NIST CSF Implementation
The NIST Cybersecurity Framework is voluntary guidance published by an agency of the United States Department of Commerce. NIST does not certify anyone against it, so implementation and independent assessment are what actually produce evidence.
The Six Functions
CSF 2.0What the CSF Is and Who Publishes It
The Cybersecurity Framework is published by the National Institute of Standards and Technology, a non-regulatory agency of the United States Department of Commerce. Version 1.0 appeared in February 2014 in response to an executive order on improving critical infrastructure cybersecurity, and version 1.1 followed in April 2018.
The current release is CSF 2.0, published on 26 February 2024 as NIST Cybersecurity White Paper 29. The framework is no longer aimed only at critical infrastructure; NIST states that it is intended for organisations of all sizes and sectors. A sixth Function, Govern, was added, moving cybersecurity risk from a technical concern to an enterprise risk management one.
The framework is applied through Organisational Profiles. A Current Profile records the outcomes an organisation is achieving today, a Target Profile records the outcomes it needs, and the gap between them is the action plan. Tiers, from Partial through Risk Informed and Repeatable to Adaptive, describe how rigorous cybersecurity risk governance and management practices are.
At a glance
There is no NIST CSF certification
NIST runs no certification programme, accredits no certification bodies and issues no certificates. Organisations use an independent CSF assessment report, ISO/IEC 27001 certification, a SOC 2 report or contract-specific attestations as evidence instead.
The Six Functions
Govern
Cybersecurity risk management strategy, expectations and policy are established, communicated and monitored, including roles, oversight and supply chain risk.
Identify
Current cybersecurity risks to assets, suppliers and the wider organisation are understood.
Protect
Safeguards manage those risks, covering identity and access, awareness and training, data security, platform security and technology resilience.
Detect
Possible cybersecurity attacks and compromises are found and analysed.
Respond and Recover
Action is taken on detected incidents, and affected assets and operations are restored, with recovery communicated.
What NIST CSF implementation delivers
Produces evidence of CSF adoption through implementation and independent assessment.
Turns the gap between the Current Profile and the Target Profile into a prioritised action plan.
Moves cybersecurity risk into enterprise risk management through the Govern Function.
Makes progress demonstrable through outcome-based metrics and periodic reassessment.
Gives leadership a shared language for discussing cybersecurity risk.
Supports security conversations with customers, regulators and partners.
How Univate Implements the CSF
Scope and drivers
Establish what is prompting the work, which systems and business lines are in scope, and which Tier is realistic.
Current Profile
Assess achievement of each relevant Subcategory outcome against evidence, not opinion, and record what was examined.
Target Profile
Agree the outcomes your risk appetite, customers and regulators require, including supply chain expectations under Govern.
Roadmap and remediation
Sequence gap closure by risk reduction and dependency, with owners and dates, and implement the changes.
Measurement and reassessment
Outcome-based metrics, incident exercises and periodic reassessment of the Current Profile make progress demonstrable.
NIST CSF across nine markets
Univate supports certification, assessment and compliance programmes for organisations operating across international markets, including NIST CSF implementation and assessment.
UAE
Relevant to organisations in UAE that want to structure cybersecurity risk around NIST CSF outcomes or serve customers who ask for it.
Saudi Arabia
Relevant to organisations in Saudi Arabia that want to structure cybersecurity risk around NIST CSF outcomes or serve customers who ask for it.
Philippines
Relevant to organisations in Philippines that want to structure cybersecurity risk around NIST CSF outcomes or serve customers who ask for it.
South Africa
Relevant to organisations in South Africa that want to structure cybersecurity risk around NIST CSF outcomes or serve customers who ask for it.
USA
Relevant to organisations in USA that want to structure cybersecurity risk around NIST CSF outcomes or serve customers who ask for it.
Singapore
Relevant to organisations in Singapore that want to structure cybersecurity risk around NIST CSF outcomes or serve customers who ask for it.
Malaysia
Relevant to organisations in Malaysia that want to structure cybersecurity risk around NIST CSF outcomes or serve customers who ask for it.
Vietnam
Relevant to organisations in Vietnam that want to structure cybersecurity risk around NIST CSF outcomes or serve customers who ask for it.
India
Relevant to organisations in India that want to structure cybersecurity risk around NIST CSF outcomes or serve customers who ask for it.
Why Univate Global for NIST CSF
Tell us which contract, regulator or board requirement is pointing you at the CSF. We will build a Current Profile, agree a Target Profile with you and set out the work between the two.
Univate supports certification, assessment and compliance programmes for organisations operating across international markets, and will talk through scope, effort and the route that applies to your organisation.
EVIDENCE-BASED PROFILES
Current Profile achievement is assessed outcome by outcome against evidence, with what was examined recorded.
TAILORED SCOPE
Each engagement is scoped to the systems, business lines and Target Profile that matter to the organisation.
Often taken alongside NIST CSF
NIST CSF Questions We Are Asked Most Often
Can't find the framework
you're looking for?
Univate supports over a hundred certification, privacy and cybersecurity
services across
nine markets. Tell a specialist what your client or regulator is asking for.