NIST CSF 2.0
A NIST CSF assessment that compares where you are to where you decided to be.
CSF is an outcome and governance framework, not a technical checklist. Cyber Guys uses it the way it is designed to be used: you set a target profile, assess your current profile, and the gap between them becomes the work.
- All six functions across 68 curated subcategories
- Current profile against a target profile you choose
- Mapped onto the same controls as the Essential Eight, ISO 27001 and CIS
- Governance and supplier risk treated as first-class, as CSF 2.0 intends
There is no NIST CSF certification and no official CSF score. Anyone offering to certify you against CSF is describing their own scheme, not NIST’s.
Northside Legal · by function
- Govern (GV)Below target
- Identify (ID)Below target
- Protect (PR)At target
- Detect (DE)Below target
- Respond (RS)At target
- Recover (RC)At target
No single headline percentage. Reducing a profile comparison to one number is the standard way CSF gets misrepresented.
The six functions
What CSF 2.0 actually asks about.
Six functions describing the outcomes a security programme should achieve. The platform covers a curated set of subcategories chosen for relevance to small and medium business, rather than every subcategory in the full framework.
Govern
Who decides, what the risk appetite is, what your legal and contractual obligations are, and how supplier risk is managed. New in CSF 2.0, and usually the weakest area in a small organisation.
Identify
What you have, what matters most, and what would hurt if it stopped. You cannot protect an asset nobody has written down.
Protect
Identity, access, data security, awareness training and platform hardening — the controls most people picture when they think about security.
Detect
Noticing that something is wrong. Detection speed determines cost, and this only works if a human is actually reviewing the alerts.
Respond
What happens in the first hour: who is called, what is contained, what is communicated and to whom, including notification obligations.
Recover
Getting back to work, and knowing in advance that you can — which is a statement about tested backups rather than about backup software.
Why profiles, not scores
A target profile is a business decision, not a default.
The right CSF position for a two-person bookkeeping practice is not the right position for a firm holding twenty thousand client records. CSF is built to reflect that, and a single readiness percentage would erase it.
- You choose a target profile per function, based on what you hold and who you serve.
- The current profile is assessed against that target, not against a universal ideal.
- Gaps are the distance between the two, which makes prioritisation obvious.
- Movement is shown between assessment versions rather than as a single number.
How it fits the rest
CSF alongside the Essential Eight.
These two are complementary rather than competing, and most Australian organisations end up using both.
- The Essential Eight is specific and technical — eight strategies, measured by maturity.
- CSF is broad and outcome-based — governance, supplier risk, detection and recovery.
- The Essential Eight says nothing about governance; CSF says little about patch windows.
- Both map onto the same control library here, so the overlap is answered once.
- CSF is usually what a larger customer or a board asks about; the Essential Eight is usually what an insurer or tender asks about.
See a current profile against a target profile.
Fifteen minutes, using CSF 2.0 as the lens, with the gaps rolling straight into an action plan.