NIST CSF Compliance: The Six Functions and How to Comply

The NIST Cybersecurity Framework (CSF) is a voluntary, outcome-based framework for managing cyber risk, and it has quietly become the common yardstick organisations use to show they run a mature security program. It does not prescribe a fixed list of controls; it describes the outcomes a good program achieves, in a shared language your whole organisation and your customers can understand. This guide explains what NIST CSF compliance actually means in practice: whether it is mandatory, the six functions of CSF 2.0, how profiles and tiers work, how to demonstrate compliance with evidence, and how it maps onto the ISO 27001 and SOC 2 work you may already do. For the framework overview, see the NIST CSF framework page.

Is NIST CSF compliance mandatory?

Not by itself. There is no law that says 'comply with the NIST CSF', and there is no certificate to earn. But compliance is increasingly expected in practice: US federal agencies and many critical-infrastructure sectors are directed to use it, enterprise customers ask vendors to align to it, and cyber-insurance and contracts frequently reference it. So while it is voluntary, 'we are aligned to NIST CSF' has become a credential buyers trust, which is why so many organisations pursue CSF compliance even without a mandate.

The six functions of CSF 2.0

The 2.0 revision (2024) added Govern as a sixth function, elevating strategy, roles and oversight to sit alongside the operational work. The six functions are the backbone of any CSF compliance effort.

• Govern: establish and monitor the cyber risk strategy, roles, policy and oversight (the function added in 2.0).
• Identify: understand your assets, data, suppliers and the risks to them.
• Protect: put safeguards in place, access control, training, data security, secure configuration.
• Detect: find anomalies and security events, through monitoring and analysis.
• Respond: contain, analyse and communicate when an incident occurs.
• Recover: restore capabilities and services affected by an incident.

Profiles and tiers

Two concepts make the CSF actionable, and both matter for compliance. A profile is your set of outcomes: you create a current profile (where you are) and a target profile (where you need to be), and the gap between them becomes your compliance roadmap. Tiers (from Partial to Adaptive) describe how rigorous and risk-informed your practices are. Tiers are a risk-based choice, not a score to maximise, aim for the tier your risk justifies, not the highest one.

What NIST CSF compliance actually looks like

Because there is no certificate, CSF compliance is demonstrated, not awarded. In practice it means you can show, function by function, that you have defined the outcomes you need and have evidence they are met.

1. 1Assess your current profile across all six functions, honestly.
2. 2Define a target profile based on your risk, customers and obligations.
3. 3Prioritise the gap between current and target as a remediation roadmap.
4. 4Map each outcome to the evidence that demonstrates it (policies, configurations, logs, test results).
5. 5Reassess on a cadence, profiles are living, not a one-off exercise.

That overlap is the practical shortcut to CSF compliance: if you already run ISO 27001 or SOC 2, most of the evidence CSF outcomes need already exists, it just has to be mapped to the six functions rather than recreated.

NIST CSF vs ISO 27001 and SOC 2

They complement rather than compete. The CSF gives outcome-based structure and a shared vocabulary but no certificate; ISO 27001 certifies a management system; SOC 2 produces an attestation report for customers. Many organisations run ISO 27001 or SOC 2 for the external credential and use the CSF to organise the whole program and communicate posture to leadership, reusing the same evidence across all of them. See our ISO 27001 vs SOC 2 and SOC 2 compliance checklist guides for those.

Common NIST CSF compliance pitfalls

• Chasing the highest tier instead of the tier your risk justifies.
• Treating the profile as a one-time assessment rather than a living roadmap.
• Documenting outcomes with no evidence to back them at review time.
• Ignoring the new Govern function and treating CSF as purely operational.
• Rebuilding evidence from scratch instead of reusing ISO 27001 / SOC 2 work.

Putting it together

NIST CSF compliance is less about a badge and more about being able to demonstrate, across govern, identify, protect, detect, respond and recover, that you have the right outcomes and the evidence to prove them. Set a target profile that matches your risk, close the gaps, keep each outcome tied to live evidence, and reuse what you already have from ISO 27001 or SOC 2. Done that way, CSF becomes the organising layer that makes every other framework easier to run.