Best for: Industry, government, and organizations seeking to reduce cybersecurity risks. NIST describes the Cybersecurity Framework as helping organizations better understand and improve their management of cybersecurity risk. US government agencies must use the NIST CSF or any successor document when conducting risk assessments for agency systems.
Mandatory?
Voluntary — widely adopted across sectors
Who validates?
Self-assessment; optional third-party
Renewal
No fixed cycle; continuous improvement
Scope
All organizations; six functions: Govern, Identify, Protect, Detect, Respond, Recover
Governing body
NIST (National Institute of Standards and Technology), NIST CSF v2.0 (Feb 2024). Official source
Controls by category
71 controls are Mapped to NIST Cybersecurity Framework v2.0.
DE.AE-02: Potentially adverse events are analyzed to better understand associated activities.
GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed.
GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
GV.SC-02: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally.
GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.
PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.
What is the purpose of the NIST Cybersecurity Framework?
The Cybersecurity Framework helps organizations better understand and improve their management of cybersecurity risk. It is a voluntary framework of standards, guidelines, and best practices to manage cybersecurity risks.
Is use of the NIST CSF mandatory for US government agencies?
An Executive Order signed in May 2017 requires US government agencies to use the NIST CSF or any successor document when conducting risk assessments for agency systems. Each agency head must produce a risk management report documenting risk mitigation and the agency's action plan to implement the CSF.
How is the NIST CSF related to NIST SP 800-53 and FedRAMP?
The NIST CSF references globally recognized standards including `NIST SP 800-53`. Each CSF control is mapped to corresponding NIST 800-53 controls within the FedRAMP Moderate baseline.
Does Microsoft provide a responsibility matrix for the NIST CSF?
Microsoft has developed a NIST CSF Customer Responsibility Matrix (CRM). The CRM lists control requirements that depend on customer implementation, shared responsibility controls, and implementation details for controls owned by Microsoft. It is downloadable from the Service Trust Portal Blueprints section.
