Evidence you already keep
Reuse control evidence from FISMA, FedRAMP or CMMC work instead of collecting it again.
Platform →- Home
- NIST CSF 2.0
NIST CSF 2.0 outcomes, proven with evidence
CSF 2.0 describes outcomes rather than prescribing controls, so the work is proving each outcome with evidence. NISTcompliance.ai lets you show CSF outcomes with the evidence you already collect for FISMA, FedRAMP or CMMC, from one evidence base.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
What NISTcompliance.ai does
Outcomes you can prove
Continuous monitoring
Evidence collected on a schedule and mapped to your controls, so the record never goes stale between assessments.
Continuous monitoring →Assessor workspace
Evidence and history your assessor can trace, with access you control.
Assessor workspace →Functions
Six functions, 22 categories, 106 subcategories
Category and subcategory counts are taken from the CSF 2.0 Core in CSWP 29, Appendix A.
Govern
6 categories, 31 subcategories. Context, risk strategy, roles, policy, oversight and supply chain.
Identify
3 categories, 21 subcategories. Assets, risk assessment and improvement.
Protect
5 categories, 22 subcategories. Identity and access, awareness, data, platform and resilience.
Detect
2 categories, 11 subcategories. Continuous monitoring and adverse event analysis.
Respond
4 categories, 13 subcategories. Incident management, analysis, communication and mitigation.
Recover
2 categories, 8 subcategories. Recovery plan execution and communication.
Sources: NIST CSWP 29, NIST release. Sources checked Oct 23, 2026. Not a substitute for the official text.
Tier 1Partial
Tier 2Risk Informed
Tier 3Repeatable
Tier 4Adaptive
Sources: NIST CSWP 29. Sources checked Oct 23, 2026. Not a substitute for the official text.
Profiles
Current, Target and Community
CSWP 29FACT
Current Profile
The Core outcomes your organization is achieving today.
CSWP 29FACT
Target Profile
The outcomes you have selected and prioritized to reach.
CSWP 29FACT
Community Profile
A baseline of outcomes published to address the shared interests of a sector or community.
Sources: NIST CSWP 29. Sources checked Oct 23, 2026. Not a substitute for the official text.
Mappings and guides
The resources NIST has published
OLIRFACT
CSF to SP 800-53 5.2.0
NIST's informative reference catalog includes a CSF 2.0 to SP 800-53 Release 5.2.0 mapping.
CATALOGFACT
More than 50 documents
NIST's informative references catalog cross-references the CSF to more than 50 other cybersecurity documents.
SP 1308FACT
Enterprise risk and workforce
Quick Start Guide for cybersecurity, enterprise risk management and workforce, finalized March 23, 2026.
SP 1347FACT
Informative references
Quick Start Guide explaining informative references, finalized August 25, 2026.
SP 1353FACT
AI for CSF work
A draft Quick Start Guide on using AI for CSF analysis and reporting, published August 19, 2026. Comments closed October 15, 2026.
Sources: Informative References, NIST release, SP 1308 announcement, SP 1347 announcement, SP 1353 draft. Sources checked Oct 23, 2026. Not a substitute for the official text.
Questions
Common questions
What changed from CSF 1.1?
CSF 2.0 added the Govern function, bringing the total to six functions, and expanded its guidance with Quick Start Guides and informative references.
Is CSF 2.0 still the current version?
Yes. As of October 2026, NIST's CSF page shows 2.0 as current.
Book a demo
Prove your CSF outcomes
We will show how your existing evidence base supports your CSF work.