What is the NIST Cybersecurity Framework 2.0?

It is a free framework from the US National Institute of Standards and Technology (NIST) that describes the cybersecurity outcomes an organisation should aim for. The outcomes are organised into the functions Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0 added Govern, which covers strategy, roles, policy, risk management and supply-chain risk, and widened the framework from critical infrastructure to organisations of every size and sector. It is not a certification and does not prescribe tools; you describe your current profile, decide a target profile and plan how to close the gap, with implementation tiers describing how mature your approach is. European companies use it as a clear structure even though it is not EU law, often alongside ISO/IEC 27001 and NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., to which it maps well. Network detection belongs mainly under Detect, through continuous monitoring and analysis of adverse events, and supports Respond with information about what happened. NetSenX covers part of Detect on the segments it watches: beaconing, scanning, lateral movement and unusual outbound volume, on every plan. Govern, Protect and Recover need other measures.

← All 15 questions on Security standards: ISO 27001, SOC 2All topics