Framework · Cyber risk governance
Sightadel guides you through the six functions of the NIST Cybersecurity Framework 2.0 – with industry templates drawn from many years of consulting and certification practice, AI that helps with wording, and real consultants for the difficult parts.
What it is about
The Cybersecurity Framework (CSF) of the US National Institute of Standards and Technology is a voluntary framework. It describes which outcomes an organisation should achieve in managing cyber risk – not which tools to use. This makes it suitable for any size and sector.
Version 2.0 was published in February 2024. It organises the framework into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new. Strategy, roles, policies and supply chain risk are thus visibly at the centre, instead of being spread across other functions. Beneath them are 22 categories and 106 subcategories.
With profiles you describe your current and target state; with tiers you describe the maturity of your risk management. There is no certificate. The value lies in a common language: management, the supervisory board and insurers understand where you stand without having to read clauses of a standard.
IT reports in technical terms; the board needs priorities. Six functions with current and target state make gaps and progress understandable.
Cyber insurers and international customers use the CSF as a reference. A well-maintained profile answers their questionnaires faster and more consistently.
ISO 27001, NIS2 or DORA are already on the table. The CSF serves as an umbrella under which measures and evidence from all frameworks can be managed consistently.
Requirements
Summarised in our own words. The original text in its current version is always authoritative.
Organisational context, risk management strategy, roles and responsibilities, policy, oversight and supply chain risk management.
In SightadelGuiding questions lead to risk strategy and roles. Templates provide drafts for policies; you set objectives and risk appetite yourself.
Know assets, systems, data and dependencies, assess risks and derive improvements.
In SightadelRisk register with assessment and treatment, linked to measures. You assess service providers in the Vendors module.
Manage identities and access, build awareness, secure data and platforms, make infrastructure resilient.
In SightadelEach subcategory as a guided question with answer options. Training and access reviews run as recurring cycles with evidence.
Continuously monitor systems and activities, analyse and classify adverse events.
In SightadelYou link reports from monitoring and vulnerability scans to the subcategory. Expiry dates show when a piece of evidence is out of date.
Manage, analyse and contain incidents and communicate about them internally and externally.
In SightadelTemplates for incident process and communication. The activity log shows completely who decided what and when.
Restore operations after an incident in a planned way and communicate about the recovery.
In SightadelYou plan recovery tests as a cycle. Lessons learned become action plans with owners and due dates.
Describe the current state and the target state for each subcategory and prioritise the gap.
In SightadelThe current profile is created as you answer. The dashboard shows the status per function; open gaps appear under Issues.
Classify how governed and repeatable cyber risk management actually is – from partial to adaptive.
In SightadelYou classify the tier with reasoning. Sightadel records the reasoning so that next year's comparison rests on the same basis.
Process
Two to four months to a reliable current and target profile. Closing the gaps is an ongoing task, not a project with an end date.
The whole organisation or one area, internal management or evidence for third parties. This determines how deep you go.
Clarify risk strategy, roles and responsibilities. Without this basis, the other functions cannot be assessed meaningfully.
Work through all subcategories step by step, assess them honestly and link existing evidence. Templates and AI provide drafts; you decide.
Set the target state per function and rank gaps by risk. Not everything has to reach the highest tier.
Gaps become action plans with owners and due dates. You file evidence with an expiry date.
Present the status to management and the supervisory board, have it audited externally if desired and update the profile regularly.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
Technical measures without a risk strategy and roles cannot be prioritised sensibly. First clarify mission, risk appetite and responsibilities.
A flattering profile will be exposed at the latest by the insurer or an external review. Require evidence for every positive rating.
The tiers describe the nature of governance overall, not the degree of implementation of an individual subcategory. Keep the two separate and give reasons for the classification.
A target profile without prioritisation is a wish list. Derive the target from risks and obligations and have management approve it.
The supply chain category carries considerably more weight in version 2.0. Assess important service providers systematically instead of just filing contracts.
A profile that is only touched once a year is out of date in between. Plan recurring evidence as cycles with an expiry date.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
Almost every subcategory has an equivalent in Annex A or clauses 4 to 10. If you run an ISMS, you can fill large parts of the current profile from existing evidence.
NIS2Govern corresponds to management accountability, Respond to the reporting obligations, Protect to the risk management measures. The CSF does not replace NIS2, but organises it well.
DORAICT risk management, incident handling, testing and third-party risk are reflected in the six functions. DORA obligations such as the register of information come on top.
SOC 2Both come from the US. The CSF shows management the maturity level; SOC 2 gives customers an audited report. You use the evidence for both.
Audit and evidence
There is no certification and there are no accredited bodies for the NIST CSF. Most organisations assess themselves. If you want to show the supervisory board, insurers or customers an independent opinion, have the profile reviewed externally. Sightadel does not assess. You choose an auditor from our independent partner network or one of your choice. No commission is paid for audits – neither to us nor to the partners.
External auditors get their own access in Sightadel to answers, reasoning and evidence and can never delete anything. Through the Trust Center, you show customers and partners your frameworks, documents and security posture – without filling in a questionnaire afresh each time.
To the independent auditor networkCSF 2.0 consists of three building blocks. The Core organises desired cybersecurity outcomes into six functions, 22 categories and 106 subcategories. Each subcategory describes an outcome, for example that roles and responsibilities for cyber risk are established and communicated. How you achieve this outcome is left open by the framework.
Profiles describe the state of an organisation along the Core. The current profile records what has been achieved today, the target profile what is to be achieved. The gap between them is your work programme. In addition, there are community profiles, which sectors or interest groups create as a shared baseline.
The tiers classify how rigorous and repeatable cyber risk management is governed overall. There are four: Partial, Risk Informed, Repeatable and Adaptive. They are explicitly not a maturity model for each individual subcategory, but describe the nature of governance.
In addition, NIST publishes implementation examples for the subcategories online, quick-start guides for smaller businesses and mappings to other frameworks, including NIST SP 800-53 and ISO 27001. These supplementary resources are updated continuously and available free of charge. In Sightadel, functions, categories and subcategories are set up as guided questions; the current profile is created as you answer.
A framework from the US might at first seem out of place in Europe. In practice, many companies use it nonetheless, for three reasons. First, as a language for management: six functions are easier to understand than more than ninety controls from Annex A of ISO 27001. A supervisory board can do more with the sentence “Detect is at tier two, the target is three” than with a list of open controls.
Second, as an answer to questions from outside. Cyber insurers, international corporate customers and US partners often use the CSF to structure their questionnaires. If you have a well-maintained profile, you answer them faster and more consistently.
Third, as an umbrella for several frameworks. If you work with NIS2, ISO 27001 and customer requirements at the same time, you can bundle the measures under the six functions and report an overall status. The CSF alone does not fulfil legal obligations. It replaces neither NIS2 nor DORA nor a certificate. Its value lies in governance and communication.
For small organisations, the CSF is a good starting point because it does not prescribe which documents must exist. If you start small, tackle Govern first and the categories that affect your own business most.
The framework itself is free; there is no certification fee. The Sightadel licence for the NIST CSF is charged monthly per edition, with discounts for multiple frameworks and advance payment. You can find all prices and a calculator on our pricing page.
The internal effort depends mainly on how deep you go. A first current profile for a mid-sized organisation can be done in a few weeks if information security, IT operations and someone from management work together. It takes more effort if reliable evidence is required for every assessment, for example because an external auditor or an insurer is to confirm the profile.
An external review is voluntary. If you want one, the auditor invoices their work directly to you. It depends on the scope, the number of sites and whether only the profile or also the effectiveness of the measures is reviewed. For difficult individual questions, you can book consulting as a package in the app.
The current profile is only worth as much as its honesty. In practice, people like to assess what is intended, not what is actually happening. A draft policy is not an implemented outcome; a test carried out once is not a repeatable process.
A simple rule has proven itself: every rating above “partially implemented” needs evidence. This can be a record, a report from a tool, a sample or a resolution. In Sightadel, you link the evidence directly to the subcategory and give it an expiry date. If it expires, the status on the dashboard drops until new evidence is available.
The reasoning is just as important. Anyone reassessing next year will want to know why a subcategory was considered largely implemented at the time. Sightadel records answers, comments and evidence with dates, so that comparisons over the years rest on the same basis.
You mark subcategories that do not apply to you as not applicable, with reasoning. That is legitimate, but should remain the exception. A profile in which a third of the items are hidden raises more questions for auditors and insurers than it answers.
The target profile is a business decision, not a technical one. It derives from your objectives, your risks, legal obligations and customer expectations. Not every subcategory has to be fully implemented, and not every organisation needs the Adaptive tier.
A practical approach: first determine the subcategories that are mandatory by law or contract. Then those that address the greatest risks to your most important processes. Only after that comes the rest. This produces a list that management can understand and back with a budget.
In Sightadel, gaps between current and target become action plans with an owner and a due date. The dashboard shows how far you have come per function. For boards, one page is often enough: status per function, the three most important gaps, progress since the last report.
Also record which gaps you deliberately do not close. A documented risk acceptance by management is a legitimate outcome. It shows auditors and insurers that the decision was made and did not simply get left behind. Do not forget to review it after a year.
The CSF is not a project with an end date. Threats, systems and business change, and the profile has to keep up. Most organisations carry out a full reassessment once a year and update in between as needed, for example after an incident, an acquisition or the introduction of an important platform.
For ongoing evidence, it helps to plan recurring activities as cycles: access reviews, training, restore tests, vulnerability scans, supplier assessments. Each run produces evidence with a date. If it is missing, Sightadel reminds you before the gap shows up in the report.
The Govern function requires management to oversee cyber risk. In practice, this means regular reports to management and the supervisory board, documented decisions on risk acceptance and budget, and a clear owner. The activity log in Sightadel shows who decided what and when. Through the Trust Center, you share your status with customers and partners without answering every questionnaire afresh.
If you want an external opinion, have the profile assessed at regular intervals by an independent auditor. The auditor gets their own access in Sightadel to answers, reasoning and evidence, can comment and does not have to request folders by email.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Working materials
Checklists and templates for other frameworks are available under Resources.
Practical aids, not legal advice.
Terms
No. The CSF is a voluntary framework without certification. You can assess your profile yourself or have it reviewed externally. If you need a certificate, combine the CSF with ISO 27001.
As a common language. The six functions make the maturity level understandable for management, the supervisory board and insurers. US customers and partners also often ask about it.
Above all, the Govern function for strategy, roles, policies and supply chain risk. In addition, the framework is now explicitly aimed at all organisations, not just critical infrastructure.
ISO 27001 is certifiable, NIS2 is a legal obligation, the CSF is a framework. The content overlaps strongly. In Sightadel, you link a piece of evidence once and use it for all three.
With Govern and an honest current profile. A profile rated too favourably helps nobody, not even in discussions with the insurer.
No. The target profile depends on your risks and your business. For many organisations, a middle tier is appropriate. What matters is that the choice is justified.
The licence is charged per framework and edition; you can find all prices and a calculator on our pricing page. There is no certification fee. Costs for an external review only arise if you want one, and are invoiced independently by the auditor.
Four tiers that describe how rigorous and repeatable cyber risk management is governed: Partial, Risk Informed, Repeatable and Adaptive. They are not a rating of individual subcategories, but an overall picture of governance.
The original is published in English; NIST also provides translations into other languages on its website. In Sightadel, functions, categories and subcategories are set up as questions in our own words, while the original identifiers such as GV.SC are kept for orientation.
There is no obligation; the CSF is voluntary. However, version 2.0 is the current edition, and partners such as insurers increasingly refer to it. If you have a profile based on 1.1, map it to the new categories and add above all Govern and the supply chain.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
