NIST CSF 2.0 — Govern is the new front door.
Six functions, twenty-two categories, your maturity tier per outcome. CSF 2.0 finally treats governance as cybersecurity — Cybereen runs your organisational profile, target profile, and the gap between them.
An outcomes framework — not a control list.
The NIST Cybersecurity Framework is a voluntary, outcome-based framework first published in 2014 and updated to 2.0 in February 2024. Where ISO and SOC 2 prescribe controls, CSF describes outcomes — you bring the controls that get you there.
The 2.0 revision did three things that matter. It added a sixth function — Govern — pulling supply chain, roles, strategy and oversight to the front. It made the framework explicitly universal (no longer just for critical infrastructure). And it leaned into Organisational Profiles — a current-state and target-state snapshot you can show your board in one document.
You assess against four Implementation Tiers — Partial, Risk-Informed, Repeatable, Adaptive. The tiers are not maturity scores; they describe how risk-aware and consistent your practices are. Most regulated mid-market orgs target Tier 3 (Repeatable); critical infrastructure pushes for Tier 4.
Four tiers. Pick where your risk appetite lands.
Tiers describe the rigour of your cyber risk management — not how many controls you have. Higher tier means more risk-informed decisions and tighter feedback loops.
Partial.
Risk practices ad-hoc, awareness limited, supply chain not assessed. Common starting point for small orgs without dedicated cyber leadership.
- Reactive, case-by-case
- No formal risk strategy
- Suits very small / new orgs
Risk-Informed.
Risk is considered, but not consistently. Cyber is on leadership's radar but not yet embedded in business decisions.
- Cyber strategy drafted
- Some categories covered well
- Inconsistent across teams
Repeatable.
Cyber risk management is formal, organisation-wide, and updated as the environment changes. The level most regulated mid-market AU orgs should target.
- Consistent, documented
- Supply chain assessed
- Board-visible reporting
Adaptive.
Cyber risk practices continuously improve from lessons learned and predictive indicators. Required for critical infrastructure and high-target orgs.
- Predictive threat modelling
- Real-time risk integration
- SOC 24/7 expected
Six functions. Govern wraps the other five.
The CSF Core is a hierarchy: 6 Functions → 22 Categories → ~106 Subcategories. Govern is the new function in 2.0 and the one auditors and boards open first.
Strategy, roles, policy, oversight, supply chain. The "who-decides" layer.
Asset inventory, risk assessment, business environment, supplier risk.
Access control, awareness, data security, secure development, platform security.
Continuous monitoring, adverse-event analysis, detection process maintenance.
Incident management, analysis, communication, mitigation, recovery prep.
Incident recovery plan execution, communication, lessons learned.
Where you are today.
Snapshot of your tier per Category, with the evidence underpinning each. The "you're here" diagram for the board pack.
Where you're going.
Risk-informed target state, by Subcategory. Cybereen tracks the gap — turning a CSF "outcome" into a backlog item with an owner and a date.
Profile in. Profile out. Living document.
The Organisational Profile isn't a one-time PDF — it's how you talk about cyber to your board, your insurer, and your largest customer. Cybereen keeps it current automatically.
- Current & Target Profile — side-by-side, per Subcategory, gap quantified.
- Tier scoring — automatic Tier 1–4 derivation from your evidence stream.
- Govern dashboard — the new function gets first-class treatment: strategy, roles, oversight, supply chain.
- Board pack export — one page per Function, current vs target, top three gaps.
- Cross-framework reuse — your CSF Subcategories map to ISO Annex A, SOC 2 TSCs, Essential Eight mitigations.
Three places CSF programmes drift.
Outcomes-based frameworks are flexible — and that flexibility is where most teams trip.
Treating tiers as a score to hit.
Tier 4 isn't a target for every org — it's appropriate for high-target ones. Aiming for Tier 4 across the board burns budget on adaptive practices for risks you don't carry. Tiers should map to risk appetite, not vanity.
Skipping Govern because "we have ISO".
Govern overlaps with ISO clauses 4–6 but is broader — it includes supply chain risk and roles in a way ISO doesn't quite. Reusing ISO evidence is right; assuming Govern is "covered" is wrong.
Profile as a one-time exercise.
The Organisational Profile is the live picture of your cyber posture — not a slide your CISO drew in March. If the only time anyone touches it is your annual board update, it's a relic by week six.
Questions before you adopt 2.0.
The framework changed enough between 1.1 and 2.0 to matter.
Is CSF mandatory for AU organisations?
We're on CSF 1.1 — what changes in 2.0?
How does CSF relate to ISO 27001 and Essential Eight?
Can we certify against CSF?
How do we set tier targets?
Does Cybereen replace our SIEM / EDR / risk-management tool?
Your CSF Profile in 90 minutes — for real.
Answer a structured set of questions per Function. Cybereen builds your current Profile, asks for the evidence behind each Subcategory, and shows the gap to your target. Free trial, no card.