NIST Cybersecurity Framework 2.0 assessment

No. The CSF is a voluntary framework, and NIST does not certify, accredit or endorse organizations against it, so no legitimate CSF certificate exists. What you can have is a documented Current and Target Profile backed by evidence, which is what boards, insurers and customers actually ask for. If you need a certificate or attestation, CSF work maps directly into ISO 27001, SOC 2 or CMMC, each granted by an authorized assessor you choose.

CSF 2.0 adds the Govern function, gathering risk strategy, roles, policy, oversight and supply chain risk management into one place instead of scattering them across Identify. It widens the intended audience from critical infrastructure to every organization, restructures several categories, and adds implementation examples, Quick Start Guides, Community Profiles and online informative references. If your last assessment used 1.1, the ratings don’t carry over cleanly; the governance and supply chain outcomes in particular need fresh evidence.

A Profile describes outcomes: your Current Profile records which CSF outcomes you achieve today and how well, and your Target Profile records which you intend to achieve. Tiers describe the rigor of your approach — Partial, Risk Informed, Repeatable or Adaptive — across cyber risk governance and management. Tiers are not a maturity score to chase for its own sake; the right Tier depends on your risk and resources, and aiming for Adaptive everywhere is rarely sensible.

The CSF says what outcomes to achieve. SP 800-53 is a catalog of specific security and privacy controls, and SP 800-171 is the requirement set for protecting Controlled Unclassified Information in nonfederal systems. NIST’s informative references link CSF subcategories to those controls. Many organizations use the CSF to set direction and report to leadership, then use a control catalog to implement and test. If you handle CUI or sell to the Department of Defense, a CSF profile is a useful first view, but SP 800-171 and CMMC set the bar you are measured against.

Underwriters increasingly ask about specific controls — multi-factor authentication, endpoint detection and response, backups, privileged access, incident response — and many organize their questions around the CSF functions. A current, evidence-backed profile lets you answer accurately, which matters because inaccurate answers can lead to coverage disputes after a claim. It also shows which gaps are most likely to affect your terms, so you can address those first.

It is the most common one, because six functions are simple enough for directors to follow while still mapping to detailed controls underneath. A CSF-based report can show the current and target position for each function, the highest risks, and progress against the roadmap over time. Pairing the profile with penetration testing and exercise results keeps the scorecard grounded in evidence instead of self-assessment.