NIST CSF 2.0 for IT Teams, Mapped to the Controls You Run, With a Self-Assessment Worksheet

Updated: November 2026. Function and category names, subcategory counts, Tiers, profile steps and every crosswalk date checked against NIST's CSF 2.0 publications, NIST's OLIR mapping catalog and CIS, AICPA and CISA pages on 11 November 2026.

Security questionnaires, insurance renewals and client contracts keep asking which framework your security program follows. A small IT team rarely has time to turn a framework document into tickets. This guide maps NIST CSF 2.0 to the controls you already run, then gives you a worksheet to score where you stand.

TL;DR

• What it is. NIST CSF 2.0 is a free, voluntary set of security outcomes in 6 functions, 22 categories and 106 subcategories.
• No certificate. NIST certifies nobody, so you show a profile and its evidence instead.
• Tiers and scores. Leadership picks a Tier for how rigorously risk is governed and managed, and the worksheet scores categories separately.
• CIS does the tasks. CIS Controls IG1 gives a small team its to-do list, and CSF is the report.
• Start with the worksheet. Score 22 rows, set targets and turn each gap into a ticket.

What Is NIST CSF?

NIST CSF is a free, voluntary framework from the US National Institute of Standards and Technology that lists the cybersecurity outcomes an organization should reach, sorted into six functions. It describes what good looks like and leaves the methods, tools and vendors to you.

The current version is CSF 2.0, published as NIST CSWP 29 on 26 February 2024. Version 1.0 came out in February 2014 under Executive Order 13636, and 1.1 followed on 16 April 2018. Version 2.0 dropped the old title, Framework for Improving Critical Infrastructure Cybersecurity, and added a sixth function, Govern. So if a guide still teaches five functions, it's describing 1.1.

A NIST blog post on 24 February 2026 called CSF 2.0 NIST's top-downloaded technical publication, with over 3 million views and downloads.

The outcomes skip tools on purpose: CSF asks for a hardware inventory and doesn't care which RMM produces it. For how frameworks sit next to legal and contract duties, start with our IT compliance basics.

How the NIST CSF Framework Is Built

CSF 2.0 has three parts: the Core, Organizational Profiles and Tiers. Around them, NIST publishes online resources: mappings to other frameworks (it calls them Informative References), worked examples for subcategories and short Quick-Start Guides.

The Core is the list of outcomes. NIST says it isn't a checklist, and the order implies no sequence or priority: the functions are worked on at the same time. Govern sits in the middle of NIST's wheel because it shapes how the other five get done. The Core covers IT, IoT and OT, plus cloud, mobile and AI environments.

Here's how the 22 categories split across the six functions, with two category codes from each.

Organizational Profiles describe your posture in Core terms. A Current Profile says where you are, a Target Profile says where you want to be, and the gap between them is your work list. You can keep any number of profiles, such as one per site or per client.

Tiers describe how rigorously an organization governs and manages cybersecurity risk, from Tier 1 to Tier 4, and get their own section below. The 1.1-to-2.0 changes live in our IT governance guide, linked under Govern.

NIST's own four-minute overview of CSF 2.0, published on 21 October 2024, is the video NIST embeds on its framework pages. It predates the 2025 and 2026 mapping updates listed at the end of this post.

One Outcome From Function to Evidence

People search for the number of controls in NIST CSF. Strictly, it has none: CSF lists 106 outcomes, and the controls come from the frameworks mapped to them. Here's one outcome traced from its function down to the file an auditor would ask for.

Two things in that trace surprise people. CIS's mapping ties Control 7 only to ID.RA, where vulnerabilities get found, and leaves it off PR.PS-02. And the ISO 27001 mappings come from third parties: NIST lists them in its catalog but says it doesn't test non-NIST mappings for correctness or endorse them.

The evidence row is the one you own. A patch report only proves PR.PS-02 if your plan sets the deadline it's measured against, so write the deadline first. Our Windows patch policy guide covers the patching side in detail.

The Six Functions Mapped to What a Small IT Team Runs

The tables below are our mapping at category level, built for a team of one to five people. NIST and CIS haven't reviewed or endorsed them. Two columns are ours: what a small team runs, and the evidence that proves it. The CIS column is CIS's own CSF 2.0 mapping, as posted to NIST's OLIR catalog on 23 December 2025.

That CIS mapping is thinner than you'd expect. It covers 49 of the 153 Safeguards and maps nothing to GV.OC, GV.RM, GV.PO, GV.OV or RS.MI. A dash in the CIS column means CIS mapped no Safeguard there. The work still counts.

Govern

Govern has 6 categories and 31 subcategories. It's the paperwork layer: who decides, what you've promised, and how leadership checks it.

GV.OC-03 is the subcategory NIST's FAQ points to for compliance: knowing the legal, regulatory and contract requirements you're under. Decision rights, first artifacts, how Govern stacks with COBIT and ITIL, and the 1.1-to-2.0 changes are in our guide to the Govern function in depth.

GV.PO-02 asks that policy is reviewed, updated, communicated and enforced. So the register needs review dates, not only titles. If your policies read like step-by-step instructions, our policy vs procedure guide explains the split.

GV.SC is the biggest Govern category, at 10 subcategories. Start with GV.SC-04: know your suppliers and rank them by criticality. Our vendor risk program guide covers the tiering.

Identify

Identify has 3 categories and 21 subcategories. Know what you have and what can go wrong with it.

ID.AM counts data too. ID.AM-07 asks for a data inventory, and an RMM export won't give you one, so keep a short list of where regulated or client data lives. Our asset lifecycle guide covers the hardware side.

One surprise in 2.0: the incident response plan sits in Identify. ID.IM-04 asks that IR and other cybersecurity plans are set up, communicated, maintained and improved. ID.RA-01 is the scanning outcome, where vulnerabilities are found, validated and recorded. For the tools behind it, see our vulnerability scanning roundup.

Protect

Protect has 5 categories and 22 subcategories. It holds the day-to-day controls, and it's where CIS IG1 does the heavy lifting.

PR.AA-05 is the access review row: permissions are defined, managed, enforced and reviewed, with least privilege. A signed quarterly review of admin and finance access covers it for a small team. Our guide to role-based access shows how to group permissions so there's less to review.

PR.PS-04 puts logging under Protect too: log records are generated and made available for monitoring. For PR.AT, a completion export per person is the evidence, and our awareness training guide covers what makes training stick.

Detect

Detect has 2 categories and 11 subcategories. Spot trouble, then decide whether it's an incident.

DE.AE-08 asks that incidents are declared when events meet defined criteria. Write the criteria down in daylight, because 2 a.m. is a bad time to invent them. A DE.CM coverage report only means something if the logs land where someone looks, and our log collection guide covers where to send them.

Respond

Respond has 4 categories and 13 subcategories.

CIS Control 17 covers every mapped Respond row, and the gap in CIS's mapping shows here. RS.MI-01 and RS.MI-02 are containment and eradication, and no Safeguard maps to them. Put the isolate-and-disable steps in your plan anyway. Our incident response plan guide walks through writing one.

Recover

Recover has 2 categories and 8 subcategories.

RC.RP-03 asks that backup integrity is verified before you restore. That's the same restore test PR.DS-11 wants, so one test produces evidence for two rows in two functions.

NIST CSF Tiers and Maturity Scores

CSF 2.0 has four Tiers: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). They describe how rigorously an organization governs and manages cybersecurity risk, from informal, ad hoc responses up to agile, risk-informed ones that keep improving. NIST says organizations can choose to use them, and that Tiers should guide a risk method rather than replace it.

CSWP 29 gives each Tier two notional descriptions: governance for the Govern function, and management for the other five. NIST's Tiers Quick-Start Guide, SP 1302 from October 2024, adds the practical side. Leadership generally picks the Tiers, for the whole organization or per function or category, which NIST says works better than per subcategory. Its worked example sets Tier 2 for Identify and Protect, then checks each category in those functions against it.

Here's our reading. A Tier describes how the program is run, while a category score says whether one outcome is in place and proven. Push Tiers down to single controls, such as "Tier 3 for MFA", and they stop saying anything about the program. So the worksheet keeps the two apart: leadership sets the Tiers, and each of the 22 rows gets its own 0-4 score. CSF 1.1 said Tiers don't represent maturity levels, but CSF 2.0 doesn't repeat that line, so this split is our framing.

In r/ciso, a poster asked whether a six-figure outside CSF maturity assessment pays off. The top reply says it helped make the case to the board for more investment, paired with a roadmap. The next says a team can do one in-house in days, and a side thread argues over whether Tiers are maturity levels.

Vendors selling assessments reply in that thread too, so read past them. For a maturity story on top of the profile, our maturity assessment guide walks a 50-person company through one.

NIST CSF Self-Assessment Worksheet

The worksheet has one row per CSF 2.0 category, so 22 rows. Each row holds the category, a plain-language outcome, what a small IT team runs, the evidence and CIS's mapped Safeguards. You add Current and Target scores, an owner, the next action, a due date and a status, and the gap fills itself. An MSP split column suggests who runs each row, and a separate Example sheet fills in PR.PS Platform Security with fictional scores.

Current and Target use a 0-4 scale, kept separate from Tiers:

NIST's profile guide, SP 1301, suggests rating scales such as high, medium and low, 1 to 5, or red, yellow and green. It also lets you add or drop columns. So the 0-4 scale is ours, built so nobody can claim a 3 without a file to point at.

Download the .xlsx worksheet with all 22 rows, the 0-4 scale and the MSP split column. No form, no email.

Prefer Google Sheets? Make your own copy and edit it there.

For subcategory-level work across all 106 outcomes, NIST's own XLSX Organizational Profile template sits on its Profiles page.

How to Fill In the Worksheet

NIST's profile process in CSWP 29 and SP 1301 has five steps, and the worksheet follows them:

1. Scope the profile. The whole company, one site or one client.
2. Gather what you need. Policies, inventories, contracts, the last insurance questionnaire and recent incident tickets.
3. Create the profile. For each row, write what you run and score it as Current, then set the Target score. NIST fills both columns, plus a priority, in this one step.
4. Analyze the gaps and plan. For each gap, write the action, priority, owner, deadline and resources, as SP 1301 lists them.
5. Work the plan and update the profile. Close the tickets, attach the evidence and re-score.

NIST says to repeat the steps as often as needed. Our advice for a small team: review open gaps quarterly and re-score every row once a year.

A Filled-In Example Row

The Example sheet in the download covers PR.PS. Here's a second example, for PR.DS-11, which asks that backups are created, protected, maintained and tested. This team's backup runs nightly but has never logged a restore test.

NIST's own example for PR.DS-11 says to test backups and restores at least once a year. Quarterly is our recommendation, because the same test feeds RC.RP-03 and catches a broken job before an incident does. Our guide to DR test types covers what a restore test should include.

OpenFrame is Flamingo's open, AI-native infrastructure for IT and security, and it supplies evidence for three rows. Its RMM keeps device inventory and per-device patch status (ID.AM, PR.PS), and its help desk keeps incident ticket history (RS.MA). Fae resolves support requests and Mingo runs IT operations, for $1 per device per month with a 14-day free trial. Flamingo builds OpenFrame, which isn't a GRC tool and doesn't score CSF, so policies, risk decisions and the profile stay with you.

How NIST CSF Relates to CIS Controls, ISO 27001, SOC 2 and CMMC

CSF says which outcomes to reach. The frameworks below give you either the controls that reach them or the proof a client wants. Each row has a dated mapping source, so you can see how fresh the crosswalk is.

Read the mapping sources before the arrows. NIST built its own mappings to SP 800-53 and SP 800-171, while the ISO 27001 mappings come from third parties. AICPA's SOC 2 mapping dates from 2018, so it targets the pre-2.0 CSF and has no Govern function to map to.

CMMC Level 2 trips people up. NIST's CSF 2.0 mapping covers SP 800-171 Rev 3, but under 32 CFR 170, Level 2 assesses the 110 requirements of Rev 2. So a Rev 3 crosswalk won't line up row for row with a CMMC assessment. For where the program stands now, see our CMMC status page.

CSF structures the program, and a SOC 2 report is what a client reads. If clients are asking for one, our SOC 2 for MSPs guide covers what's involved.

Where a Small IT Team Should Start

NIST's FAQ says you don't need a consultant to adopt or assess the CSF. It points smaller organizations to its Small Business Quick-Start Guide, SP 1300, from February 2024. CIS IG1 is the 56 Safeguards CIS treats as basic cyber hygiene. For a one- or two-person team, it's the to-do list and CSF is the report. This order gets evidence into the worksheet fastest:

1. Write the context page and name the owners (GV.OC, GV.RR).
2. Build the inventory of devices, software, SaaS and data (ID.AM).
3. Run the IG1 basics under PR.AA, PR.PS and PR.DS: MFA, patching, encryption and backups with a restore test.
4. Collect identity and endpoint logs where someone will read them (DE.CM).
5. Write an incident response plan and test it once (ID.IM-04, RS.MA).
6. Score the worksheet, set targets and review the gaps quarterly.

If an insurance renewal started all this, hold the list up against your insurer's questionnaire. Our guide to cyber insurance questions covers the ones underwriters ask.

In r/cybersecurity, a one-person security team at a small company on Azure asked whether to start with SP 800-53 or CSF. The two top replies suggest UK Cyber Essentials Plus or CIS IG1 as a first step. Others call CSF the target and SP 800-53 a menu too big to adopt whole.

Running NIST CSF Across MSP Clients

NIST's FAQ says the Core outcomes apply whether you run your own systems or a provider runs them as a service. CSWP 29 also lets you keep any number of profiles and use a Target Profile to state what you expect from suppliers. For an MSP, that means one worksheet template, with a Target Profile per client tier.

GV.SC-02 sets roles for suppliers, customers and partners, and DE.CM-06 has the client monitor its providers, which CIS maps to Safeguards 15.2 and 15.6. Both put the MSP inside the client's profile, so agree the split in the contract and record it in the worksheet's MSP column. For software that tracks this across tenants, see our multi-tenant compliance tools roundup.

What Is Current for NIST CSF in November 2026

CSF 2.0 is still the current version on 11 November 2026. NIST's publication pages and its updates archive show no 2.1 or 3.0. What keeps changing is the material around it, and a NIST blog counted seven new CSF 2.0 mappings in 2025 alone.

The Cyber AI Profile, NIST IR 8596, is still a preliminary draft. It was published on 16 December 2025, comments closed on 30 January 2026, and no newer draft has followed. Since a 29 September 2026 executive order on super intelligence, NIST's pages say SI where they said AI. The publication's title still says Cyber AI Profile. Until it's final, our AI governance template maps AI controls to NIST AI RMF.

Our IT governance guide, linked under Govern, keeps the running CSF news log.

Score Your First Profile This Quarter

NIST CSF 2.0 gives you 22 categories of outcomes and leaves the how to you. Map each one to something you already run, attach the evidence, and score it on a scale you keep apart from Tiers. CIS IG1 fills the gaps, and the worksheet shows leadership and clients where you stand. To see where CSF fits next to the rest, browse our wider frameworks list.