NIST CSF 2.0 · Assessment guide
Score CSF 2.0 honestly — outcome by outcome, with evidence.
A CSF maturity score is only as good as the evidence under it. This guide sets out what NIST actually defines — six Functions, 22 Categories, 106 Subcategories, Profiles and Tiers — what it does not, and a method and template for an assessment your board can challenge and still trust.
Reviewed 6 November 2026 · 10 sources cited
The short answer
A NIST CSF 2.0 maturity assessment rates your organisation against the framework’s 106 Subcategories, grouped into 22 Categories under six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Record a Current and a Target Profile, score each outcome on a defined scale backed by evidence, and prioritise the gaps. NIST’s four Tiers describe the rigour of your risk management, not a maturity score — rate them separately. There is no CSF certification.
Start here
What NIST defines, and what every assessment adds.
CSF 2.0 was published on 26 February 2024 as NIST CSWP 29, the first major update since 2014. Its Core is a set of outcomes — six Functions, 22 Categories and 106 Subcategories. Govern is new, and the old title, “Framework for Improving Critical Infrastructure Cybersecurity”, is gone: CSF 2.0 is written for organisations of every size and sector. NIST is explicit that the outcomes “are not a checklist of actions to perform” and that the CSF does not prescribe how to achieve them.
NIST gives you two tools for describing where you stand. An Organizational Profile records your Current state and your Target for each outcome; the gap between them becomes the action plan. The Tiers — Partial, Risk Informed, Repeatable, Adaptive — characterise how rigorous your cybersecurity risk governance and management are.
What NIST does not give you is a maturity score. Every 0–5 or 1–5 scale you have seen in a CSF assessment, including ours, is a convention someone added to make Current and Target comparable. That is fine — as long as the scale is defined, each score is backed by evidence, and nobody presents it as a NIST rating. There is also no CSF certification; anyone selling one is selling something NIST does not offer.
CSF 2.0 Core
Six Functions, 22 Categories, 106 outcomes
Category names and IDs as NIST publishes them, with a one-line summary of each and the number of Subcategories you will score. Gaps in Subcategory numbering are deliberate: NIST kept CSF 1.1 identifiers and relocated some outcomes.
| ID | Category | What it is about | Outcomes |
|---|---|---|---|
| GV.OC | Govern · Organizational Context | Mission, stakeholders, dependencies and legal and contractual requirements are understood | 5 |
| GV.RM | Risk Management Strategy | Priorities, constraints and risk appetite are set and used for decisions | 7 |
| GV.RR | Roles, Responsibilities, and Authorities | Who is accountable for cybersecurity risk, and that leadership owns it | 4 |
| GV.PO | Policy | Cybersecurity policy is established, communicated and enforced | 2 |
| GV.OV | Oversight | Results of risk management feed back into the strategy | 3 |
| GV.SC | Cybersecurity Supply Chain Risk Management | Supplier risk is managed from selection to exit | 10 |
| ID.AM | Identify · Asset Management | Data, hardware, software, services and people are inventoried by importance | 7 |
| ID.RA | Risk Assessment | Vulnerabilities, threats, likelihood and impact are understood | 10 |
| ID.IM | Improvement | Lessons from evaluations, tests and incidents are turned into improvements | 4 |
| PR.AA | Protect · Identity Management, Authentication, and Access Control | Access is limited to authorised users, services and hardware | 6 |
| PR.AT | Awareness and Training | People have the awareness and skills for their security tasks | 2 |
| PR.DS | Data Security | Data at rest, in transit and in use is protected; backups exist | 4 |
| PR.PS | Platform Security | Hardware, software and services are configured, maintained and logged | 6 |
| PR.IR | Technology Infrastructure Resilience | Architecture protects networks and keeps capacity and resilience | 4 |
| DE.CM | Detect · Continuous Monitoring | Networks, people, providers and systems are monitored for adverse events | 5 |
| DE.AE | Adverse Event Analysis | Events are analysed and correlated to declare incidents | 6 |
| RS.MA | Respond · Incident Management | Incidents are triaged, categorised, escalated and handled | 5 |
| RS.AN | Incident Analysis | Investigations establish what happened and the root cause | 4 |
| RS.CO | Incident Response Reporting and Communication | Stakeholders, regulators included, are notified as required | 2 |
| RS.MI | Incident Mitigation | Incidents are contained and eradicated | 2 |
| RC.RP | Recover · Incident Recovery Plan Execution | Systems and services are restored and their integrity verified | 6 |
| RC.CO | Incident Recovery Communication | Recovery progress is communicated inside and outside | 2 |
By Function: Govern 31 outcomes, Identify 21, Protect 22, Detect 11, Respond 13, Recover 8 — 106 in total. Summaries are ours; the outcome wording in the template is NIST’s.
Our convention, not NIST’s
The 0–5 scale in our template
A SemperWise convention for rating each outcome’s Current and Target state. Each step asks for more evidence than the one below it — which is the point.
| Score | Label | What it means | Evidence that supports it |
|---|---|---|---|
| 0 | Not performed | The outcome is not achieved in any part of the scope | None — record why, if it is out of scope |
| 1 | Ad hoc | Achieved sometimes, by individuals, without a defined way of doing it | Examples, but no procedure |
| 2 | Defined | A documented policy, standard or procedure exists | The approved document |
| 3 | Implemented | Done consistently across the whole scope | Records from across the scope, not one team |
| 4 | Measured | Monitored, with evidence that it works | Metrics, test results, review outputs over time |
| 5 | Improving | Reviewed and improved on a cycle | Before-and-after changes driven by those reviews |
Two rules keep it honest: a score without evidence counts as the score below it, and a Target of 5 everywhere is not a target. CSF 2.0 encourages higher Tiers “when risks or mandates are greater” or when cost-benefit supports it — the same logic applies to Targets.
Method
Running the assessment in five steps
NIST’s own five-step process for Organizational Profiles, with what each step means in practice.
-
Step 1
Scope the Profile
- Whole organisation, one business unit, or one risk such as ransomware — NIST allows as many Profiles as you need
- Name who scores, who reviews and who owns the Target
- Mark Subcategories that are out of scope, with the reason
-
Step 2
Gather the information
- Policies, risk registers, business impact analyses, asset inventories, test reports, incident records
- Interview owners per Category — but collect artefacts, not opinions
- Use a sector Community Profile, where one exists, as a starting Target
-
Step 3
Score Current, set Target
- Rate each Subcategory’s Current state against the scale, citing evidence
- Set Targets from risk, regulation and contracts — not ambition
- Rate the four Tiers separately, overall or per Function
-
Step 4
Analyse gaps and plan
- Rank gaps by risk reduction, not by size of gap
- Give every priority gap an owner, a next action and a due date
- Roll scores up by Category and Function for the board summary
-
Step 5
Act, then re-score
- Re-score after the work, using the same evidence rules
- Test the outcomes that matter most — Detect and Respond especially — rather than accepting “yes, we monitor”
- Repeat on a cycle; NIST describes the process as continual improvement
Two different questions
CSF Tiers versus a maturity score
| CSF Tiers (NIST) | Outcome maturity score (our template) | |
|---|---|---|
| Question answered | How rigorous are our cybersecurity risk governance and management practices? | How far is each specific outcome achieved, and how far do we want it? |
| Defined by | NIST — notional descriptions in CSF 2.0 Appendix B | SemperWise — the 0–5 scale above |
| Levels | Partial, Risk Informed, Repeatable, Adaptive | 0 Not performed to 5 Improving |
| Rated at | Overall, or per Function or Category | Every Subcategory, rolled up |
| Set by | Leadership, per NIST’s Quick-Start Guide | Outcome owners, reviewed against evidence |
| Good for | Setting the tone and ambition of the programme | Finding and prioritising specific gaps |
Where SemperWise fits
From a self-assessment to scores that hold up.
Services are people doing the work; SemperWise One is the platform. Each row says which.
“The board wants a number we can defend.”
An independent CSF 2.0 assessment to Subcategory level: evidence reviewed, Current and Target Profiles, a Tier rating with reasons, and a prioritised roadmap.
NIST CSF assessment“Our Detect and Respond scores are self-reported.”
A red-team exercise tests whether attacks are actually noticed and handled — evidence for DE and RS that an interview cannot give.
Red team assessment“We claim vulnerabilities are found and fixed.”
Penetration testing and retesting as evidence for ID.RA and PR.PS, every finding confirmed by a person.
VAPT“We need the profile to stay current.”
CSF held in SemperWise One alongside ISO 27001 and other frameworks, with evidence that carries a collection date and expiry, so scores can be re-checked.
Unified control model“ISO 27001 is the next ask.”
CSF and ISO 27001 cover much of the same ground; we reuse the assessment evidence for certification readiness. Certification itself comes from an accredited body.
ISO 27001 readiness“Nobody owns the roadmap.”
A named senior practitioner a few days a month to run the plan and report to the board.
Virtual CISOThe template
The CSF 2.0 workbook, ready to score.
An Excel workbook with four sheets. Read me explains the method on this page. Assessment has one row per CSF 2.0 Subcategory, with NIST’s outcome wording, and columns for Function, Category, Subcategory ID, Outcome, Current (0–5), Target (0–5), Gap (calculated), Priority, Owner, Evidence / notes, Next action and Due date, with drop-down lists. Summary calculates average current, target and gap per Function and per Category, with a current-versus-target chart by Function. Tiers lets you rate the organisation against the four CSF Tiers separately.
Everything it is built on is on this page. NIST also publishes its own Organizational Profile template as a spreadsheet; ours adds the scale and the roll-up.
- All 106 Subcategories with NIST’s outcome wording
- Gap and averages calculated for you, with a chart by Function
- An updated copy if NIST revises the CSF Core
We reply within 24 business hours. Your email is used only to send the template and its updates.
Thank you
We have emailed you the NIST CSF 2.0 maturity self-assessment template. You can also download it now.
If it is urgent, call +91-95851-60363.
Questions
What people ask about CSF 2.0 assessments next.
The follow-up questions this subject raises, answered in full.
Is there a NIST CSF 2.0 certification?
No. NIST’s own FAQ says it “does not offer certifications or endorsements” of CSF implementations and has no plans for a conformity assessment programme; NIST is not a regulator, and most organisations use the CSF voluntarily. What you can have is an assessment — self-assessed or independent — that records Current and Target Profiles with evidence. If you need a certificate, ISO 27001 is certifiable by an accredited certification body, and much CSF assessment evidence carries over. Our NIST CSF page explains how we run assessments.
What is the difference between CSF Tiers and maturity levels?
Tiers describe how rigorous your cybersecurity risk governance and management are — Partial, Risk Informed, Repeatable, Adaptive. CSF 1.1 stated that “Tiers do not represent maturity levels”, and CSF 2.0 says they should complement your risk methodology, not replace it. A maturity score rates each outcome. NIST’s Tiers Quick-Start Guide suggests choosing Tiers overall or per Function or Category, so rate them separately from Subcategory scores.
How many Categories and Subcategories does CSF 2.0 have?
Twenty-two Categories and 106 Subcategories, under six Functions. By Function: Govern has 6 Categories and 31 Subcategories, Identify 3 and 21, Protect 5 and 22, Detect 2 and 11, Respond 4 and 13, Recover 2 and 8. Subcategory numbers have gaps on purpose — NIST kept CSF 1.1 identifiers and relocated some outcomes — so ID.AM runs 01 to 08 without an 06.
What are Current and Target Profiles?
An Organizational Profile describes your cybersecurity posture in terms of CSF outcomes. The Current Profile records which outcomes you achieve now and how far; the Target Profile records the outcomes you have chosen and prioritised, allowing for new requirements, technology and threats. The gap between them is your action plan. You can have several Profiles with different scopes, and a sector Community Profile can serve as the starting Target.
Is there a free NIST CSF 2.0 self-assessment template in Excel?
NIST publishes a CSF Organizational Profile template as a spreadsheet for recording Current and Target Profiles side by side. Our workbook builds on the same Core: one row per Subcategory with NIST’s wording, a 0–5 scale with calculated gaps, Function and Category averages with a chart, and a separate sheet for the Tiers. Use whichever fits. What matters more is that every score cites evidence.
What changed from CSF 1.1 to CSF 2.0?
The Govern Function was added, gathering strategy, roles, policy, oversight and supply-chain risk. The scope widened from critical infrastructure to organisations of every size and sector, and the old title was dropped. Categories were reorganised into 22, and NIST now publishes Implementation Examples, Informative References and Quick-Start Guides online, updated more often than the framework.
How does CSF 2.0 relate to SEBI CSCRF and ISO 27001?
SEBI’s Cybersecurity and Cyber Resilience Framework uses the same six function names and many of the same category codes (GV.OC, ID.AM, PR.AA and others), so a CSF assessment maps well onto it — see our SEBI CSCRF checklist. ISO 27001 is a certifiable management-system standard; NIST’s Informative References map CSF outcomes to standards, so one evidence set can serve all three. None replaces the others.
Sources
Checked by our research desk on 6 November 2026. Regulations and figures move; where a number here matters to a decision, follow it to the source.
- The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29) — NIST, 26 February 2024
- NIST releases version 2.0 of landmark Cybersecurity Framework — NIST, 26 February 2024
- Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 — NIST, 16 April 2018
- CSF 2.0 Quick-Start Guide for Using the CSF Tiers (SP 1302) — NIST, October 2024
- CSF 2.0 Quick-Start Guide for Creating and Using Organizational Profiles (SP 1301) — NIST, February 2024
- CSF 2.0 Profiles — Organizational Profile template — NIST
- Cybersecurity Framework resource centre — NIST
- Cybersecurity Framework — Frequently Asked Questions — NIST
- Cybersecurity and Privacy Reference Tool (CPRT) — NIST Computer Security Resource Center
- Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities — SEBI, 20 August 2024
Next step
A score you can defend, not one you hope holds.
Thirty minutes, no charge. Bring your self-assessment or nothing. You leave knowing which scores would survive an outside review, where evidence is missing, and whether an independent assessment is worth it — with a written scope and a fixed price if it is.