Huntress Acquires Inside Agent: A New Era for Identity ProtectionFree Trial
Menu
InvestorsCareersBlogAboutAcademySupportContact
LoginSign up
NIST FRAMEWORKS · CSF 2.0 · 800-53 · RISK MANAGEMENT · FEDERAL COMPLIANCE

NIST-aligned securitygovernance framework.Structured risk. Measurable posture.

Align security posture to NIST CSF 2.0 and NIST 800-53 for structured risk governance, federal contract eligibility, and critical infrastructure compliance. Gap assessments, control implementation, and programme roadmaps.

Framework Overview

NIST CSF 2.0 — the cybersecurity
governance standard.

Released February 2024, CSF 2.0 adds a Govern function and elevates supply-chain risk — reflecting how enterprise security programmes must operate today.

0%
Global enterprise CSF adoption
0
Subcategories in CSF 2.0
0
Control families in 800-53 Rev 5
0+
Individual controls in 800-53
GVF1
Govern
Establishes cybersecurity strategy, expectations, policy, and accountability across the organisation. New in CSF 2.0.
IDF2
Identify
Understand the organisation's current cybersecurity risk to systems, people, assets, data, and capabilities.
PRF3
Protect
Develop and implement appropriate safeguards to ensure delivery of critical infrastructure services.
DEF4
Detect
Develop and implement appropriate activities to identify the occurrence of a cybersecurity event.
RSF5
Respond
Develop and implement appropriate activities to take action regarding detected cybersecurity incidents.
RCF6
Recover
Develop and implement appropriate activities to maintain plans for resilience and restoration of capabilities.

CSF 2.0 Functions

Six functions. One
integrated programme.

Establishes cybersecurity strategy, expectations, policy, and accountability across the organisation. New in CSF 2.0.

Subcategory Areas
Organisational ContextRisk Management StrategyRoles & ResponsibilitiesPolicyOversightCybersecurity Supply Chain Risk
Key Outcomes
Board-level risk visibility
CISO mandate with authority
Supplier risk governance
Documented policy lifecycle
92maturity score
Govern Function
6 subcategory areas

Implementation Tiers

Measure maturity, not just compliance.
Four NIST tiers.

NIST Tiers are not compliance levels — they describe the rigour and sophistication of your risk management programme.

T1
Partial
Tier 1 of 4

Risk management practices are not formalised; applied ad hoc, reactively. Limited organisational awareness of cybersecurity risk.

Typical Indicators
No formal risk management process
Ad hoc incident response
No supplier security requirements
Security spend is reactive

NIST 800-53 Rev 5

Twenty control families.
360+ individual controls.

AC
Access Control
25 controls in Rev 5
25controls
The AC family (Access Control) is one of 20 families in NIST SP 800-53 Rev 5. Controls are mapped directly to CSF subcategories, allowing organisations to implement CSF outcomes with concrete technical and procedural controls. Spakto assesses your current implementation against low, moderate, and high-impact baselines for each family.
Implementation Baseline
Low
10
Moderate
19
High
25

Framework Evolution

CSF 1.1 to 2.0.
What changed and why it matters.

CSF 2.0 (February 2024) reflects a decade of operational feedback and the realities of modern threat landscapes including supply chain attacks and ransomware.

Change Area
CSF 1.1
CSF 2.0
Type
Govern Function
Not present
New top-level function covering policy, roles, oversight and supply chain risk
new
Supply Chain Risk
Addressed within ID.SC subcategory only
Elevated to its own GV.SC category with 10 subcategories
enhanced
Framework Tiers
4 Tiers focused on implementation
Tiers clarified as risk management maturity indicators, not compliance levels
enhanced
Profiles
Current vs Target profile concept
Community Profiles introduced; template profiles for sectors published
enhanced
Subcategory Count
98 subcategories across 5 functions
106 subcategories across 6 functions with tighter outcome focus
enhanced
Informative References
Inline references in framework document
Moved to separate online reference tool with cross-framework mappings
changed
Govern Scope
N/A
Covers cybersecurity risk strategy, roles & responsibilities, policy, oversight
new
SMB Guidance
Separate Quick Start Guide
Small business quick start guides integrated into framework deliverables
enhanced

Implementation Lifecycle

Seven phases. Structured progress.
Measurable outcomes.

Phase 1 of 7
1
Scope & Prioritise
Wk 1–2

Define organisational scope, critical assets, and applicable NIST tiers. Establish risk tolerance with executive stakeholders and map regulatory drivers.

Upcoming phases

Cross-Framework Mapping

One programme. Four frameworks
satisfied simultaneously.

NIST CSF maps directly to ISO 27001, SOC 2, PCI DSS, and HIPAA. Implementing against NIST subcategories simultaneously builds evidence for all four frameworks.

NIST CSF 2.0
ISO 27001:2022
SOC 2
PCI DSS 4.0
HIPAA
GV — Govern
Clauses 4–6, 9.3
CC1, CC2
Req 12
164.308(a)(1)
ID.AM — Asset Mgmt
A.8.1
CC6.1
Req 12.3
164.310
ID.RA — Risk Assessment
Clause 6.1
CC3
Req 12.3.2
164.308(a)(1)(ii)(A)
PR.AA — Access Control
A.9
CC6.1–6.3
Req 7, 8
164.312(a)
PR.DS — Data Security
A.8.2, A.10
CC6.7
Req 3, 4
164.312(a)(2)(iv)
DE.CM — Monitoring
A.12.4
CC7.1–7.2
Req 10, 11
164.308(a)(1)(ii)(D)
RS.MA — Incident Mgmt
A.16
CC7.3–7.5
Req 12.10
164.308(a)(6)
RC.RP — Recovery
A.17
A1.2
Req 12.10.1
164.308(a)(7)
Maximise compliance ROI with a single programme
Spakto's cross-framework gap assessments ensure each control mapped to a NIST subcategory is simultaneously credited against all applicable frameworks, reducing audit preparation time by up to 60%.

Profile Gap Visualisation

Current vs target profile.
Quantify every gap.

A representative industry benchmark showing typical Current and Target profiles across all six CSF functions. Your actual assessment reflects your specific risk posture.

GVGovern
58% → 90%
IDIdentify
72% → 90%
PRProtect
65% → 85%
DEDetect
48% → 80%
RSRespond
55% → 85%
RCRecover
42% → 80%
Current profile
Target profile
Profile Summary
GV
Govern
Priority: High
+32pp
ID
Identify
Priority: Low
+18pp
PR
Protect
Priority: Medium
+20pp
DE
Detect
Priority: High
+32pp
RS
Respond
Priority: High
+30pp
RC
Recover
Priority: High
+38pp

Why Spakto

Engineering-led. Evidence-based.
Not consultant theatre.

Evidence-led assessments: logs, configs, tickets reviewed per subcategory
Technical validation against all 106 CSF subcategories in-scope systems
Prioritised roadmap with TCO estimates and RACI per gap
Single assessment maps to ISO 27001, SOC 2, PCI DSS, and HIPAA simultaneously
Continuous monitoring cadence with quarterly profile updates and live dashboard
Ready to close your NIST CSF gaps?
Get a structured gap assessment with a prioritised 90/180/365-day roadmap delivered in 10 weeks.
Start Assessment

Frequently Asked

Frequently asked
questions.

Still have questions?
Our security engineers answer within one business day.
Ask a question