6 Functions of the NIST Cybersecurity Framework (2026 Update) & What’s Changed

The NIST Cybersecurity Framework (NIST CSF) is one of the most widely adopted frameworks for managing and reducing cybersecurity risk. Originally released in 2014, the framework provides organizations with a structured, flexible approach to identifying, protecting against, detecting, responding to, and recovering from cyber threats.

While the NIST cybersecurity framework is voluntary, it has become a de facto standard across industries due to its adaptability, scalability, and alignment with other compliance frameworks such as ISO 27001, SOC 2, and HIPAA.

In 2024, NIST released a major update—CSF 2.0—which expanded the framework’s scope beyond critical infrastructure and introduced a stronger emphasis on governance, risk management, and organizational accountability. As of 2026, CSF 2.0 represents the current standard. NIST also released a cybersecurity, enterprise risk management, and workforce management quick-start guide in March 2026 to help organizations improve communications around these topics.

The framework is composed of three primary components:

• The Framework Core: Functions, categories, and subcategories
• Implementation Tiers: Risk maturity levels
• Profiles: Alignment between current and target states

Together, these components help organizations assess their current cybersecurity posture, define target outcomes, and build a roadmap for continuous improvement.

The 6 Core Functions of the NIST Cybersecurity Framework (CSF 2.0)

One of the most important updates in CSF 2.0 is the addition of a sixth function: Govern.

Today, the NIST cybersecurity framework core functions include:

• Govern (new in CSF 2.0)
• Identify
• Protect
• Detect
• Respond
• Recover

These functions are not linear—they operate continuously and in parallel to support a comprehensive cybersecurity risk management strategy.

Govern (New in CSF 2.0)

The Govern function is the most significant change in the modern NIST cybersecurity framework. It elevates cybersecurity from a technical issue to a business and leadership responsibility.

This function focuses on establishing:

• Cybersecurity risk governance and oversight
• Policies aligned with business objectives
• Roles, responsibilities, and accountability
• Integration of cybersecurity into enterprise risk management (ERM)
• Supply chain risk management strategy

Organizations are now expected to demonstrate that cybersecurity decisions are driven at the executive level, not just within IT.

This shift reflects a broader industry trend: cybersecurity is no longer just about controls—it’s about governance, risk ownership, and business alignment.

Identify

The Identify function remains foundational to understanding organizational risk. It focuses on developing a comprehensive understanding of:

• Assets (systems, data, people, vendors)
• Business environment and critical operations
• Governance structures and regulatory requirements
• Risk assessments and threat landscape
• Risk tolerance and prioritization

CSF 2.0 places additional emphasis on:

• Third-party and supply chain visibility
• Data classification and ownership
• Business context in risk decisions

Without a strong Identify function, organizations cannot effectively prioritize cybersecurity investments.

Protect

The Protect function outlines safeguards to limit or contain the impact of cybersecurity events. Key areas include:

• Identity and access management (IAM)
• Security awareness and training
• Data protection and encryption
• Secure configuration and system maintenance
• Protective technologies and controls

In CSF 2.0, there is greater emphasis on:

• Zero trust principles
• Identity-first security strategies
• Integration of human risk (training and behavior)

Organizations must move beyond static controls and adopt adaptive, risk-based protections.

Detect

The Detect function ensures timely discovery of cybersecurity events. It includes:

• Continuous security monitoring
• Detection of anomalies and suspicious activity
• Logging and event analysis
• Defined detection processes

Modern updates emphasize:

• Real-time visibility across hybrid environments
• Integration with SIEM, XDR, and AI-driven detection tools
• Defined detection thresholds based on business risk

The speed and accuracy of detection directly impact the organization’s ability to minimize damage.

Respond

The Respond function focuses on containing and managing cybersecurity incidents once detected. It includes:

• Incident response planning
• Internal and external communications
• Root cause analysis
• Mitigation and containment actions
• Continuous improvement based on lessons learned

CSF 2.0 reinforces:

• Cross-functional response coordination (legal, PR, executive leadership)
• Regulatory and breach notification requirements
• Playbooks and tabletop testing

An effective response program reduces operational disruption and reputational damage.

Recover

The Recover function ensures resilience and a timely return to normal operations. It includes:

• Recovery planning and prioritization
• System restoration and data recovery
• Business continuity alignment
• Post-incident improvements
• Stakeholder communication

Recent updates emphasize:

• Cyber resilience over simple recovery
• Integration with disaster recovery (DR) and business continuity planning (BCP)
• Testing recovery capabilities regularly

Organizations are expected not just to recover—but to recover quickly and strategically.

Implementation Tiers: Measuring Cybersecurity Maturity

In addition to six core functions, the NIST cybersecurity framework also includes four implementation tiers that help organizations assess maturity:

• Tier 1: Partial
• Tier 2: Risk-Informed
• Tier 3: Repeatable
• Tier 4: Adaptive

These tiers allow organizations to benchmark their current posture and define a target state. CSF 2.0 strengthens the connection between tiers and enterprise risk management, encouraging organizations to align cybersecurity maturity with business risk tolerance.

How to Implement the NIST Cybersecurity Framework in 2026

Implementing the NIST cybersecurity framework core functions requires a structured, iterative approach. Organizations should:

• Conduct a gap assessment against CSF 2.0
• Develop a current vs. target profile
• Prioritize remediation based on risk
• Establish governance and accountability structures
• Continuously monitor, test, and improve controls

The NIST cybersecurity framework remains one of the most effective ways to strengthen cybersecurity posture, align security with business objectives, prepare for audits and regulatory requirements, and reduce organizational risk. Its flexibility allows organizations to map it to other frameworks, making it a powerful foundation for compliance and security programs.

However, the NIST cybersecurity framework is not a one-time project. To be effective, it requires a continuous lifecycle of risk management and improvement.

How IS Partners Can Help

Successfully implementing the NIST cybersecurity framework core functions requires more than documentation—it requires expertise, structure, and ongoing oversight.

IS Partners helps organizations:

• Perform NIST CSF gap assessments
• Build and mature cybersecurity programs
• Align with multiple compliance frameworks
• Strengthen governance and risk management

Our approach ensures your organization moves from reactive security to a proactive, risk-driven cybersecurity strategy. With more than two decades of experience in guiding and auditing government agencies and contractors for compliance, our dedicated NIST Compliance Consultant group is ready to help federal information systems and government contractors comply with NIST standards.

Click here to schedule your free, 30-minute consultation with a senior-level compliance expert today.

About The Author

Jena Andrews

Jena is a senior auditor and security consultant since 2021. She is specialized in compliance management, cybersecurity, IT security, and risk management. Jena is a certified information systems auditor (CISA) and project manager.

With a decade-long history in Project Management, Jena has focused the past five years on Compliance, IT and Operations auditing, Information Security, and Cybersecurity. She has conducted a plethora of compliance audits and security assessments in accordance with standards including SOC 1, SOC 2, HIPAA, PCI DSS, ISO 27001, and NIST 800-53, 800-171.

Jena is a proud B.S. graduate in Criminal Justice from West Chester University and holds esteemed CISA, PMP, and CCP certifications, further highlighting her expertise and commitment to professionalism.