YTYK You think you know

Card 12 of 15 Profiles — the actual deliverable ●●○ Working knowledge

There is no CSF certification

There is no CSF certification, no accreditation and no compliance status. The Framework is voluntary, it produces no pass mark, and no body awards anything for having used it.

Why it is like this

It was built as a common language for risk conversations across sectors and across the boundary between technical and executive staff. A certificate would have turned that into a procurement checkbox within a year.

Not to be confused with

Unauditable. Plenty of organisations are assessed against a CSF Profile, by internal audit or a third party, and regulators reference it. What does not exist is a certificate saying "CSF compliant" — any vendor claiming one is selling you their own scheme.

In practice

The same is true of Tiers: there is no body that awards you Tier 3.

Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §1 and §4. Read on .

Predict Check yourself

A supplier's proposal states it is "NIST CSF 2.0 certified". What should you conclude?

  1. No such certification exists — at best they mean a third party assessed them against a Profile, and it is worth asking which one.
  2. They hold an accreditation issued by NIST.
  3. They have achieved Tier 4.
  4. They are certified to ISO/IEC 27001, which the CSF recognises as equivalent.
Show the answer

No such certification exists — at best they mean a third party assessed them against a Profile, and it is worth asking which one.

It is a useful question to ask a supplier, because the honest answer names a Profile and an assessor, and the dishonest one does not.