NIST CSF

What is the NIST Cybersecurity Framework (CSF)?

The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, public-domain framework that organizes cybersecurity into six functions — Govern, Identify, Protect, Detect, Respond, and Recover — each broken into categories and subcategories of outcomes. It is a common language for managing cyber risk and a popular on-ramp before a formal audit. There is no NIST CSF certification.

The six functions

CSF 2.0 organizes security outcomes into six functions: Govern (added in 2.0, covering strategy, roles, and risk-management decisions), Identify, Protect, Detect, Respond, and Recover. Together they describe a full lifecycle from understanding your risk to recovering from incidents.

How it is structured

Each function contains categories, which contain subcategories, the specific outcomes you aim for. The framework also provides Implementation Tiers (how rigorous your practices are) and Profiles (your current versus target state), so you can measure and prioritize rather than treat it as pass/fail.

Voluntary, public-domain, and not certifiable

There is no official NIST CSF certificate. Organizations self-assess and align, sometimes with a third-party assessment, and use the framework as a shared vocabulary with customers, boards, and regulators. It is a superb starting point before committing to a certifiable standard like ISO 27001.

Where Keel fits

NIST CSF is free on every Keel plan. Keel ships the framework as a trackable control set, crosswalked to SOC 2, ISO 27001, and the rest, so the work you do for CSF counts toward whatever formal framework you pursue next.

FAQ