NIST Cybersecurity Framework 2.0: From Assessment to Organisational Resilience
The NIST Cybersecurity Framework (CSF) is the most widely used cybersecurity framework in the United States and has become globally influential as a practical tool for managing cybersecurity risk. Version 2.0, released in February 2024, introduced a sixth function — Govern — reflecting the maturation of cybersecurity into a board-level, enterprise-wide risk management concern. This guide explains how to implement CSF 2.0 to reduce cybersecurity risk, improve resilience, and communicate your security posture to leadership.
The Six Functions of NIST CSF 2.0
NIST CSF 2.0 organises cybersecurity activities into six core functions:
Govern (GV): NEW in v2.0. Establishes the organisational context for cybersecurity risk management — cybersecurity strategy, roles and responsibilities, policy, oversight, supply chain risk management, and cybersecurity programme governance. This function recognises that cybersecurity risk management requires leadership commitment and organisational governance, not just technical controls.
Identify (ID): Developing an organisational understanding of cybersecurity risk to systems, people, assets, data, and capabilities. Asset management, risk assessment, improvement activities.
Protect (PR): Implementing appropriate safeguards to ensure delivery of critical services. Identity management, authentication, access control, awareness training, data security, platform security, technology infrastructure resilience.
Detect (DE): Developing activities to identify the occurrence of a cybersecurity event. Continuous monitoring, adverse event analysis.
Respond (RS): Developing activities to take action regarding a detected cybersecurity incident. Incident management, incident analysis, incident response reporting, communication, mitigation, improvements.
Recover (RC): Developing activities to restore capabilities impaired by a cybersecurity incident. Incident recovery plan execution, communication during recovery.
Current Profile vs. Target Profile: The Gap Analysis Approach
The core operational tool of the NIST CSF is the Current Profile / Target Profile gap analysis:
Current Profile: An assessment of your organisation's current state against the CSF outcomes — what practices are in place, how mature they are, and where gaps exist. Developed through interviews, documentation reviews, and technical assessments.
Target Profile: Where your organisation needs to be, based on business objectives, risk tolerance, regulatory requirements, and the threat landscape relevant to your sector. Not necessarily full implementation of all CSF outcomes — but the outcomes material to your risk management needs.
Gap Analysis: Comparing the Current Profile to the Target Profile to identify the gaps — the practices that are missing or insufficiently mature. Gaps are then prioritised by risk impact and implementation effort.
Improvement Roadmap: A time-bounded plan for closing prioritised gaps, with specific actions, owners, timelines, and resource requirements. This becomes the organisation's cybersecurity improvement programme.
This profile-based approach is what distinguishes the CSF from a compliance checklist — it is fundamentally a risk management tool, not a pass/fail framework.
Using NIST CSF for Board-Level Cybersecurity Communication
One of CSF 2.0's most important contributions is providing a common language for communicating cybersecurity risk to boards and executive leadership. The Govern function explicitly addresses this need.
Cybersecurity risk as business risk: The CSF helps translate technical cybersecurity findings into business risk terms — likelihood of threat scenarios, impact on business objectives, comparison to risk appetite, and investment required to reach acceptable risk levels.
Dashboard reporting using CSF functions: Many organisations use the six CSF functions as the structure for board cybersecurity reporting — showing the maturity level and status of each function and the risk implications of gaps.
Risk appetite alignment: The CSF's target profile mechanism forces a conversation between cybersecurity and leadership about what level of risk the organisation is willing to accept — a governance conversation that the Govern function now explicitly requires.
NIST CSF for Regulated Industries
Regulators across multiple sectors reference or require NIST CSF alignment:
US Financial Services (FFIEC): The FFIEC Cybersecurity Assessment Tool maps directly to NIST CSF and is used by bank examiners to assess cybersecurity maturity.
Healthcare (HHS): HHS has published guidance mapping HIPAA Security Rule requirements to NIST CSF, making CSF the practical implementation framework for HIPAA.
Energy (NERC CIP): NERC CIP requirements for bulk electric system operators align to CSF functions, and NERC has published CSF mapping guidance.
Nigerian Sector Regulations: CBN and NITDA cybersecurity frameworks both reference international frameworks including NIST CSF as appropriate implementation guidance for Nigerian financial and technology organisations.
Insurance and third-party risk: Cyber insurance underwriters increasingly use NIST CSF maturity levels as rating factors, and enterprise risk teams use CSF assessments as part of vendor risk evaluations.
Why Organisations Choose Savadub
Deep GRC Expertise
Our team holds practitioner-level expertise across every major compliance framework — not just theoretical knowledge, but hands-on implementation experience across multiple industries and organisation sizes.
Engineers, Not Just Consultants
We implement controls, not just recommend them. Our GRC engineers configure the systems, write the integrations, and build the monitoring pipelines that make compliance operational.
Global and African Regulatory Coverage
We understand both the global frameworks and the African regulatory environment — NDPR, NDPA, CBN directives, NITDA guidelines, and regional data protection laws — making us uniquely positioned for organisations operating across Africa and internationally.
Internal and External Audit Capability
We provide both embedded internal audit functions and independent third-party audit support, including CPA-accredited audit coordination for SOC examinations.
End-to-End Engagement
From initial gap assessment through certification, continuous monitoring, and ongoing compliance management — we are your long-term GRC partner, not a one-time consultant.
Industries We Serve
Financial Services · Healthcare · Technology & SaaS · Manufacturing · Logistics & Trade · Government & Public Sector · Energy & Critical Infrastructure · Education & EdTech · Media & Broadcasting · Retail & E-Commerce · Professional Services · Food & Beverage
Deliverables You Receive
Working with Savadub, every engagement delivers a concrete set of outputs:
- Gap Assessment Report — prioritised findings with effort estimates and risk ratings
- Compliance Roadmap — milestone-based plan from current state to certification or attestation
- Risk Register — organisational risk register with treatment plans
- Policy Pack — all required policies authored, reviewed, and approved
- Technical Control Implementation Evidence — configurations, screenshots, and audit trails
- Internal Audit Report — independent assessment of control effectiveness
- Audit Evidence Repository — organised, auditor-ready evidence collection
- Executive Summary Presentation — board and leadership-ready compliance status
- Remediation Tracker — structured tracking of open findings and closure evidence
- Continuous Monitoring Setup — ongoing CCM pipeline for post-certification compliance
Get Started with Savadub
Savadub's GRC practice combines deep compliance expertise with technical engineering capability. We don't just advise — we build, implement, and operate your compliance program from the ground up.
Book a free GRC consultation with our team. We will review your current posture, identify your most critical gaps, and give you a clear, costed roadmap to compliance.
Contact us:
- Email: grc@savadub.com
- Phone: +234 816 734 2201
- WhatsApp: +234 903 234 8435
- Website: www.savadub.com
