YTYK You think you know

Card 8 of 15 Inside the Core ●●○ Working knowledge

Implementation Examples are examples

CSF 2.0 added Implementation Examples: concrete, notional illustrations of action that could help achieve a Subcategory. They are not a required set, not exhaustive, and they are maintained online rather than in the published framework document.

Why it is like this

The commonest complaint about 1.1 was that outcomes were too abstract for a small organisation to act on. Examples close that gap without turning the framework into a control catalogue — and keeping them online means they can be updated without a new version.

Not to be confused with

A checklist of required actions. Treating the Examples as mandatory recreates exactly the prescriptive catalogue the Core was designed not to be, and locks you out of a better way of achieving the same outcome.

In practice

They live alongside the Informative References in the CSF 2.0 Reference Tool, which is where you look them up rather than in the PDF.

Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §2.2. Read on .

Predict Check yourself

An auditor marks an organisation non-compliant because it did not perform a listed Implementation Example. Is that a sound finding?

  1. No — Implementation Examples are notional illustrations, not requirements; the question is whether the Subcategory's outcome is achieved.
  2. Yes — Implementation Examples are the testable form of a Subcategory.
  3. Yes, for organisations targeting Tier 3 or above.
  4. No, because the CSF cannot be audited at all.
Show the answer

No — Implementation Examples are notional illustrations, not requirements; the question is whether the Subcategory's outcome is achieved.

The CSF can certainly be used as an assessment basis. What cannot be done is turning an example into an obligation.