Skip to main content

CSF 2.0 (CSWP 29)Final2024

The NIST Cybersecurity Framework (CSF) 2.0

At a glanceThe common language most cybersecurity guidance now uses: six functions (Govern, Identify, Protect, Detect, Respond, Recover) broken into outcomes any organization can work toward. Every district leader should know its shape, because the Cybersecurity Rubric 2.0 is organized the same way. Read it when you set priorities or explain your program to a board.

Reading level
Leader
Length
32 pages · about 40 min for the key parts
Best for
Superintendents and cabinet, Technology directors, Business officials, IT staff and service partners
CSF 2.0
Govern, Identify, Protect, Detect, Respond, Recover
Read it on NIST DOI 10.6028/NIST.CSWP.29 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Key concepts

CSF 2.0 describes what good cybersecurity risk management achieves, not how to achieve it. Its Core lists outcomes grouped into six functions and 22 categories. Organizational Profiles describe where you are now and where you want to be, and Tiers describe how rigorous your risk practices are. Version 2.0 added the Govern function, which puts leadership, policy, roles and supplier risk at the center.

  • Core: 6 functions, 22 categories and their subcategories (outcomes)
  • Organizational Profiles: Current and Target, used to find and close gaps
  • Tiers 1-4: Partial, Risk Informed, Repeatable, Adaptive
  • Online companions: informative references, implementation examples and quick-start guides

How it is organized

  • CSF overview and intended uses
  • The CSF Core: Govern, Identify, Protect, Detect, Respond, Recover
  • Organizational Profiles and Tiers
  • Online resources that supplement the CSF
  • Improving risk communication and integration with enterprise risk management
  • Appendix A: the full Core; Appendix B: Tiers; Appendix C: glossary

What a school district should take from it

  • Cybersecurity is a leadership responsibility first: Govern sits at the center of the other five functions.
  • The 22 CSF categories map one-to-one to the 22 Cybersecurity Rubric 2.0 categories, so rubric results speak NIST's language.
  • A Target Profile is a decision, not a wish list. Leadership chooses which outcomes matter most for the district.
  • The CSF is voluntary and outcome-based, so a small district can use it without buying anything.

How to use it in your district

  1. Use your rubric baseline as your Current Profile; agree on target levels with the cabinet as your Target Profile.
  2. Report progress to the board by function, using the same six names NIST uses.
  3. Assign an owner for each function so Govern, Respond and Recover do not default to the technology department alone.
  4. Use the quick-start guides (SP 1300 series) instead of the full document for team onboarding.
  5. Revisit the Target Profile each budget cycle and when the district adopts major new systems.

Common misconceptions

The CSF is a compliance checklist you pass or fail.
It is a voluntary set of outcomes. You decide your targets and how to reach them.
It is only for large enterprises or critical infrastructure.
Version 2.0 is written for organizations of any size, sector or maturity, and NIST names schools among the audiences for its small-business guide.
CSF 2.0 replaced the old framework's five functions with new ones.
It kept Identify, Protect, Detect, Respond and Recover and added Govern.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • GV.OCOrganizational Context
  • GV.RMRisk Management Strategy
  • GV.RRRoles, Responsibilities, and Authorities
  • GV.POPolicy
  • GV.OVOversight
  • ID.IMImprovement

Tools in the program portal

Related publications

Citation and source

CSF 2.0 (CSWP 29), The NIST Cybersecurity Framework (CSF) 2.0. National Institute of Standards and Technology. 2024. https://doi.org/10.6028/NIST.CSWP.29.

Replaces: Framework for Improving Critical Infrastructure Cybersecurity v1.1 (CSWP 6, 2018).

Topics: Frameworks and profiles, Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.