The NIST Cybersecurity Framework 2.0 (released February 26, 2024) structures an organization's cybersecurity into 6 high-level functions and 23 categories. This reference table is the most widely used matrix worldwide to map cyber posture. This article delivers the complete table with tactical control examples, prioritization matrix, and category cross-mapping.
Overview: 6 functions
| Function | Code | Purpose |
|---|---|---|
| Govern | GV | Establish, communicate and oversee cyber strategy (new in CSF 2.0) |
| Identify | ID | Understand assets, risks, dependencies |
| Protect | PR | Implement safeguards |
| Detect | DE | Quickly identify an incident |
| Respond | RS | Contain and treat |
| Recover | RC | Restore and improve |
Complete table — 23 categories
Govern (6 categories)
| Code | Category | Tactical control example |
|---|---|---|
| GV.OC | Organizational Context | Mapping of missions, stakeholders, regulatory requirements |
| GV.RM | Risk Management Strategy | Risk management policy, appetite, tolerance |
| GV.RR | Roles, Responsibilities, Authorities | Cyber RACI, cyber competence at executive level |
| GV.PO | Policy | Approved cyber policy, annually reviewed |
| GV.OV | Oversight | Executive KPIs, performance indicators |
| GV.SC | Cybersecurity Supply Chain Risk Management | Supplier evaluation, contracts, subcontracting |
Identify (3 categories)
| Code | Category | Tactical control example |
|---|---|---|
| ID.AM | Asset Management | Up-to-date CMDB (hardware, software, data, services) |
| ID.RA | Risk Assessment | EBIOS RM, ISO 27005, FAIR — periodic evaluation |
| ID.IM | Improvement | Lessons learned from incidents and exercises |
Protect (5 categories)
| Code | Category | Tactical control example |
|---|---|---|
| PR.AA | Identity Management, Authentication, Access Control | MFA, SSO, privileged account management |
| PR.AT | Awareness & Training | Quarterly simulated phishing, role-specific training |
| PR.DS | Data Security | At-rest, in-transit encryption, HSM keys |
| PR.PS | Platform Security | OS hardening, CIS baselines, patch management |
| PR.IR | Technology Infrastructure Resilience | Network redundancy, DRP, fallback sites |
Detect (2 categories)
| Code | Category | Tactical control example |
|---|---|---|
| DE.CM | Continuous Monitoring | SIEM, EDR, NDR, behavioral analysis |
| DE.AE | Adverse Event Analysis | 24/7 SOC, IOC analysis, threat hunting |
Respond (4 categories)
| Code | Category | Tactical control example |
|---|---|---|
| RS.MA | Incident Management | Crisis cell, RAPID framework |
| RS.AN | Incident Analysis | Forensic, root cause, scope |
| RS.CO | Incident Response Reporting & Communication | CSIRT notification, internal/external comms |
| RS.MI | Incident Mitigation | Isolation, containment, eradication |
Recover (3 categories)
| Code | Category | Tactical control example |
|---|---|---|
| RC.RP | Incident Recovery Plan Execution | Backup restoration, DRP, tests |
| RC.CO | Incident Recovery Communications | Return-to-normal communication |
| RC.IM | Improvements | Plan updates with AAR |
Prioritization matrix for an SME (NIS2 essential/important)
An SME cannot cover everything at once. Here is a pragmatic prioritization matrix:
| Priority | Categories to cover first | Rationale |
|---|---|---|
| P1 (3 months) | GV.PO, GV.RM, ID.AM, PR.AA, RS.MA | Policy, risk, assets, access, incident — the 5 fundamentals |
| P2 (6 months) | GV.SC, ID.RA, PR.DS, DE.CM, RC.RP | Supply chain, detailed assessment, data, monitoring, recovery |
| P3 (12 months) | GV.RR, GV.OV, PR.AT, PR.PS, PR.IR, DE.AE, RS.AN, RS.CO, RS.MI, RC.CO | Full coverage |
| Continuous | GV.OC, ID.IM, RC.IM | Context monitoring + continuous improvement |
Cross-mapping NIST CSF 2.0 ↔ NIS2 ↔ DORA ↔ ISO 27001
| NIST CSF 2.0 | NIS2 Art. 21 | DORA | ISO 27001 |
|---|---|---|---|
| GV.OC, GV.PO | (a) policies | Art. 5 | A.5.1 |
| GV.RM | (a) policies + risk | Art. 6 | A.5.4 |
| GV.SC | (d) supply chain | Art. 28 | A.5.19 |
| ID.AM, ID.RA | (b) handling, (c) BCP | Art. 8 | A.8.1, A.5.7 |
| PR.AA | (j) MFA + ACS | Art. 9 | A.5.15, A.8.2 |
| PR.DS | (h) crypto | Art. 9 | A.8.24 |
| DE.CM, DE.AE | (e) detection | Art. 10 | A.8.16 |
| RS.MA, RS.CO | (b) reporting + (c) BCP | Art. 17 | A.5.24 |
| RC.RP, RC.IM | (c) crisis & continuity | Art. 11 | A.5.30 |
See our complete NIST CSF 2.0 guide and DORA vs NIS2.
How ResiPlan automates cross-mapping
The Multi-framework Mapping module (/features/multi-framework-mapping) provides:
- Pre-wired mapping NIST CSF 2.0 ↔ ISO 27001 ↔ NIS2 ↔ DORA ↔ ANSSI EBIOS RM.
- Coverage dashboard (% per category).
- Automatic gap detection (control claimed in one framework but no evidence).
- One-click multi-framework compliance reports.
Start a free ResiPlan trial — your coverage matrix in 1 day.