Support NIST CSF 2.0 readiness with adaptive compliance

NIST (The National Institute of Standards and Technology) publishes it. Nobody has to follow it — it’s voluntary, with no mandate behind it for the private sector and no certification attached.

That’s unusual, and it’s the point. CSF is designed to be adoptable by any organization, in any sector, at any size, without a regulator forcing the issue.

Govern (GV) — your cybersecurity risk management strategy, expectations and policy.

Identify (ID) — understanding your assets, suppliers and the risks to them.

Protect (PR) — the safeguards that reduce likelihood and impact.

Detect (DE) — finding anomalies and indicators of compromise in good time.

Respond (RS) — containing and managing an incident once detected.

Recover (RC) — restoring assets and operations afterwards.

Govern is the addition in version 2.0, and it sits across the other five rather than beside them.

No, and this trips people up.

CSF describes outcomes — what should be true — organized into Functions, Categories and Subcategories. It doesn’t specify controls. For those it points at catalogs such as NIST  800-53.

The practical implication: you can’t "implement CSF" the way you implement a control set. You use it to structure your program, identify gaps, and communicate — then reach for a catalog to decide what to actually deploy.

For most organizations, yes.

CSF carries no mandate, so nothing forces the decision — but it’s the framework most commonly recommended as a starting point precisely because it works at any size and doesn’t assume a sector. It gives you a way to see your whole program before you commit to a certification track.

The exception is if a buyer or a contract has already named something specific. If a customer wants SOC 2, or you’re in a federal supply chain and CMMC has appeared in a contract, start there — the deadline picks the framework for you. 

In general, NIST CSF 2.0 can serve as a transition layer for the next steps on a certification journey, even if no one has demanded a specific framework yet. 

No. There is no CSF certification, no accredited assessor scheme, and nobody who can issue you one.

What CSF produces is an Organizational Profile — a documented view of your current outcomes and your target outcomes. Some organizations share a version of that with buyers. It’s a self-produced artifact, not a credential, and should be presented as such.

They do different jobs.

800-53 is the control catalog — what to implement. CSF is the organizing layer — how to structure and communicate the program. CSF points at 800-53 rather than replacing it.

800-171 is a subset of 800-53, tailored for nonfederal systems handling CUI. CMMC is the Department’s program for verifying 800-171.

The important distinction: 800-171 and CMMC only apply if you work with federal or defense customers. CSF applies to anyone who wants it.

There’s nothing to be compliant with — CSF is voluntary and uncertified. The useful question is whether you’re achieving the outcomes it describes.

Iru contributes directly to four of the six Functions, and it takes the platform rather than the compliance product alone. Identify comes from Iru Endpoint Management, which inventories your devices, Iru Workforce Identity, which inventories your identities, and Iru Vulnerability Management, which surfaces your software risk — knowing what you actually have is where most programs find their first gap. Protect comes from Iru Endpoint Management and Iru Workforce Identity: device hardening, encryption, and access tied to device posture. Detect and Respond come from Iru Endpoint Detection & Response, finding anomalies and containing them. Iru Compliance Automation keeps the evidence for all of it current.

Govern is your strategy and oversight. Recover depends on backup and restoration capability Iru doesn’t provide. Both sit outside the platform.

If you’d like to see how the other four work, book a demo. Existing customers can reach out to their rep.