NIST CSF

1. 2026-10-16 High
   NIST removes open comment notice for SP 1353 ipd AI/CSF Quick-Start Guide from CSF landing page

   The NIST Cybersecurity Framework landing page has been updated, removing the prominent banner soliciting public comments (deadline: October 15, 2026) on Special Publication (SP) 1353 ipd, …

   Draft consultation Deadline 2026-10-15 Action required

2. 2026-09-18 High
   NIST adds draft CSF 2.0 Community Profile for Federal Agency O-RAN Deployment to public comment

   NIST has published a draft CSF 2.0 Community Profile for Federal Agency Open Radio Access Network (O-RAN) Deployment and opened it for public comment. The profile …

   Draft consultation Deadline 2026-10-15 Action required

3. 2026-08-12 Medium
   CISA releases K-12 Cybersecurity Foundations Resource Package with guides and video series

   CISA released the K-12 Cybersecurity Foundations Resource Package on August 12, 2026, providing guides, videos, and supplemental materials to help K-12 schools and districts prevent and …

   New document Action required

That is the last 90 days. Sign in to read further back.

1. 2026-10-15 Comment period closes on draft SP 1353, a CSF 2.0 quick-start guide for using AI for CSF analysis and reporting
2. 2026-08-25 Final SP 1347, CSF 2.0 Informative References Quick-Start Guide, published
3. 2026-03-23 Final SP 1308, CSF 2.0 quick-start guide on cybersecurity, enterprise risk management and workforce management, published
4. 2025-12-16 Preliminary draft of the Cyber AI Profile (NIST IR 8596), a CSF 2.0 community profile for AI, released for comment (closed 30 January 2026)

1. 2024-02-26
   CSF 2.0 Major versionCurrent

   First major update since 2014. source

   More

   • The scope expanded from critical infrastructure to all organizations.
   • A sixth function, Govern, was added to Identify, Protect, Detect, Respond and Recover, with more emphasis on governance and supply chains.
   • NIST also published a suite of supporting resources and, later, a CSF 1.1 to 2.0 core transition spreadsheet.
2. 2023-08-08
   CSF 2.0 (initial public draft) Draft

   Public draft of CSF 2.0 (CSWP 29); comments closed 6 November 2023. source

3. 2018-04-16
   CSF 1.1 Revision

   Refined and clarified Version 1.0, with updates on authentication and identity, self-assessing cybersecurity risk, managing cybersecurity within the supply chain and vulnerability disclosure. source

   More

   • Two drafts were circulated for comment before release.
4. 2017-12-05
   CSF 1.1 (second draft) Draft

   Second draft of Version 1.1 released for public comment. source

5. 2017-01-10
   CSF 1.1 (first draft) Draft

   First draft of Version 1.1 released for public comment. source

Most organizations use the CSF voluntarily; for US federal agencies it is mandatory.

Who it is for

Any organization can use the CSF. source

Voluntary

NIST is not a regulator, and most organizations use the CSF voluntarily. source

Customers and suppliers

Some companies require it of their customers or within their supply chain. source

Federal agencies

For US federal agencies it is mandatory: Executive Order 13800 orders each agency head to use the Framework, "or any successor document", to manage the agency's cybersecurity risk. source source

Outcomes

The CSF lists outcomes, not a checklist of actions. source

NIST offers no CSF certification; organizations describe current and target outcomes in CSF Profiles.

Certification

NIST does not offer certifications or endorsements of CSF-related products, implementations, or services, and there are no plans to develop a conformity assessment program. source

Profiles

Organizations describe the outcomes they currently achieve in a Current Profile and the outcomes they want to achieve in a Target Profile. source

NIST is not a regulatory agency. For federal agencies, obligations come from Executive Order 13800; some companies require the CSF of their customers or suppliers.

Not a regulator

NIST is not a regulatory agency. source

Federal agencies

For federal agencies, obligations come from Executive Order 13800 and the risk management reports it requires. source

Companies

Some companies require the CSF of their customers or within their supply chain. source

1. Standard The NIST Cybersecurity Framework (CSF) 2.0 – CSWP 29 (PDF)
2. Guidance CSF 2.0 publication page with supplemental resources and 1.1 to 2.0 transition spreadsheet
3. Guidance NIST SP 1347 – CSF 2.0 Informative References Quick-Start Guide (August 2026)
4. Guidance NIST SP 1308 – CSF 2.0 Cybersecurity, ERM and Workforce Management Quick-Start Guide (March 2026)
5. FAQ CSF Frequently Asked Questions

1. NIST SP 800-53

   SP 800-53 is a detailed control catalog; the CSF lists high-level outcomes and points to catalogs such as SP 800-53 as informative references.

2. ISO 27001

   ISO/IEC 27001 is a certifiable management-system standard; the CSF is a voluntary outcome framework with no certification.

3. CISA CPG

   CISA's Cross-Sector CPGs are a short, prioritised subset of practices aligned to the CSF 2.0 functions, aimed at smaller critical-infrastructure operators.

4. NIST SP 800-37

   SP 800-37 is the step-by-step Risk Management Framework for authorising federal systems; the CSF is an organization-level view of cybersecurity outcomes.

5. NIST AI RMF

   The AI RMF applies a similar function-based structure (Govern, Map, Measure, Manage) to AI risk rather than cybersecurity risk.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to NIST CSF (RSS)