The most widely adopted cybersecurity framework globally. NIST CSF 2.0 provides a flexible, risk-based approach to managing cybersecurity risk across any organisation or sector.
What is NIST CSF?
The NIST Cybersecurity Framework (CSF), developed by the US National Institute of Standards and Technology, provides a voluntary framework for organisations to manage and reduce cybersecurity risk. Version 2.0, released in 2024, expanded the framework to include a new Govern function and broadened its applicability beyond critical infrastructure.
Unlike prescriptive standards, NIST CSF is outcome-based, organisations define their own target profile and implement controls appropriate to their risk environment. This flexibility makes it suitable for organisations of all sizes and sectors.
NIST CSF is widely used as a baseline for cybersecurity programmes, and alignment is often required by US federal contractors, supply chain partners, and regulated industries globally.
Compliance requirements
NIST CSF 2.0 organises cybersecurity activities into six core functions, each containing categories and subcategories of specific outcomes.
Establish and monitor the organisation's cybersecurity risk management strategy, expectations, and policy (new in CSF 2.0).
Develop an organisational understanding of cybersecurity risk to systems, people, assets, data, and capabilities, including asset management and risk assessment.
Implement appropriate safeguards to ensure delivery of critical services, access control, awareness training, data security, and protective technology.
Implement activities to identify the occurrence of a cybersecurity event, continuous monitoring, anomaly detection, and security event logging.
Implement activities to take action regarding a detected cybersecurity incident, response planning, communications, analysis, and mitigation.
Implement activities to maintain resilience and restore capabilities impaired by a cybersecurity incident, recovery planning and improvements.
Audit process
Netru guides your organisation through the NIST CSF implementation journey, from initial maturity assessment to achieving your target cybersecurity profile.
We assess your current cybersecurity posture against the NIST CSF 2.0 core functions, producing a maturity profile and gap analysis.
We work with your leadership to define your target cybersecurity profile based on business objectives, risk appetite, and regulatory requirements.
We produce a prioritised roadmap to close the gap between your current and target profiles, aligned to your budget and timeline.
Your compliance manager guides implementation of required controls across all six CSF functions, with evidence collection throughout.
We conduct a validation assessment to confirm your target profile has been achieved and document your CSF implementation.
We establish continuous monitoring processes and provide ongoing support for annual CSF reviews and profile maintenance.
How Netru delivers it
Our team translates the NIST CSF into practical, implementable controls for your organisation. We conduct your maturity assessment, define your target profile, and drive implementation across all six functions.
Talk to our teamBefore you talk to anyone