CSF 2.0 is built for gap assessment
NIST released Cybersecurity Framework 2.0 on February 26, 2024, adding the “newly added Govern function” plus quick-start guides and implementation examples (NIST). Its method for gap assessment is explicit: “Conduct a gap analysis to identify and analyze the differences between the Current and Target Profiles” (NIST CSWP 29).
| Element | What it is |
|---|---|
| Functions (6) | “Govern, Identify, Protect, Detect, Respond, and Recover” |
| Core | 22 categories and 106 subcategories (down from 23 and 108 in CSF 1.1, per Protiviti) |
| Organizational Profiles | Current Profile (what you achieve today) and Target Profile (what you want to achieve) |
| Tiers | ”Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4)” |
For NIST SP 800-171 self-assessments, CMMC and SP 800-53A control assessments, see NIST Assessment Guide: NIST 800-171 Self-Assessment, CMMC and Security Control Assessments.
What’s new in 2025–2026
- Quick-start guides keep expanding. NIST’s library now includes guides on Organizational Profiles (SP 1301), Tiers (SP 1302), enterprise risk management (SP 1303), supply chain risk (SP 1305) and Informative References (SP 1347) (NIST).
- AI enters the framework. NIST published a preliminary draft Cyber AI Profile (NISTIR 8596) on December 16, 2025, covering securing AI systems, AI-enabled defense and thwarting AI-enabled attacks (NIST). In August 2026 it released a draft quick-start guide on “Using Artificial Intelligence (AI) for CSF Analysis and Reporting” (SP 1353), open for comment until October 15, 2026 (NIST CSRC).
- Regulators reference CSF. CISA states that “each goal in the CPGs is mapped to a corresponding subcategory from the NIST CSF” (CISA), and HHS’s proposed HIPAA Security Rule update notes its concepts are represented in “the NIST’s Cybersecurity Framework” (Federal Register).
How to run a CSF 2.0 gap assessment
- Scope. Choose the organization, business unit or system the profile covers.
- Gather inputs. Policies, risk register, prior audits, SOC 2 or ISO 27001 reports, and regulatory requirements.
- Build the Current Profile. For each subcategory, record what you achieve today, with evidence.
- Build the Target Profile. Set the outcomes you need, driven by risk, regulation and business priorities.
- Analyze gaps. Compare Current vs Target, then prioritize by risk and effort.
- Plan and track. Turn gaps into an action plan with owners and dates; reassess on a set cycle.
Gap assessment template
One row per subcategory. Example rows:
| Subcategory | Current state | Evidence | Target state | Gap | Priority | Owner |
|---|---|---|---|---|---|---|
| GV.SC-04: “Suppliers are known and prioritized by criticality” | Vendor list exists; no criticality tiers | Vendor register v5 | All suppliers tiered by criticality | Tiering method missing | High | TPRM lead |
| PR.AA (identity and access) | MFA on email only | IdP config export | MFA on all remote and privileged access | MFA coverage | High | IAM lead |
| RS (incident response) | Plan exists, untested | IR plan v2 | Annual tabletop with third parties | No testing | Medium | SOC manager |
The rows are illustrative. NIST’s Organizational Profiles quick-start guide (SP 1301) offers official templates (NIST).
Checklist for a credible assessment
- All six functions covered, including Govern (policy, roles, supply chain risk)
- Each Current state backed by evidence, not interviews alone
- Target Profile tied to documented risk and regulatory drivers
- Tier chosen and justified for governance and management practices
- Gaps prioritized, owned and dated
- Mapping to other frameworks (ISO 27001, NIST SP 800-53, CIS) captured via Informative References
Speed up the evidence step
The Current Profile is only as good as its evidence. Reading policies, reports and procedures against 106 subcategories takes weeks. AI evidence assessment can map your documents to CSF 2.0 subcategories, flag outcomes with no supporting evidence and cite the passage behind every finding. NIST’s own draft SP 1353 shows the agency sees AI as a legitimate aid for CSF analysis, with human oversight.
Try a security evidence assessment against CSF 2.0. AskDona shows the evidence; your team sets the Target Profile.
FAQ
What changed from CSF 1.1 to 2.0? A new Govern function, a broader audience beyond critical infrastructure, and a restructured Core of 22 categories and 106 subcategories (NIST).
Is the NIST CSF mandatory? No, it is voluntary, but regulators and programs such as CISA’s CPGs map to it.
How is CSF different from NIST SP 800-53? CSF describes outcomes; SP 800-53 is a catalog of controls. Informative References connect the two.
Can AI help with CSF assessments? NIST has a draft quick-start guide on using AI for CSF analysis and reporting (NIST CSRC).
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| NIST: CSF 2.0 release | Standard body | Feb 26, 2024 | Govern function, resources |
| NIST CSWP 29: CSF 2.0 | Standard | Feb 26, 2024 | Functions, profiles, tiers |
| Protiviti: CSF 2.0 flash report | Consultancy | 2024 | Category counts |
| NIST: Quick-start guides | Standard body | Aug 25, 2026 | SP 1300 series |
| NIST: Cyber AI Profile draft | Standard body | Dec 16, 2025 | NISTIR 8596 |
| NIST CSRC: SP 1353 draft | Standard body | Aug 19, 2026 | AI for CSF analysis |
| CISA: Cross-sector CPGs | Regulator | Current | CSF mapping |
| Federal Register: Proposed HIPAA Security Rule | Regulator | Jan 6, 2025 | CSF reference |