Information security
NIST CSF
NIST Cybersecurity Framework
The NIST Cybersecurity Framework is a voluntary, risk-based framework for organising and improving your security programme. We use it to measure where you are and build a clear path to where you need to be.
What NIST CSF is
The NIST Cybersecurity Framework is a voluntary framework developed by the US National Institute of Standards and Technology to help organisations understand, manage and reduce cybersecurity risk. It is structured around a set of core functions: in version 2.0 these are Govern, Identify, Protect, Detect, Respond and Recover.
Unlike a certifiable standard, NIST CSF is not something you are awarded or audited against by an accredited body. It is used to assess current and target maturity, communicate risk to leadership, and align improvements with business priorities. It maps cleanly to standards such as ISO 27001 and SOC 2, which is why it is often used as the organising backbone of a wider compliance programme.
The six core functions of CSF 2.0
Govern
Sets the organisation's cybersecurity risk strategy, roles, policies and oversight so that the other functions are directed and accountable to leadership.
Identify
Builds an understanding of the assets, suppliers, data and risks that the programme needs to manage.
Protect
Puts safeguards in place to limit or contain the impact of a potential cybersecurity event, from access control to data security and training.
Detect
Finds and analyses possible attacks and compromises so that anomalies and events do not go unnoticed.
Respond
Takes action once an incident is detected, covering response planning, communication, analysis and mitigation.
Recover
Restores assets and operations affected by an incident and feeds lessons learned back into the programme.
Who needs it
- Organisations that want a structured view of their security maturity and priorities
- Teams that need a common language to communicate cyber risk to leadership and the board
- Companies preparing for ISO 27001 or SOC 2 that want a framework to organise the work
What you get
- A current-state maturity assessment against the CSF functions
- An agreed target profile and prioritised improvement roadmap
- Governance, policy and control improvements mapped to the framework
- Penetration test evidence and a maturity reporting view for leadership
Timelines depend on your scope, maturity and the target profile you choose. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The current edition is NIST CSF 2.0, published in February 2024, which replaced version 1.1 from 2018. The headline change was the addition of the Govern function, which lifts risk governance to sit alongside the five original functions, along with a broader scope that applies to organisations of any size or sector rather than mainly critical infrastructure. NIST also expanded its supporting resources, such as implementation examples and quick-start guides, to help teams apply the framework. If your programme was last mapped to version 1.1, moving to 2.0 is mostly a case of reframing existing work under the six functions and giving governance its own clear home rather than starting again.
What it costs
NIST CSF is a voluntary framework, not a certifiable standard, so there is no certificate or attestation to buy and no accredited body to pay. The costs are our scoped advisory or implementation fee, which we quote up front once we understand your size, sector and starting point, plus any independent assessment, penetration testing or specialist input you choose to bring in, which that party charges separately on its own schedule. tr3labs is never a certifier, auditor or regulator for this framework; we assess maturity and build the roadmap with you. We scope the work with you rather than quote blind.
How tr3labs gets you there
Scope and current-state assessment
We assess your programme against the CSF functions and categories, establish your current maturity, and agree a realistic target profile tied to your risk and business goals.
Build the roadmap and controls
We turn the gaps into a prioritised roadmap and help you implement the governance, policies and technical controls needed to move from current to target state.
Test and validate
We use penetration testing and security reviews to confirm that Protect and Detect capabilities actually work, and pressure-test your Respond and Recover plans.
Measure and report
We give you a clear way to track maturity over time and report progress to leadership, and align the output with ISO 27001 or SOC 2 if certification is the next step.
NIST CSF vs ISO 27001
Both organise a security programme around risk, so they are often confused, but only one results in a certificate.
| NIST CSF | ISO 27001 | |
|---|---|---|
| Core idea | Flexible framework to assess and improve maturity | Certifiable management system with required controls |
| Covers | Six functions from governance to recovery | An ISMS with Annex A control options |
| Who asks for it | Boards and leadership wanting a risk view | Customers and partners wanting proof |
| Audit model | Self-assessed, no accredited certificate | Independent certification body audit |
| Often held with | ISO 27001 or SOC 2 as the next step | NIST CSF used to organise the work |
NIST CSF FAQ
- How much does a NIST CSF programme cost?
- NIST CSF is voluntary, so there is no certificate or accredited body to pay. You pay our scoped advisory or implementation fee, quoted up front, plus any independent assessment, penetration testing or specialist input you choose to add, which those parties price separately on their own schedule.
- How long does NIST CSF take?
- It depends on your scope, maturity and the target profile you choose. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Can you get certified against the NIST CSF?
- No. The NIST CSF is a voluntary framework, not a certifiable standard, so there is no accredited certificate or attestation. It is used to assess and improve maturity. If you need a certificate, we use the CSF to organise the work and point it at ISO 27001 or a SOC 2 report.
- What are the core functions of NIST CSF 2.0?
- Version 2.0 is built around six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in 2.0 to put cybersecurity risk management firmly within wider enterprise governance.
- How does NIST CSF relate to ISO 27001?
- They complement each other. NIST CSF is excellent for assessing maturity and communicating risk, while ISO 27001 gives you a certifiable management system. The two map closely, so the work you do on one feeds the other.
The services that get you there
Related standards
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read