# NIST CSF 2.0 Standards Reference

## Primary Standard
### NIST Cybersecurity Framework (CSF) Version 2.0
- **Published**: February 26, 2024
- **Publisher**: National Institute of Standards and Technology (NIST)
- **Document**: NIST CSWP 29
- **Scope**: Applicable to all organizations regardless of size, sector, or maturity
- **Key Change**: Added Govern function as central pillar; expanded from 5 to 6 functions

## CSF 2.0 Core Structure

### GV - Govern
- GV.OC-01 to GV.OC-05: Organizational context understood
- GV.RM-01 to GV.RM-07: Risk management strategy established
- GV.RR-01 to GV.RR-04: Roles, responsibilities, and authorities
- GV.PO-01 to GV.PO-02: Cybersecurity policy established
- GV.OV-01 to GV.OV-03: Cybersecurity strategy oversight
- GV.SC-01 to GV.SC-10: Supply chain risk management

### ID - Identify
- ID.AM-01 to ID.AM-08: Asset management
- ID.RA-01 to ID.RA-10: Risk assessment
- ID.IM-01 to ID.IM-04: Improvement
- ID.BE (removed in 2.0, moved to GV)

### PR - Protect
- PR.AA-01 to PR.AA-06: Identity management, authentication, access control
- PR.AT-01 to PR.AT-02: Awareness and training
- PR.DS-01 to PR.DS-10: Data security
- PR.PS-01 to PR.PS-06: Platform security
- PR.IR-01 to PR.IR-02: Technology infrastructure resilience

### DE - Detect
- DE.CM-01 to DE.CM-09: Continuous monitoring
- DE.AE-01 to DE.AE-08: Adverse event analysis

### RS - Respond
- RS.MA-01 to RS.MA-05: Incident management
- RS.AN-01 to RS.AN-08: Incident analysis
- RS.CO-01 to RS.CO-03: Incident response reporting and communication
- RS.MI-01 to RS.MI-02: Incident mitigation

### RC - Recover
- RC.RP-01 to RC.RP-06: Incident recovery plan execution

## Implementation Tiers Detail

### Tier 1: Partial
- **Risk Management Process**: Ad hoc; not formalized
- **Integrated Risk Management**: Limited awareness; irregular risk practices
- **External Participation**: No formal collaboration with external entities
- **Governance**: Cybersecurity not integrated into enterprise risk management

### Tier 2: Risk-Informed
- **Risk Management Process**: Approved by management but may not be policy
- **Integrated Risk Management**: Awareness at organizational level; some sharing
- **External Participation**: Aware of ecosystem role; limited collaboration
- **Governance**: Some integration of cybersecurity into enterprise risk

### Tier 3: Repeatable
- **Risk Management Process**: Formally approved policies; regularly updated
- **Integrated Risk Management**: Organization-wide approach; consistent implementation
- **External Participation**: Regular collaboration with partners and ecosystem
- **Governance**: Cybersecurity fully integrated into enterprise risk management

### Tier 4: Adaptive
- **Risk Management Process**: Continuous improvement using advanced techniques
- **Integrated Risk Management**: Real-time shared awareness; dynamic risk response
- **External Participation**: Active leadership in ecosystem risk management
- **Governance**: Agile cybersecurity governance adapting to changes

## Related NIST Publications
- **SP 800-53 Rev 5**: Security and Privacy Controls (detailed control catalog)
- **SP 800-37 Rev 2**: Risk Management Framework (RMF)
- **SP 800-30 Rev 1**: Guide for Conducting Risk Assessments
- **SP 800-171 Rev 3**: Protecting CUI in Nonfederal Systems
- **SP 800-207**: Zero Trust Architecture
- **SP 800-218**: Secure Software Development Framework (SSDF)

## CSF 2.0 Informative References
The CSF references specific controls from:
- NIST SP 800-53 Rev 5
- ISO/IEC 27001:2022
- CIS Controls v8
- COBIT 2019
- ISA/IEC 62443 (Industrial Control Systems)
