NIST Cybersecurity Framework 2.0: What Changed and What It Means for Indian Enterprises

Aug 7, 2026

Article by

Introduction

The Cybersecurity Framework (CSF) is published by the National Institute of Standards and Technology (NIST), an agency of the United States Department of Commerce. It is a voluntary set of guidelines that helps organisations understand, assess, prioritise and communicate their cybersecurity risks, regardless of their size, sector or level of technical maturity.

The CSF does not tell an organisation exactly which tools or controls to buy. Instead, it describes a set of desired outcomes and links these to existing standards, guidelines and practices that an organisation can use to achieve them. This makes it flexible enough to apply across industries and countries, which is one of the main reasons it has been adopted well beyond its original audience of United States critical infrastructure operators.

The first version of the CSF was released in 2014, following a Presidential Executive Order that asked NIST to develop a framework for reducing cyber risk to critical infrastructure. CSF 2.0, published on 26 February 2024, is the first major revision since then, reflecting a decade of change in technology, threats and cybersecurity practice.

What Has Changed in CSF 2.0?

A Wider Scope: The original framework was written for organisations responsible for critical infrastructure, such as energy, water and financial services. CSF 2.0 broadens this scope explicitly to cover organisations of all types and sizes, including small businesses, large enterprises, government agencies, schools and non-profits. The framework is now positioned as a general-purpose cybersecurity risk management tool rather than one aimed primarily at critical infrastructure operators.
The Addition of a Sixth Function: The most significant structural change in CSF 2.0 is the addition of a new function, GOVERN, alongside the original five: Identify, Protect, Detect, Respond and Recover. Previously, governance-related activities, such as setting cybersecurity strategy, defining roles and responsibilities, and establishing policy, were scattered across the other functions or left largely implicit. CSF 2.0 draws these together into a dedicated function that sits at the centre of the framework, because it shapes how the other five functions are carried out. Govern covers six areas: organisational context, risk management strategy, roles and responsibilities, policy, oversight, and cybersecurity supply chain risk management. By placing governance at the centre, NIST aims to ensure that cybersecurity cannot be treated purely as a technical function. It needs board-level ownership, clear accountability, and alignment with an organisation's broader enterprise risk management strategy.
Greater Emphasis on Supply Chain Risk: Cybersecurity Supply Chain Risk Management now has its own category within GOVERN. This reflects how much organisations today depend on external suppliers, vendors, cloud providers and partners, each of which can introduce risk into an organisation's environment. CSF 2.0 asks organisations to understand, prioritise and monitor these third-party relationships throughout their lifecycle, not only at the point of onboarding.
Restructured Categories and Subcategories: Several categories have been renamed, merged or reorganised to reflect current practice. For example, what was previously called "Business Environment" is now folded into "Organisational Context" under Govern, and a new "Platform Security" category has been introduced under Protect to cover the security of hardware, software and services across physical and virtual environments. NIST has also refreshed several subcategories to reflect areas such as identity management, data security and technology infrastructure resilience.
Organisational Profiles and Continuous Improvement: CSF 2.0 places more emphasis on the use of Organisational Profiles, which describe an organisation's current cybersecurity posture (Current Profile) and its desired future posture (Target Profile). Comparing the two helps an organisation identify gaps and build a prioritised action plan. This was present in earlier versions but is now explained in more depth, along with the concept of Community Profiles, which are shared baselines developed for a particular sector or use case.
Expanded Online Resources: Recognising that a static document cannot keep pace with a fast-changing threat landscape, NIST has expanded its suite of online resources that accompany the framework. These include Implementation Examples, which offer concrete, action-oriented steps for achieving each outcome, and Quick Start Guides, which are short, audience-specific guides on topics such as enterprise risk management and small business adoption. These resources are updated more frequently than the core document itself.

Why This Matters for Indian Enterprises

The CSF was written with a United States audience in mind, but its outcomes are sector-neutral, country-neutral, and technology-neutral. This is why the framework has found wide adoption among Indian enterprises, and why the changes in version 2.0 carry practical significance here as well.

Alignment with Global Client Expectations

A significant proportion of Indian IT, software development, and business process outsourcing (BPO) services are delivered to U.S.-based clients. These clients often require their vendors to demonstrate alignment with the NIST Cybersecurity Framework as part of contractual security and compliance obligations. Adopting NIST CSF therefore enables Indian companies to meet client expectations, strengthen trust, and remain competitive in the global outsourcing market.

Alignment with Indian Regulatory Expectations

Indian regulators have not mandated the NIST framework, and it carries no certification of its own. However, its influence is visible in the structure of several domestic regulatory frameworks. The Reserve Bank of India's Cyber Security Framework for banks, first issued in 2016 and since supplemented through various circulars and master directions, asks regulated entities to build board-approved cybersecurity policies, maintain round-the-clock monitoring, and follow structured incident reporting timelines, themes that map closely to the Govern, Detect and Respond functions of CSF 2.0. Similar principles run through SEBI's cybersecurity and cyber resilience guidelines for market participants.

For enterprises handling personal data, the Digital Personal Data Protection Act, 2023 requires reasonable security safeguards and timely breach notification, obligations that align naturally with the Protect and Respond functions of the CSF.

One Framework, Several Compliance Outcomes

Many Indian enterprises, particularly in banking, healthcare and software services, are required to satisfy multiple frameworks at once: ISO/IEC 27001 for information security management, sector-specific regulatory requirements at home, and increasingly, data protection obligations under the DPDP Act. Because the CSF's outcomes map cleanly onto the control areas of ISO 27001, and the safeguards expected under Indian data protection law, a well-built CSF profile can reduce duplicated effort. Rather than running separate compliance exercises for each requirement, an organisation can use a single Current and Target Profile as the foundation for several audits and regulatory conversations.

A Practical Starting Point, not a Certification

It is worth being clear about what the CSF is not. There is no certifying body and no formal audit. What it offers is a shared structure for organising a cybersecurity programme, understanding where gaps exist, and setting a realistic path toward improvement. For Indian enterprises building or maturing a cybersecurity function, this structure to understand the current state, define a target state, and close the gap through a prioritised plan offers a practical and internationally recognised starting point.

Getting Started with CSF 2.0

Organisations beginning this journey typically follow a similar sequence: assess the current state of cybersecurity practices against the six functions to build a Current Profile, define a realistic Target Profile based on business risk and regulatory obligations, identify the gap between the two, and use that gap analysis to prioritise investment and action. Progress is then tracked using the four Implementation Tiers, which range from Partial (Tier 1) to Adaptive (Tier 4), giving the organisation a consistent way to measure and communicate improvement over time.

Conclusion

CSF 2.0 does not reinvent cybersecurity risk management, but it does reflect ten years of lessons learned since the framework was first published. The addition of the Govern function, the sharper focus on supply chain risk, and the broader applicability beyond critical infrastructure all point to the same underlying shift that cybersecurity is now understood as an enterprise-wide responsibility.

For Indian enterprises navigating an increasingly complex mix of regulatory expectations, from RBI and SEBI guidelines to the DPDP Act, CSF 2.0 offers a common structure that can support all these conversations at once. Organisations that take the time to build a Current and Target Profile today will be better placed to demonstrate maturity, close gaps efficiently and communicate cyber risk clearly, whether to a regulator, a customer or their own board.