The NIST Cybersecurity Framework 2.0 organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Each function is divided into categories, 22 in all, which are further divided into subcategories that describe specific outcomes. This list covers the six functions and their 22 categories.
Free account needed to download. You come straight back to the file.
Who it is for. Organisations of any size or sector that want a common language for managing and reporting cybersecurity risk. It is voluntary, and widely used as a baseline or a maturity yardstick.
What this list covers. NIST CSF 2.0 (February 2024), function and category level: 22 categories. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it asks for |
|---|---|---|
| GV.OC | Organizational context | Understand the mission, stakeholders and legal duties that shape how cybersecurity risk is managed. |
| GV.RM | Risk management strategy | Set the priorities, risk appetite and tolerances that guide cybersecurity decisions. |
| GV.RR | Roles, responsibilities and authorities | Assign and communicate who is accountable for cybersecurity, with the authority and resources to act. |
| GV.PO | Policy | Establish, communicate and enforce cybersecurity policy, and update it as risk changes. |
| GV.OV | Oversight | Review results of the cybersecurity programme and use them to adjust strategy. |
| GV.SC | Cybersecurity supply chain risk management | Identify, assess and manage the cybersecurity risks that suppliers and partners create. |
| Ref | Control | What it asks for |
|---|---|---|
| ID.AM | Asset management | Keep an inventory of hardware, software, services, data and suppliers, and know how they matter to the business. |
| ID.RA | Risk assessment | Understand the threats, vulnerabilities and likelihood and impact of attack, and prioritise the response. |
| ID.IM | Improvement | Find improvements from assessments, tests, exercises and real incidents, and act on them. |
| Ref | Control | What it asks for |
|---|---|---|
| PR.AA | Identity management, authentication and access control | Limit physical and logical access to authorised people, services and hardware, in line with risk. |
| PR.AT | Awareness and training | Give personnel the awareness and skills to do their cybersecurity tasks. |
| PR.DS | Data security | Protect data at rest, in transit and in use to preserve confidentiality, integrity and availability. |
| PR.PS | Platform security | Manage the hardware, software and services of physical and virtual platforms securely through their life. |
| PR.IR | Technology infrastructure resilience | Manage security architectures so that resilience is built in and assets stay available. |
| Ref | Control | What it asks for |
|---|---|---|
| DE.CM | Continuous monitoring | Monitor assets for anomalies, indicators of compromise and other potentially adverse events. |
| DE.AE | Adverse event analysis | Analyse anomalies and indicators to characterise events and detect possible incidents. |
| Ref | Control | What it asks for |
|---|---|---|
| RS.MA | Incident management | Manage responses to detected incidents, from triage and prioritisation through to closure. |
| RS.AN | Incident analysis | Investigate incidents to understand what happened, how, and what the impact is. |
| RS.CO | Incident response reporting and communication | Coordinate response with internal and external stakeholders as laws and policy require. |
| RS.MI | Incident mitigation | Contain incidents and reduce their effects. |
| Ref | Control | What it asks for |
|---|---|---|
| RC.RP | Incident recovery plan execution | Carry out restoration activities so operational availability returns. |
| RC.CO | Incident recovery communication | Coordinate restoration with internal and external parties and share recovery progress. |
Version 2.0 added a sixth function, Govern, and widened the scope from critical infrastructure to all organisations. Supply chain risk management is now part of Govern.
No. It is a voluntary framework. Organisations use it to describe their current and target profile and to plan improvements, not to obtain a certificate.
They overlap heavily. ISO 27001 is a certifiable management system standard; the CSF is an outcome-based framework. Many organisations map one to the other.
This list stops at categories. NIST publishes the full set of subcategories and implementation examples free of charge on its website.