Definition
The NIST Cybersecurity Framework (CSF) 2.0, released February 26, 2024, helps organizations of any size and sector understand and manage cybersecurity risk. Version 1.1 had five functions. Version 2.0 added Govern, which covers cybersecurity strategy, roles and oversight, alongside Identify, Protect, Detect, Respond and Recover. Use is voluntary. The framework is not an audit standard and does not itself give a basis for an opinion.
Why it matters in an audit or review
Clients often describe their security programs in CSF terms. An auditor reading that description can map it to risks arising from IT, and an assurance practitioner can use the CSF alongside AICPA criteria to frame the discussion with management. A SOC for Cybersecurity description uses DC 100, not the CSF.
Example
Illustrative: a client says it follows the CSF. The auditor asks which functions have been assessed, who owns the Govern function and when the last incident response test was performed, then compares the answers to what the IT general controls testing found.
Common mistakes
- Saying a client is CSF compliant. The framework has no certification.
- Treating CSF alignment as evidence that controls operated.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, https://doi.org/10.6028/NIST.CSWP.29
- NIST, Cybersecurity Framework resource center, https://www.nist.gov/cyberframework
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error