The NIST Cybersecurity Framework is one of the most widely referenced security frameworks in the world, but it's also one of the most misunderstood — it's not a certification, not a checklist, and not something you get "audited against" the way you would for ISO 27001 or SOC 2. It's a common language and structure for describing and managing cybersecurity risk, developed by the US National Institute of Standards and Technology.
It's voluntary, and not certifiable
Unlike ISO 27001, there's no accredited body that certifies an organisation "NIST CSF compliant" — there's no certificate to hang on the wall. Organisations adopt the CSF voluntarily (though it's frequently referenced or effectively required by regulators, contracts, and cyber insurers) to structure their own security program and communicate about risk in a consistent way, both internally and with partners.
The six functions (CSF 2.0 added Govern)
The CSF organises cybersecurity activities into a small number of high-level Functions. For years the framework centred on five: Identify, Protect, Detect, Respond, and Recover. CSF 2.0 added a sixth function, Govern, reflecting a broader recognition that cybersecurity risk management needs to be driven by organisational strategy and oversight, not treated purely as a technical operations problem.
- Govern — establish and monitor the organisation's cybersecurity risk management strategy, expectations, and policy.
- Identify — understand the organisation's assets, environment, and cybersecurity risks.
- Protect — implement safeguards to limit or contain the impact of a potential cybersecurity event.
- Detect — identify the occurrence of a cybersecurity event in a timely manner.
- Respond — take action regarding a detected cybersecurity incident.
- Recover — restore capabilities or services impaired by a cybersecurity incident.
Categories and subcategories give the functions teeth
Each function breaks down into Categories (e.g. under Protect: Identity Management and Access Control, Data Security, Platform Security) and further into Subcategories — specific, actionable outcomes like "identities and credentials are issued, managed, verified, revoked, and audited." This is where the CSF stops being a set of five or six abstract headings and becomes something you can actually map real controls against.
Implementation Tiers describe maturity, not compliance
The CSF also defines four Implementation Tiers describing how an organisation's cybersecurity risk management practices actually operate, from Tier 1 (Partial — reactive, ad hoc) through to Tier 4 (Adaptive — the organisation actively adapts its practices based on lessons learned and predictive indicators). Tiers describe organisational maturity and rigor, not a pass/fail compliance state — an organisation isn't required to reach Tier 4 to be "using" the CSF correctly.
Profiles: comparing where you are to where you want to be
A CSF "Profile" is simply the specific set of outcomes an organisation has selected from the Categories and Subcategories, based on its actual risks, business objectives, and resources. Organisations typically build a Current Profile (where things stand today) and a Target Profile (the desired future state), then use the gap between them to prioritise investment — this comparison is one of the most practically useful parts of the whole framework.
How it relates to ISO 27001 and SOC 2
These frameworks aren't competitors so much as different tools serving different purposes. ISO 27001 gives you a certifiable management system with a formal audit; SOC 2 gives you an attestation report enterprise buyers ask for directly. The NIST CSF gives you a structure for actually organising and communicating about risk — many organisations use it internally to drive their security roadmap while also maintaining ISO 27001 certification or a SOC 2 report for external assurance, since the underlying controls overlap substantially.
This guide is general information — for guidance on which framework(s) best fit your organisation's specific regulatory, contractual, or customer requirements, consult a qualified professional.
Turning functions and categories into tracked controls
The CSF's real value shows up when its categories are actually mapped to specific, owned, evidenced controls — not left as a strategy document nobody revisits. ComplianceDesk's NIST CSF framework gives you the functions and categories pre-built as trackable controls, with an evidence vault and reminders, so your Current Profile reflects what's actually happening rather than what was true during last year's planning session.