It dropped critical infrastructure from the title
Version 1.1 was the *Framework for Improving Critical Infrastructure Cybersecurity*. Version 2.0, published 26 February 2024, is simply The NIST Cybersecurity Framework (CSF) 2.0 — explicitly for organizations of any size, sector and maturity, not only critical infrastructure.
Why it is like this
The framework had been adopted far outside its stated audience for a decade. The rename ratifies what had already happened and removes the excuse that it was written for somebody bigger.
Not to be confused with
A cosmetic change. It came with a deliberate widening — small-business Quick Start Guides, Community Profiles and Implementation Examples — aimed at organisations with no dedicated security function.
In practice
It is also not a US-only instrument in practice: it is used internationally and is mapped against ISO/IEC 27001 in the Informative References.
Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §1. Read on .
Odd one out Check yourself
Three of these describe CSF 2.0's stated audience. Which one does not?
Show the answer
US federal agencies and their contractors specifically
Federal agencies have their own mandatory regime in SP 800-53 and FISMA. The CSF is voluntary, and 2.0 widened rather than narrowed who it is for.