NIST CSF 2.0: What has changed?

The NIST Cybersecurity Framework (CSF) 2.0 introduces desired outcomes to address cybersecurity risks alongside other business risks. These outcomes are sector-specific, technology-neutral, and can be mapped to security controls to mitigate risks effectively. The framework comprises the CSF Core, Organizational Profiles, and Tiers to characterize risk management practices. Significant updates in the final version of NIST CSF 2.0 include changes in functions, categories, and subcategories. Additionally, a comparison between NIST CSF 2.0 and ISO 27001:2002 is presented, highlighting potential cyber threats and security compromises.