NIST CSF 2.0 explained: how to answer it from the ISO/IEC 27001 system you already run

A customer questionnaire arrives with one line that stops the week: "Please confirm your alignment with the NIST Cybersecurity Framework 2.0." The organisation runs an information security management system for ISO/IEC 27001:2022. It has a risk register, a Statement of Applicability and an evidence register that an auditor accepted six months ago. Now someone has to decide whether that answers the question, or whether a second project has just started.

It answers the question. This article explains what NIST CSF 2.0 is, what changed in the 2.0 edition, and how to show alignment from the ISMS you already run, without building a second control set.

What NIST CSF 2.0 is

The Cybersecurity Framework is published by the US National Institute of Standards and Technology. Version 2.0 came out in February 2024 and replaced version 1.1. It is free to download and free to use, and that matters for how it spreads: boards, insurers, customers and sector regulators across many countries ask about it because it costs nothing to point at.

It is not a management system standard and nothing is certified against it. It describes outcomes, the things an organisation should be able to say are true about its cybersecurity, and leaves the "how" to the organisation. The outcomes sit in six functions, 22 categories and 106 subcategories. Two further ideas carry most of the practical weight: profiles, which record which outcomes you achieve today and which you intend to achieve, and tiers, four levels that describe how disciplined your risk governance is, from partial to adaptive.

Where ISO/IEC 27001 is a certifiable set of requirements for running a system, the CSF is a shared vocabulary for describing a security posture. One is audited; the other is answered.

What changed in 2.0

Three changes matter to an ISO/IEC 27001 team. The framework now addresses any organisation of any size in any sector, not only critical infrastructure. A sixth function, Govern, was added and placed at the centre: strategy, roles, policy, oversight and supply-chain risk are now named outcomes rather than assumptions. And supply-chain risk management, which used to sit inside Identify, became a category of its own under Govern, which tells you where questionnaires are heading next.

The six functions, and what already answers them

Read each function as a question and most ISMS teams will recognise their own documents in the answer.

Govern asks whether cybersecurity is directed and overseen. The ISMS answers with its context and scope, the policy and objectives, the assigned roles, the risk method, supplier controls and the management review.

Identify asks whether you know what you have and what could go wrong. The asset inventory, the risk assessment and the risk register answer it, together with the improvement actions that come out of audits and incidents.

Protect asks whether the safeguards are in place. This is where most of the Annex A controls live: access, awareness and training, data security, platform security and the resilience of the technology itself.

Detect asks whether you would notice an attack. Logging, monitoring and the analysis of events answer it, and this is where many ISMS implementations are thinnest.

Respond asks what happens when you do notice. The incident management process, its roles, communications and lessons-learned record answer it.

Recover asks whether the business comes back. Backups, restore testing and the continuity and disaster recovery plans answer it, which is also where a business continuity management system for ISO 22301 does more of the work than the ISMS.

Answering the questionnaire from one system

Keep the ISMS as the system of record. Do not open a second risk register or a second set of policies labelled "NIST". Every control still has one owner, one piece of evidence and one review date.

Build a crosswalk at category level first. Twenty-two rows: for each CSF category, the ISMS clauses and the Annex A controls, by number, that deliver it. A category-level map takes an afternoon and answers most questionnaires. Go to subcategory level, 106 rows, only when a customer or regulator asks for it.

Derive the current profile from the Statement of Applicability. The statement already says which controls apply and whether they are implemented. Read through the crosswalk, that becomes the list of CSF outcomes you achieve today. The evidence register supplies the proof behind each one.

Set the target profile from the risk register and the objectives. The outcomes you do not yet achieve, and have decided you should, are your target profile. If they are not already in the treatment plan, that is a finding against the ISMS, not against the framework.

Expect three gaps. Supply-chain outcomes are broader in the CSF than most supplier controls cover. Detection outcomes assume monitoring that many small ISMS implementations run lightly. Recovery outcomes reach into continuity planning. None of these needs a new system; they need the existing one to say more.

Treat tiers as a description, not a score. A tier records how risk-informed and repeatable your governance is. Choose the one that is true, write down why, and let it improve through the management review. Claiming a higher tier than the evidence supports creates the finding the questionnaire was trying to avoid.

Label the mapping as your own. NIST publishes informative references, and several organisations publish crosswalks. Yours is still your interpretation of your controls. Record the framework edition, the ISO/IEC 27001 edition, the mapping version, who reviewed it and when, so it can be defended and updated.

Where awareness fits

This is the last article of Cybersecurity Awareness Month, so one example. The CSF's awareness and training outcomes expect everyone to receive training suited to their work, and people in specialised roles to receive more. ISO/IEC 27001 covers the same ground in its competence and awareness clauses and in the Annex A awareness control. One programme, one attendance register and one set of effectiveness measures answer both, which is the crosswalk the free Cybersecurity Awareness Programme Kit already carries.

A note on using AI

An AI assistant can draft a first crosswalk quickly, and it will be wrong in places, because mappings are judgement. Use it to propose rows, then have the person who owns each control confirm them. Never let the assistant mark an outcome as achieved; that is a statement of fact about your organisation, and a named person makes it. Keep the AI-use log beside the mapping.

The free resources

The ISMS Starter Kit for ISO/IEC 27001:2022 includes a crosswalk to NIST CSF 2.0 at category level, labelled as a Brivellis mapping, alongside the Statement of Applicability and evidence register that feed the current profile. The awareness kit carries the awareness crosswalk, and the BCMS Starter Kit for ISO 22301 covers the recovery side. All three are free, with no sign-up, on brivellis.com. A readiness checklist for NIST CSF 2.0 follows in early November.