NIST CSF 2.0, the grid for reading your security
Govern, identify, protect, detect, respond, recover. The world's most widely used framework as a common language, and the recommended starting point for anyone without a specific obligation.
A framework, not an obligation
The NIST Cybersecurity Framework is published by the US National Institute of Standards and Technology. Version 2.0, released in 2024, explicitly broadened its scope to organisations of every size and sector, not just critical infrastructure.
It is not a certifiable standard and it does not impose anything: it is a reference framework for organising security, describing its current state and defining the target state. That is why it is useful to anyone who has no regulatory obligation but wants to understand where to start.
In Italy many organisations know it without realising: the Framework Nazionale per la Cybersecurity, Italy's National Cybersecurity Framework, is built on its function-based approach.
The six functions of NIST CSF 2.0
Version 2.0 adds Govern to the five original functions, and puts governance at the centre of all the others.
Govern
Strategy, roles, policies, risk and supplier management: who decides and by which rules.
Identify
Assets, data, risks and opportunities for improvement.
Protect
Identity and access, training, data and platform security, infrastructure resilience.
Detect
Continuous monitoring and analysis of adverse events.
Respond
Incident management, analysis, communication and containment.
Recover
Restoring operations and communicating during recovery.
Not just an assessment: the grid for all the others
Beyond the CSF self-assessment, the framework's functions are the grid used to break down every gap analysis score, whichever standard you are following.
| NIST CSF function | How Dottor Box covers it |
|---|---|
| Govern | Compliance and GRC for policies and roles, Supply Chain for suppliers |
| Identify | Asset Management, Attack Surface and Risk Assessment |
| Protect | Microsoft Entra ID and Google Workspace postures, Training, Cyber Awareness |
| Detect | Vulnerability Assessment, Cyber Agent, Dark Web Monitoring |
| Respond | Incident Response and Data Breach: CSIRT and incident phases |
| Recover | Business continuity: BIA, continuity plan, backup checks |
Find the imbalances before an attacker does
A common language
The same vocabulary for the technician, management and the external consultant.
Imbalances in plain sight
Many companies protect well and detect nothing: the score by function shows it.
A lens on every standard
NIS2, ISO 27001 or GDPR: the scores are always read on the same functions.
A starting point
Useful even without obligations, and the work done counts towards the standards still to come.
The NIST framework is not something you get certified against: it is there to bring order. It separates things that are often confused: defending yourself, noticing you are under attack, reacting, getting back to work.
NIST CSF 2.0: frequently asked questions
What is the difference between NIST CSF 1.1 and 2.0?
Version 2.0 adds the Govern function, which brings security governance (strategy, roles, policies, suppliers) to the same level as the others, and explicitly broadens the scope to organisations of every size and sector.
Can you be certified against NIST CSF?
No. It is a voluntary framework for organising security and communicating its status. For certification the reference is ISO/IEC 27001, with which the CSF integrates well.
Does it make sense for a European company?
Yes: Italy's National Cybersecurity Framework is based on the same function-based approach, and many NIS2 and DORA requirements can easily be read on this grid.
Where is it best to start?
With the self-assessment: the score by function shows where you are weakest. If you are looking for a list of concrete technical controls in order of priority, use it alongside the CIS Controls IG1.
The modules that work for NIST CSF
Asset Management
A single IT inventory of devices and software, with a graph map of the network.
Learn more SeeVulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more GovernBusiness continuity
Business Impact Analysis, continuity plan and backup checks, guided by questionnaires.
Learn more GovernCompliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more ComplianceCIS Controls · IG1
Basic cyber hygiene: the starting point for every SME.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.