Last updated: 9 November 2026
NIST CSF 2.0 is a free, voluntary cyber security framework from the US National Institute of Standards and Technology, updated in February 2024. It organises security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. UK businesses are not required to use it, but it is a useful way to structure a security programme, and to show a client or insurer that you manage risk deliberately.
The six functions
Govern
New in 2.0. Leadership sets risk appetite, roles, policy and oversight, including supply chain risk.
Identify
Know your assets, data, suppliers and risks.
Protect
Safeguards such as access control, training, patching and secure configuration.
Detect
Monitoring that finds attacks and unusual activity quickly.
Respond
Incident management, analysis, communication and containment.
Recover
Restoring systems and data, then learning from what happened.
What changed in version 2.0
- Governance and accountability now sit at the centre, so cyber risk is a board and director matter.
- Greater emphasis on managing suppliers and the supply chain.
- Extra guidance for small businesses, including quick start guides and examples.
How it compares with what UK businesses already use
| Scheme | Type | Best for |
|---|---|---|
| NIST CSF 2.0 | Voluntary framework, no certificate | Structuring a programme and measuring maturity |
| Cyber Essentials | UK certification of basic controls | Baseline protection and many UK contracts |
| ISO 27001 | Certifiable management system | Formal assurance for larger clients and tenders |
| NCSC CAF | UK assessment framework | Essential services and regulated sectors |
NIST CSF 2.0 cannot be certified. You use it to describe where you are now (a Current Profile), where you need to be (a Target Profile) and the gaps between them. Many UK businesses start with Cyber Essentials, then use NIST CSF to plan beyond it.
Using it in a small business
- Start with Govern: name an owner, agree a risk appetite and write a short policy.
- Score yourself against each function in plain terms: not done, partly done, done and tested.
- Pick the three weakest areas and fix those first.
- Review once a year, or after a major change.
How ABCOM helps
We run a short gap review against NIST CSF 2.0, map it to Cyber Essentials and ISO 27001, and give you a prioritised action list in plain English. As an NCSC Assured Service Provider we keep the advice practical for UK small and medium businesses.
Quick answers
Is NIST CSF 2.0 mandatory in the UK?
No. It is a voluntary US framework used worldwide. Some US customers or parent companies may ask you to align with it, but UK law does not require it.
Can we get certified to NIST CSF 2.0?
No. There is no official certificate. You can have an independent assessment against it, but Cyber Essentials and ISO 27001 are the certifications you can hold.
What are Implementation Tiers?
Four levels (Partial, Risk Informed, Repeatable and Adaptive) that describe how well an organisation manages cyber risk. They are a conversation tool, not a pass mark.
How does it relate to Cyber Essentials?
Cyber Essentials covers five technical controls. NIST CSF 2.0 is broader and includes governance, detection, response and recovery.
Want to know where you stand against NIST CSF 2.0? We will give you a clear gap review and a short action plan.
Related answers and guides
- What is Zero Trust?
- What is an incident response plan?
- What do cyber insurers require?
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about Microsoft Defender and Purview. Free, friendly and no obligation.