NIST CSF Explained: The Six Functions and How to Adopt It

The NIST Cybersecurity Framework (CSF) is a voluntary, outcome-based framework for managing cyber risk. It doesn't prescribe specific controls — it describes the outcomes a good program achieves, in a common language your whole organisation can use. That flexibility is why it's often adopted as the organising layer over other frameworks rather than instead of them.

The six functions of CSF 2.0

The 2.0 revision added Govern as a sixth function, elevating strategy and oversight to sit alongside the operational work.

Profiles and tiers

Two concepts make the CSF actionable. A profile is your set of outcomes; you create a current profile (where you are) and a target profile (where you need to be), and the gap becomes your roadmap. Tiers describe how rigorous and risk-informed your practices are — from Partial to Adaptive — and are a risk-based choice, not a score to maximise.

How to adopt the CSF

1. 1Assess your current profile across the six functions.
2. 2Define a target profile based on your risk and obligations.
3. 3Prioritise the gap between current and target as a roadmap.
4. 4Map each outcome to the evidence that demonstrates it.
5. 5Reassess on a cadence — profiles are living, not one-off.

CSF vs ISO 27001

They complement rather than compete. The CSF gives outcome-based structure and a shared vocabulary; ISO 27001 certifies a management system. Many organisations run ISO 27001 for certification and use the CSF to communicate posture to leadership — reusing the same evidence across both.