Skip to main content
Add as a preferred source on Google


NIST Cybersecurity Framework Gets First Refresh

The National Institute of Standards and Technology (NIST) has released an update to its Cybersecurity Framework — the first since the guidance document was issued in 2014.

Cybersecurity Framework (CSF) 2.0's biggest change is the scope. While the government agency's original framework focused on securing critical infrastructure, 2.0 expands to include guidance for all organizations and enterprises — no matter their size or focus. NIST said the expansion was due to public sentiment on expanding the purpose of the Cybersecurity Framework to help provide personalized guidance for all against current threats.

[Click on image for larger view.] Figure 1. Breakdown of what is new in the Cybersecurity Framework 2.0.

"The CSF has been a vital tool for many organizations, helping them anticipate and deal with cybersecurity threats," said Under Secretary of Commerce for Standards and Technology and NIST Director Laurie E. Locascio. "CSF 2.0, which builds on previous versions, is not just about one document. It is about a suite of resources that can be customized and used individually or in combination over time as an organization’s cybersecurity needs change and its capabilities evolve."

CSF 2.0 will provide quick-start guides for different types of organizations, implementation examples, and a suite of resources to assist in the adoption of the framework. New for 2.0 is the Reference Tool, designed to simplify the implementation process by allowing users to browse, search, and export information from the framework in both human and machine-readable formats.

Also arriving for 2.0 is a searchable catalog of informative references, enabling organizations to map their cybersecurity activities against the CSF and reference over 50 other cybersecurity documents. According to the government agency, the new resource expansion will be able to cater to both cybersecurity beginners and pros.

"As users customize the CSF, we hope they will share their examples and successes, because that will allow us to amplify their experiences and help others. That will help organizations, sectors and even entire nations better understand and manage their cybersecurity risk," said Kevin Stine, chief of NIST’s Applied Cybersecurity Division. 

About the Author

Chris Paoli (@ChrisPaoli5) is the associate editor for Converge360.

Featured

  • networked node grid featuring illuminated connectors

    Infrastructure Accounts for More than Half of Worldwide AI Spending

    Gartner forecasts worldwide AI spending will reach $2.67 trillion in 2026, up 49.5% from 2025, with AI infrastructure accounting for nearly $1.5 trillion, or about 56% of the total. For every dollar Gartner expects to be spent on generative AI models, more than $52 will be spent on infrastructure.

  • Abstract data center infrastructure

    Survey: Lack of Specialized Infrastructure Is a Top AI Adoption Challenge

    Enterprise AI projects are running into infrastructure questions as organizations move from planning toward deployment, according to a recent Digital Realty survey.

  • A glowing digital brain with neural connections and light trails

    AI Giants Warn It May Be Time to Slow Down

    For years, leaders in the artificial intelligence industry have warned that increasingly capable AI systems could eventually become dangerous, all the while continuing to race to build them. Now, their sentiments have changed.

  • man viewing holographic display of data and code

    Why Cross-Skilling Is the Smartest Investment a Campus IT Team Can Make

    Higher education IT teams are being asked to keep pace with AI, cloud, and cybersecurity on flat budgets, and hiring a specialist for every new need can no longer keep up. Building adjacent skills across the people already on staff creates more agile, resilient teams that move faster and retain talent without adding headcount. Pluralsight makes the strategy work through skill assessments, tailored learning paths, hands-on labs and sandboxes, and microlearning that fits into the flow of work.