YTYK You think you know

Security

NIST CSF 2.0

There are six Functions now, and Tiers were never maturity levels

What the Framework actually is — outcomes rather than controls, Profiles rather than scores — and the two things that changed in 2024 that most people have not caught up with.

Start the map 5 pillars · 15 cards · about 22 minutes end to end

The map

Five minutes, once. Rate each pillar before you start and the cards you are shakiest on come first. Skipping it costs you nothing but the ordering.

  1. What the Framework is

    Outcomes, not controls — and since 2.0, not just for critical infrastructure.

  2. GOVERN, the Function that was added

    The headline change in 2.0, and it is not a sixth step in a sequence.

  3. Inside the Core

    Functions, Categories, Subcategories — plus the two things in 2.0 that are not requirements.

  4. Profiles — the actual deliverable

    Current and Target, and the gap between them is the plan.

  5. Tiers

    Four of them, they are not maturity levels, and Tier 4 is not the goal.

Apply it

One scenario per sitting, about ten minutes. No marking scheme that pretends to be objective — a rubric you are invited to argue with.

Read against The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.