Benchmark, prioritize and mature your cybersecurity program against the six functions of the NIST Cybersecurity Framework 2.0 — including the new Govern function.
The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, outcomes-based standard from the U.S. National Institute of Standards and Technology. It gives organizations of any size a common language to describe, measure and mature their cybersecurity program.
Version 2.0 — released in February 2024 — adds a sixth function, Govern, that puts board-level oversight, risk strategy and supply chain at the center of the framework.
Published February 2024 by NIST.
Govern, Identify, Protect, Detect, Respond, Recover.
Outcome-based controls mappable to your existing frameworks.
An outcome-based view of your cybersecurity program — from governance to recovery.
Establish and monitor the cybersecurity risk management strategy, expectations and policy — the new pillar of CSF 2.0.
Understand the assets, suppliers and risks that shape your organization’s cybersecurity posture.
Implement safeguards — identity, access, data security and platform security — to reduce cybersecurity risk.
Find and analyze possible cybersecurity attacks and compromises through continuous monitoring.
Take action on detected cybersecurity incidents — contain, communicate and analyze.
Restore assets and operations affected by a cybersecurity incident, and improve for next time.
Get a defensible baseline of your cybersecurity posture — without a lengthy consulting engagement. Our web-based assessment tool covers all six functions of NIST CSF 2.0 in plain language.
A pragmatic four-step engagement — designed to fit alongside PCI DSS, SOC 2 and ISO programs already in flight.
Complete the self-assessment across all six CSF 2.0 functions to capture where your program stands today.
Translate coverage scores into a target-profile roadmap sequenced by risk, budget and business impact.
Advisory support to close gaps — policy templates, control design and vendor-neutral tooling guidance.
Annual reassessment, board reporting and continuous improvement tied to your risk register.
Every NIST CSF 2.0 engagement leaves you with a portable, auditable evidence set your team owns.
Start with the self-assessment or book a working session with a Truss advisor.