Six functions. Twenty-two categories. Over a hundred subcategories. The de-facto meta-framework for cybersecurity — and the one most other frameworks already crosswalk to. The Agency keeps your CSF profile live across the whole portfolio, vendors included.
The NIST Cybersecurity Framework — CSF — is a voluntary framework published by the US National Institute of Standards and Technology for organising and communicating cybersecurity risk management. It is not a control catalogue and not a certification. It is a common structure and vocabulary, which is precisely why so many other frameworks crosswalk to it.
CSF 2.0, released in February 2024, is the first major revision since 2014 and made two consequential changes. It added a sixth function, Govern, alongside the original five — Identify, Protect, Detect, Respond and Recover — elevating governance, roles, policy and supply chain risk management from a category to a top-level concern. And it dropped the "critical infrastructure" framing: version 1.1 was aimed at that sector, while 2.0 is explicitly written for organisations of any size or type.
The framework is used through Profiles: a Current Profile describing what you do today, a Target Profile describing where you intend to be, and the gap between them as the plan. Tiers 1 to 4 — Partial, Risk Informed, Repeatable, Adaptive — describe how rigorously the practices are governed, and are deliberately not maturity levels to be climbed for their own sake.
Voluntary on paper, it is load-bearing in practice: US federal agencies work to it, suppliers are asked about it, and ISO 27001, SOC 2, FFIEC and CMMC all map to it — which makes it the usual translation layer when one control set has to answer to another.
NIST CSF is voluntary on paper but load-bearing in practice — federal agencies require it, US suppliers expect it, and most other frameworks (ISO 27001, SOC 2, FFIEC, CMMC) explicitly map to it. Maintaining a current profile by hand is the problem.
Three of The Agency's leads keep CSF evidence current, the profile mapped against your target tier, and the audit-ready output composed from live data — not last quarter's snapshot.
Every subcategory, mapped to evidence. ARIA reads SOC 2 reports, ISO certs, policies and trust pages, and maps each artefact against the CSF subcategories and the 157 Universal Controls — your profile reflects what you actually have.
Your tier, watched continuously. TARA assesses every vendor's CSF profile against your target tier, flags drift, and opens SLA-bound remediation when controls fall short — so the maturity level you committed to actually holds.
Profile reports composed from live data. VANCE generates current-state and target-state CSF profiles on demand — formatted for boards, auditors and federal agencies expecting CSF outputs (NIST 800-171, FedRAMP, CMMC).
NIST CSF stops being a once-a-year mapping exercise and becomes a continuous evidence layer that reflects current vendor posture across all six functions.
Subcategories map to evidence automatically. When a vendor changes posture or attestation, the profile updates the same week.
Once mapped to CSF, the same evidence answers ISO 27001, SOC 2, CMMC and 800-171 questions. The mapping has already been done.
TARA flags vendors whose CSF tier drops below your target — you stop discovering it during the next review and start acting on it inside SLA.
When the agency or prime contractor asks for a CSF profile, VANCE composes it from current data — not from a report writer waiting for someone to update the spreadsheet.
We crosswalked our entire vendor portfolio to NIST CSF in two weeks. The CMMC and 800-171 work that used to take a quarter now ships from the same evidence pack.
What changed in 2.0, how it differs from the other NIST publications, and what it means for third-party risk.
Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.