What is the NIST Cybersecurity Framework 2.0?

NIST CSF 2.0, released in 2024, is a voluntary framework of cybersecurity outcomes that helps organizations of any size manage and reduce cyber risk. It is organized around functions, categories and subcategories that map to widely used controls.

What are the six functions of NIST CSF 2.0?

NIST CSF 2.0 is organized around six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new in 2.0 and addresses cybersecurity strategy, roles, policy and oversight.

What changed between NIST CSF 1.1 and 2.0?

The most significant change is the addition of the Govern function, expanded guidance for organizations of all sizes and sectors, and stronger emphasis on supply-chain risk management.

How does SBCMSP map NIST CSF 2.0?

SBCMSP continuously assesses client posture across all six NIST CSF 2.0 functions, scores each outcome as pass, partial or fail, and produces a white-label, audit-ready report with per-item remediation guidance.

All frameworks

NIST Cybersecurity Framework 2.0

NIST CSF 2.0 — measure posture across all six functions

Official source: NIST Cybersecurity Framework 2.0

Assess your clients against the NIST Cybersecurity Framework 2.0, including the new Govern function — Identify, Protect, Detect, Respond and Recover, scored continuously.

Get started Read the checklist

NIST CSF 2.0 · functions 74 / 106

GVGovernPARTIAL

IDIdentifyPASS

PRProtectPARTIAL

DEDetectPASS

RSRespondPARTIAL

RCRecoverFAIL

NIST CSF is one of ten frameworks mapped from a single scan

SOC 2

HIPAA

PCI DSS v4

NIST CSF 2.0

CMMC

ISO 27001

CIS v8

FTC Safeguards

Cyber Essentials

NIST 800-171

Coverage

How SBCMSP maps NIST CSF

Continuous monitoring across every control family — 106 controls, scored on each scan.

Govern

Risk strategy, roles, policy and oversight (new in 2.0).

Identify

Asset, risk and supply-chain understanding.

Protect

Access control, awareness and data security.

Detect

Continuous monitoring and detection.

Respond & Recover

Incident response and recovery planning.

Evidence & reporting

Auto-collected evidence and a white-label, audit-ready PDF for every control.

Who it’s for Any organization adopting a recognized framework — and the MSPs guiding them.

Resources Start with the NIST CSF 2.0 checklist, then read our guide to external attack surface management.

Continuous, not point-in-time

Audit-ready all year — not just at renewal

Instead of a frantic evidence scramble before the audit, SBCMSP monitors each NIST CSF control continuously and flags drift the moment it happens.

Control-level pass / partial / fail status
Auto-collected, timestamped evidence
Gap remediation guidance per control
White-label report for the client & auditor

readiness · acme-corp70%

Controls passing74 / 106

Evidence collected94%

Open gaps4

Keep exploring

Other frameworks we map

SOC 2 HIPAA PCI DSS CMMC ISO 27001 CIS v8 FTC Safeguards Cyber Essentials CIS Controls

Get your clients NIST CSF-ready faster

Run a readiness assessment in minutes and see exactly which controls need work.

Get started Read the checklist