Overview
The NIST Cybersecurity Framework (CSF) 2.0 is organized into Functions, Categories, and Subcategories, offering a clear hierarchy to assess and improve cybersecurity posture. This article outlines how the framework is structured and how it supports maturity assessments in the Cye Exposure Management Platform.
Structure of the NIST CSF 2.0 Framework
Functions: The highest level — there are six functions in CSF 2.0
Categories: Each function contains multiple outcome-focused categories (22 in total)
Subcategories: Each category contains more granular subcategories, which are individually assessed in the Cye Exposure Management Platform
Functions > Categories > Subcategories
This layered model helps organizations work from strategic goals down to specific actions.
The Six NIST CSF 2.0 Functions
Function | Purpose |
Govern | Establish cybersecurity oversight and risk management strategy |
Identify | Understand assets, risks, and resources |
Protect | Implement safeguards to prevent or contain incidents |
Detect | Identify and analyze potential threats and breaches |
Respond | Take action to manage and mitigate incidents |
Recover | Restore operations and improve future resilience |
Example Subcategory
Subcategory: All users are informed and trained [PR.AT-1]
Focus: Employee awareness and preparedness
Expectation: Users should be trained to recognize and report risks
Why it matters: Without a clear training and reporting structure, an organization loses a vital layer of defense
Subcategories like this are where maturity ratings are assigned in the Cye Exposure Management Platform. Each one is evaluated based on how well the organization has implemented related controls, policies, and procedures.
Wrap-up / Next Steps
Understanding how the framework is structured — from functions to subcategories — helps approach the maturity assessment in a thoughtful, strategic way. Use the subcategories as checkpoints for improvement and deeper analysis.