NIST Cybersecurity Framework (CSF 2.0)
Readiness for the NIST Cybersecurity Framework 2.0: a Current Profile of where you stand across all six Functions, including the new Govern Function, a Target Profile agreed with leadership, a gap assessment and a prioritized roadmap delivered through managed IT.
Overview
The NIST CSF does not tell you what to buy. It tells you what good looks like, and makes you write it down.
The NIST Cybersecurity Framework is a common language for cyber risk, designed for organizations of every size and sector, in industry, government, academia and the nonprofit world. Version 2.0, published in February 2024, organizes outcomes into six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new, and it is the one leadership notices: it asks whether cybersecurity strategy, roles, policy, oversight and supply chain risk management are established and monitored, not only whether the technical controls exist.
The framework describes outcomes, not a checklist, so the work is deciding what those outcomes mean for you. We start with a Current Profile: which CSF outcomes your organization achieves today and to what extent, drawn from the systems and the evidence rather than from opinion. With leadership we agree a Target Profile, the outcomes you choose to achieve given your risks, obligations and budget. The gap between the two becomes a prioritized action plan, and the managed IT program is how most of it gets done: MFA, encryption, patching, logging, detection and response, tested backups and documented procedures.
The CSF is voluntary for most organizations, but it is often what boards, insurers, public-sector customers and larger clients have in mind when they ask how you manage cyber risk. A Current Profile you can show them, and a plan to close the gaps, answers that question honestly. A Target Profile can also set out what you expect of your own suppliers.
Capabilities
What's included
- ScopingWhich parts of the organization the Profile covers, from the whole organization to a defined set of systems, agreed at the start.
- Current ProfileWhere you stand on each CSF outcome across the six Functions, assessed from your systems, documents and interviews, with the evidence noted.
- Target ProfileThe outcomes you choose to achieve, agreed with leadership and shaped by your risks, obligations and any frameworks you already follow.
- Gap assessment and prioritized roadmapThe differences between the two Profiles, ranked by risk, with an action plan and an owner for each item.
- Govern Function supportCybersecurity roles, policy, risk strategy, oversight reporting and supplier risk set up so leadership can show it is in charge.
- Implementation through managed ITIdentity, data protection, patching, logging, detection, response and recovery outcomes delivered and evidenced by the program that runs your systems.
- Progress reportingThe Profiles updated as gaps close, with a short report for leadership or the board.
How It Works
Delivered through managed IT
Most Protect, Detect, Respond and Recover outcomes map to things the managed IT program already does or can be configured to do, and our management platform records the evidence as the systems run. The Govern and Identify work, including policy, roles, risk strategy and the Profiles themselves, is done with your leadership and kept current in your documentation.
Why Atlas
Secure. Reliable. Responsive.
Flat monthly fee
Predictable per-device pricing. No surprise invoices and no hourly meter running while your team waits for help.
Proactive, not reactive
Monitoring, patching, and automation run around the clock — so most issues are resolved before your staff ever notice them.
Responsive & accountable
One team that knows your environment and answers fast. You reach a real technician, not a ticket queue in another time zone.
Month-to-month
We earn your business every month. No multi-year lock-in — you stay because the service works, not because a contract traps you.
Common Questions
Questions we get asked
What changed in NIST CSF 2.0?
The biggest change is a sixth Function, Govern, covering organizational context, risk management strategy, roles and responsibilities, policy, oversight and cybersecurity supply chain risk management. CSF 2.0 is also written explicitly for organizations of all sizes and sectors rather than critical infrastructure alone, and NIST publishes supporting resources alongside it, including Quick Start Guides, Community Profiles and Informative References that map the CSF to other standards.
Is there a NIST CSF certification?
No. NIST does not assess or approve organizations against the framework, and there is no official CSF certificate. The framework is a set of outcomes that you profile yourself against. What you can show a board, insurer or customer is a documented Current Profile, a Target Profile and a plan for the gap, with evidence behind each. We prepare those with you; nobody stamps them.
What are Current and Target Profiles?
A Current Profile records which CSF outcomes your organization is achieving today and to what extent. A Target Profile records the outcomes you have chosen and prioritized, taking into account your risks, obligations and plans. The gap between them is the work, and NIST suggests documenting it as a prioritized action plan, such as a risk register or a plan of action and milestones.
What are the CSF Tiers, and do we need to pick one?
The Tiers describe how rigorous your cybersecurity risk governance and management are: Partial, Risk Informed, Repeatable and Adaptive. Using them is optional, and NIST presents them as a way to inform your Profiles rather than a score to chase. Many organizations use them to describe where they are and where leadership wants to be, which helps set realistic expectations for the roadmap.
We already follow HIPAA, CMMC or PCI DSS. Why add the CSF?
You may not need it as a separate effort. The CSF is outcome-based and maps to other standards through NIST's Informative References, so the controls you run for another framework count toward its outcomes. Many organizations use it as an umbrella that leadership can understand, with the stricter framework underneath. We profile against the CSF using the evidence you already collect.
How long does a CSF assessment take?
It depends on scope. A Profile for a defined set of systems is a much smaller job than one for the whole organization, and the framework expects you to scope it either way. The plan and timeline are agreed after a short scoping conversation. Closing the gaps then runs as part of managed IT, with the Profiles updated as items are completed.
References
Standards referenced
Secure. Reliable. Responsive.
Book a consultation and we’ll map out a managed IT plan for your business, or email contact@atlasbm.net.