NIST Cybersecurity Framework 2.0: outcomes, profiles and tiers
Understand the NIST Cybersecurity Framework 2.0 and how its functions, profiles and tiers support risk decisions.
## What is the NIST Cybersecurity Framework?
The **NIST Cybersecurity Framework (CSF) 2.0** is voluntary guidance from the US National Institute of Standards and Technology for understanding, prioritizing and communicating cybersecurity risk. Its Core describes desired outcomes, not a mandatory set of specific tools or a guarantee against incidents. Organizations can adapt the guidance to their mission, resources and legal obligations. See [NIST CSWP 29](https://doi.org/10.6028/NIST.CSWP.29).
## Six functions, used together
The Core groups outcomes into six functions: **Govern** establishes and monitors the risk strategy; **Identify** helps understand assets and risk; **Protect** supports safeguards; **Detect** concerns finding possible adverse events; **Respond** addresses incidents; and **Recover** supports restoring affected capabilities. The functions work together rather than forming a one-time sequence. Within each function, categories and subcategories express more specific outcomes. The [NIST CSF 2.0 document](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf) explains the full structure.
## Profiles and Tiers are different
An organizational Profile describes selected Core outcomes as a current state, a target state or both. Comparing those states can help a team prioritize gaps and agree on actions. A Tier describes the rigor of an organization's risk governance and management practices, providing context for those profiles. It is not an automatic assessment of a product or a substitute for documented evidence. The framework does not prescribe a single target tier for every organization.
## A bounded example
A small team might identify its critical services and owners, record current incident response and backup practices, and agree on target outcomes with leadership. It can then assign actions and review evidence over time, selecting controls that fit its risks and obligations. A profile is a planning and communication aid; it does not prove that controls work or that an organization is secure. See the [NIST CSF resource center](https://www.nist.gov/cyberframework) and our related [risk assessment and security controls guide](/risk-assessment-threat-modeling-security-controls?lang=en).