Skip to main content
14 speakers. 7 enterprise risk teams. One day in Charlotte, Oct. 22.Save My Seat
Back to Glossary

NIST CSF (Cybersecurity Framework)

The NIST Cybersecurity Framework is one of the most widely adopted voluntary frameworks for managing cybersecurity risk, published by the National Institute of Standards and Technology. It defines five core functions, Identify, Protect, Detect, Respond, and Recover, and is a standard reference point for third-party cyber risk management programs. Black Kite maps compliance findings to NIST CSF controls.

What Are the Six Functions of NIST CSF 2.0?

The NIST Cybersecurity Framework (CSF) organizes cybersecurity outcomes into six functions that together describe how an organization governs, identifies, protects against, detects, responds to, and recovers from cyber risk. NIST published the first version in 2014 for critical infrastructure. CSF 2.0, released on February 26, 2024, broadened the framework's scope to organizations in every sector. The six functions are:

  • Govern, establishing and monitoring cybersecurity strategy, policy, roles, responsibilities, and supply chain risk management.
  • Identify, understanding assets, risks, and improvement priorities.
  • Protect, applying safeguards such as access control, training, and data security.
  • Detect, finding attacks, anomalies, and signs of compromise.
  • Respond, acting on a detected incident to contain its impact.
  • Recover, restoring the operations and services an incident disrupted.

CSF Describes Outcomes and Leaves the Controls Open

CSF describes the outcomes an organization should achieve without prescribing the specific controls to reach them. NIST pairs it with Informative References that map CSF outcomes to control catalogs and standards such as SP 800-53 and ISO 27001. Two organizations can meet the same CSF outcome with different controls.

What Changed for Supply Chain Risk in CSF 2.0?

CSF 2.0 moved supply chain risk management into the new Govern function, the part of the framework that covers strategy, policy, roles, and oversight. In CSF 1.1, supply chain risk management sat inside the Identify function. It now has its own Govern category, Cybersecurity Supply Chain Risk Management (GV.SC), with ten subcategories that cover the full vendor relationship. Together, those subcategories ask organizations to:

  • Establish a program, with a supply chain risk strategy, objectives, and policies agreed on by stakeholders.
  • Know and prioritize suppliers by criticality, so oversight matches what each relationship can affect.
  • Write cybersecurity requirements into contracts, before the relationship starts.
  • Perform due diligence and keep monitoring, across the full life of the relationship.
  • Include suppliers in incident planning, and plan for what happens when a relationship ends.

Supply Chain Risk Now Sits With Cybersecurity Strategy

GV.SC-03 calls for supply chain risk management to be integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes. GV.SC is the CSF's treatment of cybersecurity supply chain risk management as a discipline. Black Kite's TPRM knowledge center collects its resources on running third-party risk programs.

How Do CSF Tiers and Profiles Work?

Profiles describe where an organization's cybersecurity outcomes are today and where they need to be, while tiers describe how rigorous its risk management practices are. A Current Profile captures the outcomes an organization achieves now. A Target Profile captures the outcomes it wants to achieve. The gap between them becomes the improvement plan.

Tiers run from 1 to 4, labeled Partial, Risk Informed, Repeatable, and Adaptive. They describe the rigor and sophistication of an organization's cybersecurity risk management practices, and they aren't compliance scores.

A Target Profile Can Set Expectations for Critical Vendors

Profiles can work for vendors too. A risk team can define the outcomes it expects from its most critical vendors as a Target Profile, then compare what each vendor can demonstrate against it. That turns a general request to follow CSF into a specific list of outcomes a vendor has to show evidence for.

How Is NIST CSF Different From SP 800-161 and SP 800-53?

CSF sets the outcomes, SP 800-53 catalogs the controls, and SP 800-161 details cybersecurity supply chain risk management practices. They're layers of the same family, and each answers a different question.

CSF is high-level and voluntary. SP 800-53 is NIST's catalog of security and privacy controls, and it's among the standards CSF's Informative References map to. NIST SP 800-161 is NIST's dedicated guidance on supply chain risk management practices, so it's where to go when GV.SC needs implementation detail.

NIST Doesn't Certify CSF the Way ISO 27001 Is Certified

Organizations get certified against ISO 27001 through certification bodies. NIST doesn't offer a certification program for CSF, and the CSF-based certifications some third parties sell aren't issued or endorsed by NIST. European regulations such as DORA go further than CSF in a different way, making organizations legally accountable for the security of the third parties they rely on.

What Resources Does NIST Provide for Applying CSF 2.0 to Suppliers?

NIST publishes companion resources for CSF 2.0, including a quick start guide dedicated to cybersecurity supply chain risk management. The C-SCRM Quick Start Guide explains how to use the CSF to establish and operate a supply chain risk management capability built around GV.SC. Implementation Examples illustrate ways to achieve each subcategory's outcome, and Informative References map CSF outcomes to other standards and control catalogs. Community Profiles let groups of organizations with shared interests define common target outcomes.

What Does CSF Alignment Prove About a Vendor?

On its own, a CSF alignment claim proves little, because NIST doesn't certify implementations. A claim of alignment doesn't say how the vendor assessed itself or who did the assessing. A useful review asks for the evidence behind the claim:

  • The profile behind it, both current and target, with the date it was last assessed.
  • Who did the assessment, and whether it was internal or independent.
  • How the vendor handles its own GV.SC outcomes, because a vendor's suppliers become fourth parties to you.
  • External evidence to compare against the claim, such as the vendor's observable vulnerabilities.

How Does Black Kite Map Vendors to NIST Frameworks?

Black Kite assesses vendors against more than 20 built-in frameworks, including NIST, and its own ratings are built on standards including NIST. With custom cyber risk assessment frameworks, teams can start from built-in frameworks such as NIST, ISO, HIPAA, DORA, and GDPR or build their own control sets. An AI-powered parser then reads vendor documentation, maps it to those controls, and flags gaps.

Vendor compliance management adds automated mapping to NIST, ISO 27001, SOC 2, HIPAA, and PCI DSS, and it cross-checks vendor compliance claims against independent, externally observed evidence instead of accepting self-reported claims at face value. Black Kite's standards-based ratings rest on MITRE, NIST, and Open FAIR™. For vendors using AI, Black Kite also publishes a free, open standard for third-party AI risk assessment that synthesizes more than 50 frameworks, including ISO, NIST, and the Shared Assessments SIG.