NIST CSF 2.0

NIST Cybersecurity Framework 2.0
Govern, Identify, Protect, Detect, Respond, Recover

NIST CSF 2.0 is the global standard for aligning cybersecurity investments to business risk. ThreeShield delivers maturity assessments, remediation roadmaps, and continuous Lavawall® monitoring across all six CSF functions.

NIST CSF 2.0: The Six Functions

CSF 2.0 added Govern as a sixth function, recognizing that cybersecurity governance is foundational to all other functions.

Govern (GV)

Establish and monitor cybersecurity strategy, expectations, and policy. Board oversight, risk tolerance definition, and organizational context. New in CSF 2.0.

Identify (ID)

Understand assets, risks, and vulnerabilities. Asset management, risk assessment, supply chain risk, and business environment analysis.

Protect (PR)

Safeguards to prevent or limit cybersecurity impact. Access control, awareness training, data security, platform security, and technology resilience.

Detect (DE)

Identify cybersecurity events. Continuous monitoring, anomaly detection, and adverse event analysis.

Respond (RS)

Take action regarding a detected incident. Incident management, analysis, mitigation, and communication.

Recover (RC)

Restore capabilities after an incident. Incident recovery, communications, and restoration of services.

Maturity Tiers Matter

NIST CSF defines four tiers: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4). Most SMBs assess at Tier 1-2. Cyber insurers and enterprise clients increasingly expect Tier 2-3. ThreeShield's assessment includes explicit tier scoring per function with a roadmap to your target tier.

Frequently Asked Questions

NIST CSF is voluntary in most contexts, but it's referenced by US federal agencies, Canadian government procurement requirements, and many enterprise client security questionnaires. It's also the most common governance framework for organizations that need to demonstrate security maturity without a specific regulatory obligation.

NIST CSF is a governance meta-framework that maps to specific frameworks. Lavawall® can show your CSF compliance alongside CIS Controls, HIPAA, SOC 2, and ISO 27001 simultaneously - because many controls are shared across frameworks.

NIST CSF is a US-originated framework but has global adoption. Canadian critical infrastructure operators increasingly reference it. For US-facing businesses, enterprise clients, or government contractors, NIST CSF alignment is often expected. It also maps well to Canadian frameworks like the CCS (Canadian Centre for Cyber Security) baseline controls.

Get Your NIST CSF Maturity Score

ThreeShield delivers explicit tier scoring across all six CSF functions with a prioritized roadmap to your target maturity level. Lavawall® keeps your score current year-round.

Book a Scoping Call

DIY · Supported · Done-for-You · All engagement models available

Three Ways to Engage - From DIY to Done-for-You

Whether you have a strong internal team or need everything handled end-to-end, ThreeShield meets you where you are.

Self-Serve

DIY via Lavawall®

For lean IT teams and cost-conscious organizations with internal security capacity

  • Lavawall® platform access with GRC module
  • Automated evidence collection against NIST CSF
  • Live compliance score dashboard
  • Policy and procedure template library
  • Self-guided remediation workflows
  • AI-generated compliance status reports
Start with Lavawall®
Recommended for MSPs & Lean IT

Supported

For MSPs, IT teams with some security resources, and organizations that need expert guidance but retain internal capacity

  • Everything in DIY tier
  • CISSP/CISA-guided gap assessment
  • Prioritized remediation roadmap
  • Policy and procedure development support
  • Quarterly compliance review calls
  • Tier 3 escalation for complex issues
  • MSP white-label available
Get Supported Engagement
Fully Managed

Done-for-You

For organizations that want full compliance delivery without managing the process internally

  • Everything in Supported tier
  • ThreeShield manages the full compliance program
  • CISSP/CISA-executed formal assessment or audit
  • findings methodology (typically 200+ findings)
  • Complete policy and procedure creation
  • Audit-ready evidence packages
  • Annual reassessment included
Book Done-for-You Assessment