The NIST CSF 2.0 is a voluntary, outcomes-based taxonomy for cybersecurity risk management. The latest version's new Govern function links security efforts to enterprise risk management and operational reliability. That's what matters for critical infrastructure. Begin by creating a Current Profile for a single mission critical system, then map gaps to the outcomes you can't yet demonstrate.
TL;DR:
- There are 6 Functions, 22 Categories, and 106 Subcategories within the Core. Profiles define current and desired state. Informative References provide mappings to standards that address outcomes.
- Segmentation, rigorous change control and passive monitoring are practical fits for brittle OT. Air-gap anything you can't patch, and lock-down access instead of betting on uptime.
- Expect 4–8 weeks for a first assessment. Scope creep will impact timing, so pilot with one service before rolling out to other services and suppliers.
- Treat reused monitoring data, change tickets and access logs as forensic evidence, then convert each gap you find into a funded action with owner, due date, and metric.
- CSF 2.0 isn't a detailed standard like SP 800-53. Map outcome gaps to actionable engineering requirements using its Reference Tool.
PODTECH
Build disaster-proof infrastructure software
PODTECH builds tailor-made software, automation, and smart building monitoring solutions for mission-critical infrastructure and operational technology environments. Learn more about PODTECH
Table of Contents
- What does the NIST CSF 2.0 Core contain?
- Why does CSF 2.0 matter for critical infrastructure?
- How do you apply CSF 2.0 step by step?
- How do you align CSF 2.0 with OT and safety constraints?
- What does a realistic implementation roadmap look like?
- Where should you start with NIST resources?
- Why governance and operations must meet
- How can PODTECH help you implement CSF 2.0?
- FAQ
- Sources
What does the NIST CSF 2.0 Core contain?
CSF 2.0 groups cybersecurity outcomes into a taxonomy you can drop into board briefings without translation. According to NIST CSWP 29, the Core consists of 6 Functions, 22 Categories and 106 Subcategories. The six Functions are:
- Govern: sets risk strategy, roles, policy and oversight.
- Identify: understands assets, suppliers and risks.
- Protect: safeguards assets and limits the impact of an event.
- Detect: finds anomalies and possible compromises.
- Respond: acts on a detected incident.
- Recover: restores services and normal operations.
Two more ideas fill out the picture. Profiles indicate where you are (Current) and where you want to be (Target). Informative References tie each Subcategory to actual standards, allowing the framework to remain a taxonomy of outcomes instead of a list of controls.
Why does CSF 2.0 matter for critical infrastructure?
The framework is designed around what energy, water, transport and data centre leaders already care about: uptime, safety and regulatory attention. Three shifts matter most.
- Govern becomes part of the Core. According to NIST, Govern means that cybersecurity risk management is embedded within enterprise risk management, positioning cyber risk as an operational risk that is core to the business. It holds leadership accountable, rather than just security personnel.
- Suppliers receive explicit consideration. CSF 2.0 guidance emphasizes supply chain and supplier criticality scores, even providing example Subcategories related to supplier management. If a vendor's controller or monitoring solution is on your critical path, it should be in scope.
- Security should not outweigh reliability. NIST's OT guidance recommends a risk-based approach balancing security with reliability, safety and real-time performance.
Together, these shifts turn CSF from a security-team exercise into an operating-risk conversation.
How do you apply CSF 2.0 step by step?
NIST's Cybersecurity Framework (CSF) 2.0 publication advocates using Profiles, the Reference Tool together with Informative References to develop a prioritised action plan. Here's how that works in practice:
- Scope the Profile. Identify mission-critical assets, OT boundaries, and the services impacted if each were to be lost. Just one service is fine to start, like a cooling plant or substation.
- Create a Current Profile. For each Subcategory that applies, document what you do today and attach proof: configurations, logs, test results, executed policies.
- Build a Target Profile. Rank desired outcomes by mission risk given stated risk appetite. Not all Subcategories should have the same level of ambition.
- Link to Informative References with the Reference Tool. When creating links to Informative References such as SP 800-53 within Subcategories, use the CSF 2.0 Reference Tool to provide engineers tangible requirements.
- Create a time-boxed roadmap. Convert every gap into an actionable objective with funding, an owner, a due date and a metric by which to measure (coverage %, mean time to detect, etc.).
Tip: Gather evidence from systems that already gather it (monitoring, change tickets, access logs) instead of creating new documentation. Pilot the entire life cycle around a single service before expanding.
Teams looking to operationalise gap prioritisation can also use a pilot project to activate a risk register.
How do you align CSF 2.0 with OT and safety constraints?
Controls designed for office IT get punished in OT environments. Applying a routine patch on a laptop could stop a line. Remember these limits:
- Safety: a control must never defeat a safety function or interlock.
- Real-time performance: added latency or scanning load can disrupt control loops.
- Availability: many systems cannot be rebooted outside planned outages.
- Equipment lifecycles: vendor hardware often outlives software support by many decades.
SP 800-82 provides guidelines for mapping outcomes into OT-friendly controls. Network segmentation, strict change control, and passive monitoring allow you to achieve Protect and Detect outcomes while leaving fragile controllers untouched. Where patching is simply not an option on a legacy device, consider controls like increased isolation and stricter access to compensate. You can read about that here in our zero trust for OT roadmap.
Identity-first access for remote monitoring allows you to achieve the same. Check out our guide to identity first controls for remote monitoring.
What does a realistic implementation roadmap look like?
Plan in phases rather than one big programme:
- Assessment (4–8 weeks): scope, Current Profile and first gap view.
- Pilot: remediate and evidence one critical service end to end.
- Scale: extend to further services and suppliers.
- Sustain (ongoing): refresh Profiles, track metrics, report to leadership.
These are estimate numbers for planning purposes only; your specific scope will drive these timelines. You'll likely have a governance liaison, an OT engineer, security architect, evidence-collection tooling, and possibly an external integrator if internal resources are limited. Size of systems in scope, complexity of OT components, third-party remediation and continuous monitoring are your biggest price factors. Check out our phased industrial IoT security roadmap for a breakdown of how telemetry requirements map to a pilot.
Where should you start with NIST resources?
Everything you need is free and official:
- Download CSF 2.0 including Reference Tool and implementation examples from NIST Cybersecurity Framework.
- Use CISA's sector implementation guidance for templates and sector considerations.
- Take the self-assessment for the entire CSF Core prior to purchase. It will identify which outcomes you cannot currently evidence.
Then pick one critical service and run the pilot.
Why governance and operations must meet
The biggest challenge with CSF 2.0 is organisational rather than technical. If your Govern function doesn't engage with the operators running the plant, you'll end up with policies that cannot be implemented. The hard work is in risk owners and OT engineers agreeing on what “good” looks like for each service. Our engineering partners earn their keep by accelerating telemetry, integration and evidence automation with no negative impact on control reliability. CSF is an outcomes taxonomy, not a controls checklist. That allows you flexibility in selecting measures your operations can actually comply with.
“The hard work is in risk owners and OT engineers agreeing on what good looks like for each service.”
— Harry
How can PODTECH help you implement CSF 2.0?
Don't have OT integration capacity internally? Need to accelerate remediation? Let us handle the engineering efforts. We collaborate with critical infrastructure owners and operators to create the artifacts CSF requires:
- Master systems integration across BMS, PMS and NMS layers.
- Datacentre and OT telemetry that turns operating data into auditable evidence.
- Custom software and enterprise automation for evidence collection and remediation workflows.
- DCIM consultancy to map assets, dependencies and risk.
Book a scoping conversation/pilot engagement on our services page and we'll launch with one mission critical service.
FAQ
What is the NIST CSF 2.0 in simple terms?
NIST Cybersecurity Framework is a voluntary cybersecurity outcomes-based framework for risk management. Released by NIST in February 2024, the Framework Core is composed of 6 Functions, 22 Categories, and 106 Subcategories.
What is new in CSF 2.0 for critical infrastructure?
The most significant update is the addition of the Govern function, which ties cybersecurity efforts to enterprise risk management and executive accountability. Suppliers and supply chains also receive more explicit consideration in CSF 2.0.
How do I start a CSF 2.0 assessment?
Create a Current Profile against one key service and document evidence against each applicable Subcategory. The self assessment against the entire Core will highlight outcomes that you cannot yet provide evidence against.
Does CSF 2.0 replace standards like SP 800-53?
No. CSF is an outcomes taxonomy. Informative References (i.e. SP 800-53) provide the underlying controls. You map them to each other using the Reference Tool.
Sources
- CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 | CSRC
- SP 800-82 Rev. 4, Guide to Operational Technology (OT) Security | CSRC
Assessment Readiness: NIST CSF 2.0 Training and Certification Self Assessment
From Certified Information Security | NICCS