Function, Category, Subcategory
The Core is a hierarchy: Functions divide into Categories, which divide into Subcategories — the outcome statements, each with an identifier such as GV.OC-01 or DE.CM-01. The Subcategory is the level you actually assess against.
Why it is like this
A flat list of outcomes would be unusable and a two-level one too coarse. The identifiers matter more than they look: they are how a Profile, a mapping and an audit finding all refer to the same thing.
Not to be confused with
Three levels of increasing prescription. Every level is an outcome; the Subcategory is simply the most specific one. None of them tells you what to implement.
In practice
In 2.0 the identifiers changed along with the structure, so a mapping built against 1.1's references will not line up — this is the part of a CSF upgrade that takes the time.
Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §2.1 and Appendix A. Read on .
Odd one out Check yourself
Three of these are levels of the CSF Core. Which one is not?
Show the answer
Control
Controls live in the Informative References — SP 800-53, ISO 27001, CIS — not in the Core.