.RR-02)
ID.GV-03: Dropped (moved to GV.OC-03)
ID.GV-04: Dropped (moved to GV.RM-03)
Risk Assessment (ID.RA): The organization understands thecybersecurity risk to the organization, assets, and individuals.
ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded (formerly ID.RA-01, PR.IP-12,
DE.CM-08)
ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources
ID.RA-03: Internal and external threats to the organization are identified and recorded
ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
ID.RA-05: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk and inform risk
prioritization

34

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
ID.RA-06: Risk responses are chosen from the available options, prioritized, planned, tracked, andcommunicated (formerly ID.RA-06, RS.MI-03)
ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked (formerly
part of PR.IP-03)
ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established(formerly RS.AN-05)
ID.RA-09: The authenticity and integrity of hardware and software are assessed prior to acquisition and use(formerly PR.DS-08)

Risk Management Strategy (ID.RM): Dropped (moved to
GV.RM)
ID.RM-01: Dropped (moved to GV.RM-01)
ID.RM-02: Dropped (moved to GV.RM-02)
ID.RM-03: Dropped (moved to GV.RM-02)
Supply Chain Risk Management (ID.SC): Dropped (moved to
GV.SC)
ID.SC-01: Dropped (moved to GV.SC-01)
ID.SC-02: Dropped (moved to GV.SC-03, GV.SC-07)
ID.SC-03: Dropped (moved to GV.SC-05)
ID.SC-04: Dropped (moved to GV.SC-07)
ID.SC-05: Dropped (moved to GV.SC-08, ID.IM-02)
Improvement (ID.IM): Improvements to organizational
cybersecurity risk management processes, procedures andactivities are identified across all Framework Functions
ID.IM-01: Continuous evaluation is applied to identify improvements
ID.IM-02: Security tests and exercises, including those done in coordination with suppliers and relevant
third parties, are conducted to identify improvements (formerly ID.SC-05, PR.IP-10, DE.DP-03)

35

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
ID.IM-03: Lessons learned during execution of operational processes, procedures, and activities are used to
identify improvements (formerly PR.IP-07, PR.IP-08, DE.DP-05, RS.IM-01, RS.IM-02, RC.IM-01, RC.IM02)
ID.IM-04: Cybersecurity plans that affect operations are communicated, maintained, and improved(formerly PR.IP-09)
Table 7. PROTECT (PR): Use safeguards to prevent or reduce cybersecurity risk

Category

Subcategory

Identity Management, Authentication, and Access Control(PR.AA): Access to physical and logical assets is limited toauthorized users, services, and hardware, and is managed
commensurate with the assessed risk of unauthorized access(formerly PR.AC)
PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by theorganization (formerly PR.AC-01)
PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions (formerly
PR.AC-06)
PR.AA-03: Users, services, and hardware are authenticated (formerly PR.AC-03, PR.AC-07)
PR.AA-04: Identity assertions are protected, conveyed, and verified
PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced,
and reviewed, and incorporate the principles of least privilege and separation of duties (formerly PR.AC-01,
PR.AC-03, PR.AC-04)
PR.AA-06: Physical access to assets is managed, monitored, and enforced commensurate with risk (formerly
PR.AC-02, PR.PT-04)
Identity Management, Authentication and Access Control(PR.AC): Dropped (moved to PR.AA)
PR.AC-01: Dropped (moved to PR.AA-01, PR.AA-05)
PR.AC-02: Dropped (moved to PR.AA-06)
PR.AC-03: Dropped (moved to PR.AA-03, PR.AA-05, PR.IR-01)

36

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
PR.AC-04: Dropped (moved to PR.AA-05)
PR.AC-05: Dropped (moved to PR.IR-01)
PR.AC-06: Dropped (moved to PR.AA-02)
PR.AC-07: Dropped (moved to PR.AA-03)

Awareness and Training (PR.AT): The organization’s
personnel are provided cybersecurity awareness and training sothey can perform their cybersecurity-related tasks
PR.AT-01: Users are provided awareness and training so they possess the knowledge and skills to performgeneral tasks with security risks in mind (formerly PR.AT-01, PR.AT-03, RS.CO-01)
PR.AT-02: Individuals in specialized roles are provided awareness and training so they possess theknowledge and skills to perform relevant tasks with security risks in mind (formerly PR.AT-02, PR.AT-03,
PR.AT-04, PR.AT-05)
PR.AT-03: Dropped (moved to PR.AT-01, PR.AT-02)
PR.AT-04: Dropped (moved to PR.AT-02)
PR.AT-05: Dropped (moved to PR.AT-02)
Data Security (PR.DS): Data is managed consistent with theorganization’s risk strategy to protect the confidentiality,
integrity, and availability of information
PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected (formerly PR.DS-01,
PR-DS.05, PR.DS-06, PR.PT-02)
PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected (formerly PR.DS02, PR.DS-05)
PR.DS-03: Dropped (moved to ID.AM-08)
PR.DS-04: Dropped (moved to PR.IR-04)
PR.DS-05: Dropped (moved to PR.DS-01, PR-DS-02, PR.DS-10)
PR.DS-06: Dropped (moved to PR.DS-01, DE.CM-09)
PR.DS-07: Dropped (moved to PR.IR-01)

37

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
PR.DS-08: Dropped (moved to ID.RA-09, DE.CM-09)
PR.DS-09: Data is managed throughout its life cycle, including destruction (formerly PR.IP-06)
PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected (formerly PR.DS-05)
PR.DS-11: Backups of data are created, protected, maintained, and tested (formerly PR.IP-04)

Information Protection Processes and Procedures (PR.IP):
Dropped (moved to other Categories and Functions)
PR.IP-01: Dropped (moved to PR.PS-01)
PR.IP-02: Dropped (moved to ID.AM-08)
PR.IP-03: Dropped (moved to PR.PS-01, ID.RA-07)
PR.IP-04: Dropped (moved to PR.DS-11)
PR.IP-05: Dropped (moved to PR.IR-02)
PR.IP-06: Dropped (moved to PR.DS-09)
PR.IP-07: Dropped (moved to ID.IM-03)
PR.IP-08: Dropped (moved to ID.IM-03)
PR.IP-09: Dropped (moved to ID.IM-04)
PR.IP-10: Dropped (moved to ID.IM-02)
PR.IP-11: Dropped (moved to GV.RR-04)
PR.IP-12: Dropped (moved to ID.RA-01, PR.PS-02)
Maintenance (PR.MA): Dropped (moved to ID.AM-08)
PR.MA-01: Dropped (moved to ID.AM-08, PR.PS-03)
PR.MA-02: Dropped (moved to ID.AM-08, PR.PS-02)
Protective Technology (PR.PT): Dropped (moved to otherProtect Categories)
PR.PT-01: Dropped (moved to PR.PS-04)
PR.PT-02: Dropped (moved to PR.DS-01, PR.PS-01)

38

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
PR.PT-03: Dropped (moved to PR.PS-01)
PR.PT-04: Dropped (moved to PR.AA-07, PR.IR-01)
PR.PT-05: Dropped (moved to PR.IR-04)

Platform Security (PR.PS): The hardware, software (e.g.,
firmware, operating systems, applications), and services ofphysical and virtual platforms are managed consistent with theorganization’s risk strategy to protect their confidentiality,
integrity, and availability
PR.PS-01: Configuration management practices are applied (formerly PR.IP-01, PR.IP-03, PR.PT-02,
PR.PT-03)
PR.PS-02: Software is maintained, replaced, and removed commensurate with risk (formerly PR.IP-12,
PR.MA-02)
PR.PS-03: Hardware is maintained, replaced, and removed commensurate with risk (formerly PR.MA-01)
PR.PS-04: Log records are generated and made available for continuous monitoring (formerly PR.PT-01)
PR.PS-05: Installation and execution of unauthorized software are prevented
PR.PS-06: Secure software development practices are integrated and their performance is monitored
throughout the software development life cycle
Technology Infrastructure Resilience (PR.IR): Security
architectures are managed with the organization’s risk strategy
to protect asset confidentiality, integrity, and availability, andorganizational resilience
PR.IR-01: Networks and environments are protected from unauthorized logical access and usage (formerly
PR.AC-03, PR.AC-05, PR.DS-07, PR.PT-04)
PR.IR-02: The organization’s technology assets are protected from environmental threats (formerly PR.IP05)
PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations(formerly PR.PT-05)
PR.IR-04: Adequate resource capacity to ensure availability is maintained (formerly PR.DS-04)

39

Public Draft

The NIST Cybersecurity Framework 2.0
Table 8. DETECT (DE): Find and analyze possible cybersecurity attacks and compromises

Category

Subcategory

Continuous Monitoring (DE.CM): Assets are monitored tofind anomalies, indicators of compromise, and other potentiallyadverse events
DE.CM-01: Networks and network services are monitored to find potentially adverse events (formerly
DE.CM-01, DE.CM-04, DE.CM-05, DE.CM-07)
DE.CM-02: The physical environment is monitored to find potentially adverse events
DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events(formerly DE.CM-03, DE.CM-07)
DE.CM-04: Dropped (moved to DE.CM-01, DE.CM-09)
DE.CM-05: Dropped (moved to DE.CM-01, DE.CM-09)
DE.CM-06: External service provider activities and services are monitored to find potentially adverse events(formerly DE.CM-06, DE.CM-07)
DE.CM-07: Dropped (moved to DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09)
DE.CM-08: Dropped (moved to ID.RA-01)
DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to findpotentially adverse events (formerly PR.DS-06, PR.DS-08, DE.CM-04, DE.CM-05, DE.CM-07)
Adverse Event Analysis (DE.AE): Anomalies, indicators ofcompromise, and other potentially adverse events are analyzed
to characterize the events and detect cybersecurity incidents(formerly DE.AE, DE.DP-02)
DE.AE-01: Dropped (moved to ID.AM-03)
DE.AE-02: Potentially adverse events are analyzed to better understand associated activities
DE.AE-03: Information is correlated from multiple sources
DE.AE-04: The estimated impact and scope of adverse events are determined
DE.AE-05: Dropped (moved to DE.AE-08)
DE.AE-06: Information on adverse events is provided to authorized staff and tools (formerly DE.DP-04)40

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis
DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria (formerly DE.AE05)

Detection Processes (DE.DP): Dropped (moved to otherCategories and Functions)DE.DP-01: Dropped (moved to GV.RR-02)
DE.DP-02: Dropped (moved to DE.AE)
DE.DP-03: Dropped (moved to ID.IM-02)
DE.DP-04: Dropped (moved to DE.AE-06)
DE.DP-05: Dropped (moved to ID.IM-03)

Table 9. RESPOND (RS): Take action regarding a detected cybersecurity incident

Category

Subcategory

Response Planning (RS.RP): Dropped (moved to RS.MA)
RS.RP-01: Dropped (moved to RS.MA-01)
Incident Management (RS.MA): Responses to detectedcybersecurity incidents are managed (formerly RS.RP)
RS.MA-01: The incident response plan is executed once an incident is declared in coordination with relevant
third parties (formerly RS.RP-01, RS.CO-04)
RS.MA-02: Incident reports are triaged and validated (formerly RS.AN-01, RS.AN-02)
RS.MA-03: Incidents are categorized and prioritized (formerly RS.AN-04, RS.AN-02)
RS.MA-04: Incidents are escalated or elevated as needed (formerly RS.AN-02, RS.CO-04)
RS.MA-05: The criteria for initiating incident recovery are applied

41

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory

Incident Analysis (RS.AN): Investigation is conducted toensure effective response and support forensics and recovery
activities
RS.AN-01: Dropped (moved to RS.MA-02)
RS.AN-02: Dropped (moved to RS.MA-02, RS.MA-03, RS.MA-04)
RS.AN-03: Analysis is performed to determine what has taken place during an incident and the root cause of
the incident
RS.AN-04: Dropped (moved to RS.MA-03)
RS.AN-05: Dropped (moved to ID.RA-08)
RS.AN-06: Actions performed during an investigation are recorded and the records’ integrity andprovenance are preserved (formerly part of RS.AN-03)
RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved
RS.AN-08: The incident’s magnitude is estimated and validated
Incident Response Reporting and Communication(RS.CO): Response activities are coordinated with internal andexternal stakeholders as required by laws, regulations, or
policies
RS.CO-01: Dropped (moved to PR.AT-01)
RS.CO-02: Internal and external stakeholders are notified of incidents
RS.CO-03: Information is shared with designated internal and external stakeholders (formerly RS.CO-03,
RS.CO-05)
RS.CO-04: Dropped (moved to RS.MA-01, RS.MA-04)
RS.CO-05: Dropped (moved to RS.CO-03)
Incident Mitigation (RS.MI): Activities are performed toprevent expansion of an event and mitigate its effects
RS.MI-01: Incidents are contained
RS.MI-02: Incidents are eradicated42

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
RS.MI-03: Dropped (moved to ID.RA-06)

Improvements (RS.IM): Dropped (moved to ID.IM)
RS.IM-01: Dropped (moved to ID.IM-03)
RS.IM-02: Dropped (moved to ID.IM-03)
Table 10. RECOVER (RC): Restore assets and operations that were impacted by a cybersecurity incident

Category

Subcategory

Incident Recovery Plan Execution (RC.RP): Restoration
activities are performed to ensure operational availability ofsystems and services affected by cybersecurity incidents
RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident
response process
RC.RP-02: Recovery actions are determined, scoped, prioritized, and performed
RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration
RC.RP-04: Critical mission functions and cybersecurity risk management are considered to establish postincident operational norms
RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal
operating status is confirmed
RC.RP-06: The criteria for determining the end of incident recovery are applied, and incident-related
documentation is completed
Incident Recovery Communication (RC.CO): Restoration
activities are coordinated with internal and external parties
RC.CO-01: Dropped (moved to RC.CO-04)
RC.CO-02: Dropped (moved to RC.CO-04)
RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated todesignated internal and external stakeholders

43

Public Draft

The NIST Cybersecurity Framework 2.0
Category

Subcategory
RC.CO-04: Public updates on incident recovery are properly shared using approved methods and messaging(formerly RC.CO-01, RC.CO-02)

Improvements (RC.IM): Dropped (moved to ID.IM)
RC.IM-01: Dropped (moved to ID.IM-03)
RC.IM-02: Dropped (moved to ID.IM-03)

44