NIST CSF

What is NIST CSF?

The NIST CSF (Cybersecurity Framework) is a voluntary framework from the US National Institute of Standards and Technology that gives organisations a common language and structure to understand, prioritise and manage cyber risk. The current version, CSF 2.0, was published on 26 February 2024 and groups all security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. The framework does not prescribe specific technical controls; it describes what you need to achieve, while standards such as IEC 62443 and ISO 27001 fill in the how. That makes it a practical backbone for a security programme in both IT and OT, such as factories, power stations and water utilities.

🕰️ How did the NIST CSF come about?

The framework originates from Executive Order 13636, Improving Critical Infrastructure Cybersecurity, of 12 February 2013. That order directed NIST to develop a voluntary framework for critical infrastructure together with industry and government. The Cybersecurity Enhancement Act of 2014 subsequently gave this role of NIST a statutory basis.

Versions 1.0 and 1.1 were translated into thirteen languages. With 2.0 the focus on critical infrastructure was dropped: the title is now simply The NIST Cybersecurity Framework (CSF) 2.0, aimed at organisations of every size and sector.

🧠 What are the components of the NIST CSF?

CSF 2.0 consists of three building blocks:

• CSF Core - the hierarchy of functions, categories and subcategories. Each subcategory is a desired outcome, for example “inventories of hardware managed by the organization are maintained” (ID.AM-01).
• Profiles - CSF 2.0 calls them Organizational Profiles: a Current Profile describes which outcomes you achieve today, a Target Profile which ones you want to achieve. The gap between them is your action plan. Community Profiles are shared target profiles for a sector or threat, such as the profile for manufacturing.
• Tiers - four levels (Partial, Risk Informed, Repeatable, Adaptive) that indicate how rigorous your governance and risk management practices are. Tiers are not a strict maturity model: not every organisation needs to aim for Tier 4.

Around the Core, NIST publishes online resources: Implementation Examples for each subcategory, Quick Start Guides for audiences such as small businesses, enterprise risk managers and organisations securing their supply chains, and a catalogue of Informative References in the Cybersecurity and Privacy Reference Tool (CPRT). That catalogue maps the CSF to more than fifty other documents, including NIST SP 800-53 Rev. 5. In version 1.1, references to IEC 62443, ISO 27001 and COBIT were still printed in the document itself.

🔧 What are the six functions of NIST CSF 2.0?

Govern sits at the centre of the CSF wheel: it determines how the other five functions are organised. Its six categories are organisational context, risk management strategy, roles and responsibilities, policy, oversight and cybersecurity supply chain risk management. The last of these was still a category under Identify in 1.1. In Protect, the category for identity management, authentication and access control received the new code PR.AA (PR.AC in 1.1), and Platform Security (PR.PS) and Technology Infrastructure Resilience (PR.IR) are new; they absorb, among others, the former categories PR.IP, PR.MA and PR.PT. Identify gained a dedicated category, ID.IM, for improvement based on exercises, audits and incidents.

🏭 How do you apply the NIST CSF in industrial environments?

The CSF is technology-neutral, so you have to translate it to OT yourself. In practice, that means for each function:

• Govern - define who owns OT risk and how supplier risk is assessed; in OT, system integrators and machine builders are often the largest external party.
• Identify - a complete inventory of OT assets through asset discovery and passive monitoring, so that active scans do not disrupt the control system. Risks are weighed on safety, environment and production, not only on data.
• Protect - Defense in Depth and network segmentation following the zones and conduits model as the foundation, supplemented by secure remote access and a realistic patch cycle for PLCs and HMIs.
• Detect - SIEM and anomaly detection that understand OT protocols such as Modbus, OPC UA and GOOSE, tested against techniques from MITRE ATT&CK for ICS.
• Respond - an incident response plan that accounts for safety and production continuity: isolating a controller can itself shut down a process.
• Recover - immutable backups of PLC programs and HMI configurations, and rehearsed recovery procedures with achievable RTO and RPO values.

For OT-specific guidance, NIST points to NIST SP 800-82. Rev. 3 (September 2023) still follows the five functions of CSF 1.1; the Rev. 4 draft from September 2026 is built around CSF 2.0. In addition, NIST released a draft CSF 2.0 Manufacturing Profile (NIST IR 8183 Rev. 2) in September 2025. That profile prioritises subcategories based on five mission objectives: human safety, environmental safety, production goals, product quality and sensitive information.

🧭 How do you carry out a NIST CSF assessment?

1. Define the scope - one site, one production line or the whole organisation, and which OT connections are included.
2. Build the Current Profile - assess for each subcategory whether the outcome is achieved, for example on a 0 to 4 scale or as not / partly / largely / fully.
3. Choose a Target Profile - based on risk, legislation and sector profiles. Not every subcategory deserves the same level.
4. Analyse the gap - record the gaps in a risk register and prioritise by impact on safety and availability.
5. Create a roadmap - link each action to an owner, a budget and a concrete control from IEC 62443 or ISO 27001.
6. Repeat periodically - usually annually or after major changes and incidents, so that ID.IM actually works.

A CSF score is a snapshot, not a certificate. If you want to measure maturity over time, combine the profile with a maturity model.

🔍 What is the difference between NIST CSF, IEC 62443 and ISO 27001?

The three are not mutually exclusive. Many industrial companies use the CSF to talk to the board, ISO 27001 as the management system and IEC 62443 for technical requirements on plants and suppliers.

🔐 What does the NIST CSF mean for NIS2 and the Dutch Cybersecurity Act?

NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, do not prescribe a specific framework. They require appropriate, risk-based measures, with management accountability, supplier management and incident reporting. The CSF maps onto this well: Govern covers the board-level side, GV.SC the supply chain and Respond the incident handling.

• ENISA mapping - ENISA’s technical implementation guidance for Implementing Regulation (EU) 2024/2690 contains a table that maps the requirements to ISO 27001:2022 and NIST CSF 2.0.
• Belgium - the CyberFundamentals framework (CyFun) of the Centre for Cybersecurity Belgium follows the CSF structure and is a recognised route there to demonstrate NIS2 compliance. Ireland became a co-owner of CyFun in 2025 and recommends the version based on CSF 2.0.
• Netherlands - the CSF is not a formal assessment framework, but it is a useful gap analysis alongside ISO 27001, or the BIO for government bodies.

For many organisations, the NIST CSF is the anchor on which the OT security programme is built, precisely because it is easy to explain to the board and management.

❓ Frequently asked questions

Is the NIST CSF mandatory?

The NIST CSF is a voluntary framework; no European or Dutch law requires you to use it. It does help you demonstrate that you take appropriate measures under NIS2 and the Dutch Cybersecurity Act. Only for US federal agencies has its use been mandatory, since Executive Order 13800 of 2017.

Can you get certified against the NIST CSF?

There is no official certification for the NIST CSF. Auditors can perform an assessment or attestation against the CSF, but that is not a certificate like ISO 27001. If you need a certificate, you usually choose ISO 27001, or IEC 62443-4-1 and 4-2 for products.

What is new in NIST CSF 2.0?

NIST CSF 2.0 adds a sixth function, Govern, targets all organisations instead of only critical infrastructure and pays more attention to supply chain risk management. The number of categories fell from 23 to 22 and the number of subcategories from 108 to 106. NIST also added online Implementation Examples, Quick Start Guides and a reference tool.

Are the NIST CSF Tiers a maturity model?

The NIST CSF Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorously an organisation governs and manages cyber risk. NIST does not present them as a maturity model and does not advise every organisation to pursue Tier 4. The appropriate level depends on risk, resources and legal requirements.

Is the NIST CSF suitable for OT?

The NIST CSF is suitable for OT because it is technology-neutral and describes outcomes rather than IT-specific controls. For the OT detail, you use NIST SP 800-82, the Manufacturing Profile and IEC 62443. Keep in mind that availability and safety weigh more heavily than confidentiality in OT.

How long does a NIST CSF assessment take?

A first NIST CSF assessment for a single site typically takes a few days to a few weeks, depending on scope and available documentation. Most of the effort goes into collecting evidence and interviewing IT, OT and management. Repeat assessments are faster because the Current Profile already exists.

📌 In summary

NIST CSF 2.0 is a free, voluntary framework that organises cybersecurity into six functions (Govern, Identify, Protect, Detect, Respond, Recover), giving IT, OT and the board a common language. Current and Target Profiles make gaps visible, IEC 62443, ISO 27001 and NIST SP 800-82 fill in the controls, and under NIS2 and the Dutch Cybersecurity Act the CSF helps you demonstrate a risk-based approach.