A common language for cyber risk.
The NIST Cybersecurity Framework (CSF) 2.0 gives leaders and security teams a shared way to understand, assess and improve cyber security. Cybergen assesses your current profile, agrees a target and builds the roadmap between them.
NIST Cybersecurity Framework 2.0
Answer the question every board asks
How mature is our security programme, where are our biggest gaps and what should we invest in next? The NIST CSF, published by the US National Institute of Standards and Technology, organises that conversation into six functions that work for any size or sector.
Version 2.0, released in February 2024, added a Govern function at the centre, putting cyber security strategy, roles, policy and supply chain risk management alongside the technical work. There is no NIST certificate: the value is in the clarity it brings.
The whole programme on one page
Strategy, roles, policy, oversight and supply chain risk management.
Assets, risks and improvement opportunities are understood.
Safeguards for identity, data, platforms and people.
Possible attacks and compromises are found and analysed.
Action is taken on detected incidents.
Assets and operations are restored after an incident.
See the gap. Plan the journey.
A current profile shows where you are. A target profile reflects your risks and priorities. The difference becomes your roadmap.
Assess once. Map to many.
The CSF works alongside other frameworks and regulations rather than replacing them. We map your assessment to the standards you care about, so one piece of work supports certification, regulation and customer assurance.
Cyber risk your board can act on
We turn technical findings into a clear executive view: where you are, where you are going, what it will take and how progress will be measured each quarter.
- Executive report and prioritised roadmap
- Clear owners, milestones and measures
- Quarterly progress reviews
What a NIST assessment looks like
Can we get NIST certified?
No. The NIST CSF is a voluntary framework and there is no certification. Organisations use it to assess and communicate their security posture and plan improvements.
What changed in CSF 2.0?
Version 2.0, published in February 2024, added the Govern function, broadened the framework for organisations of all sizes and sectors, and expanded guidance on supply chain risk and implementation.
Is NIST CSF relevant to UK organisations?
Yes. It is widely used internationally, especially by organisations with US customers or operations and those wanting a common way to report cyber risk.
How does this differ from your Cyber Risk and Maturity Assessment?
Our risk and maturity assessment can use several frameworks and combines maturity with risk scenarios. A NIST engagement focuses specifically on CSF 2.0 profiles and reporting.
How long does an assessment take?
It depends on scope and the number of stakeholders and evidence involved. We agree the scope and timeline during scoping.
Know where you stand. Know what's next.
Tell us about your security programme and what your leadership needs to know. We will scope a NIST CSF assessment around it.
Thanks, we've received your enquiry
A member of our team will be in touch shortly.