NIST CSF Checklist: A Function-by-Function Guide to CSF 2.0

Short answer: A NIST CSF checklist walks through the six CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover) and their 22 Categories, records which outcomes you already achieve in a Current Profile, sets the outcomes you want in a Target Profile, and turns the difference into a prioritized plan. CSF is voluntary and outcome-based, so the checklist measures results, not specific tools.

Related guides:

• What is NIST CSF and why is it important?
• NIST Implementation Tiers
• NIST CSF vs ISO 27001: what's the difference

Key takeaways

• CSF 2.0 was published by NIST on February 26, 2024 as CSWP 29. It added a sixth Function, GOVERN.
• The framework has six Functions and 22 Categories. Use the Category list as your checklist backbone and the Subcategories as detail.
• Work in Profiles: a Current Profile (what you achieve now) and a Target Profile (what you want to achieve). The gap between them is your roadmap.
• Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorous your risk governance and management are. They are a target you choose, not a score to maximize.
• For each item, record evidence, an owner and a status. A checklist without evidence will not survive a customer review.

Before you start: is NIST CSF mandatory?

For most private companies, no. The CSF 2.0 document describes itself as something organizations may adopt voluntarily, while noting that governments can also require it through policy.

That shapes how you should use this checklist:

• There is no certification. Nobody issues a "NIST CSF certified" badge. You demonstrate alignment through your Profiles, evidence and, if customers ask, an independent assessment.
• It is outcome-based. CSF describes outcomes such as "assets are managed" rather than prescribing controls. Informative References map those outcomes to standards like NIST SP 800-53 and ISO/IEC 27001 when you need control-level detail.
• It fits any size. NIST publishes a set of Quick Start Guides, including one for small businesses and one for building Organizational Profiles, which are good companions to this checklist.

Step 1: How do you scope a Current Profile?

Pick what the Profile covers, then record which CSF outcomes you achieve today for that scope.

CSF 2.0 defines a Current Profile as one that "specifies the Core outcomes that an organization is currently achieving (or attempting to achieve)" and a Target Profile as one that "specifies the desired Core outcomes that an organization has selected and prioritized."

Scoping checklist:

• Decide the scope: the whole company, one product, or one environment such as production.
• List the business drivers: customer contracts, regulations such as HIPAA, insurer requirements, board expectations.
• Name a Profile owner and the people who will rate each Function.
• Choose a simple rating scale for each outcome, for example: not started, partial, achieved.
• Agree where evidence will live so every rating links to proof.

Keep the first scope narrow. In our experience a focused Profile for your production SaaS environment produces a more useful plan than an all-company Profile that nobody finishes.

Step 2: GOVERN checklist

GOVERN sets the context, strategy and accountability that shape how you carry out the other five Functions, so rate it first.

Category	Check that you can show...
Organizational Context (GV.OC)	Your mission, stakeholders and legal, regulatory and contractual requirements are understood and documented
Risk Management Strategy (GV.RM)	Risk appetite, priorities and assumptions are agreed and used in decisions
Roles, Responsibilities, and Authorities (GV.RR)	Named owners for cybersecurity, with leadership accountability and resources
Policy (GV.PO)	A cybersecurity policy that is approved, communicated, reviewed and enforced
Oversight (GV.OV)	Leadership reviews results of the risk program and adjusts strategy
Cybersecurity Supply Chain Risk Management (GV.SC)	Suppliers are identified, prioritized, assessed and monitored for cybersecurity risk

For a small team, GOVERN evidence often fits in a handful of documents: an approved security policy, a risk appetite statement, a RACI for security roles, minutes from a quarterly leadership review, and a vendor register with risk ratings.

Step 3: IDENTIFY and PROTECT checklist

IDENTIFY tells you what you have and what could go wrong. PROTECT covers the safeguards that keep it secure.

IDENTIFY

• Asset Management (ID.AM): inventories of hardware, software, services, data and data flows, with owners.
• Risk Assessment (ID.RA): threats, vulnerabilities and likely impacts are identified and risks are prioritized.
• Improvement (ID.IM): lessons from assessments, tests and incidents feed back into the program.

PROTECT

• Identity Management, Authentication, and Access Control (PR.AA): unique identities, strong authentication, least-privilege access and periodic access reviews.
• Awareness and Training (PR.AT): staff receive security training suited to their roles.
• Data Security (PR.DS): data is protected at rest and in transit, and backups are created and tested.
• Platform Security (PR.PS): hardware, software and services are configured, patched and maintained securely, with logs generated.
• Technology Infrastructure Resilience (PR.IR): networks and environments are protected and capacity supports availability needs.

Asset Management is usually the weakest item for growing SaaS companies. Without a current inventory of cloud resources, endpoints and SaaS tools, almost every other Category is hard to prove.

Step 4: DETECT, RESPOND and RECOVER checklist

These three Functions cover finding incidents, handling them and getting back to normal operations.

DETECT

• Continuous Monitoring (DE.CM): networks, users, devices and services are monitored for anomalies and potential attacks.
• Adverse Event Analysis (DE.AE): alerts are analyzed, correlated and escalated when they indicate an incident.

RESPOND

• Incident Management (RS.MA): an incident response plan exists, is executed and incidents are triaged and prioritized.
• Incident Analysis (RS.AN): investigations establish what happened and the root cause.
• Incident Response Reporting and Communication (RS.CO): internal and external stakeholders, including regulators where required, are notified.
• Incident Mitigation (RS.MI): incidents are contained and eradicated.

RECOVER

• Incident Recovery Plan Execution (RC.RP): recovery actions restore systems and data, and integrity is verified before return to service.
• Incident Recovery Communication (RC.CO): recovery progress is communicated to stakeholders.

Test these with a tabletop exercise at least once before you rate them as achieved. A plan that has never been rehearsed is a plan on paper only.

Step 5: Which Tier should you target?

Choose the Tier your risk and resources justify, not the highest one available.

CSF 2.0 names four Tiers: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive. They describe the rigor of your cybersecurity risk governance and management practices. NIST's Tiers Quick Start Guide explains how to apply them to your Profiles.

A practical way to choose:

• Early-stage SaaS selling to SMBs: aim for Tier 2 first. Risk-informed decisions with documented practices are a big step up from ad hoc work.
• SaaS or HealthTech vendors selling to enterprises or health systems: Tier 3 is a common target, because buyers expect repeatable, policy-driven processes that run between audits.
• Organizations with mature programs and high exposure: Tier 4 may be justified where you need to adapt continuously to new threats.

Your Target Tier can differ by Function. Plenty of teams target Tier 3 for PROTECT and RESPOND while accepting Tier 2 for parts of GOVERN in their first year.

Step 6: How do you turn gaps into an action plan?

Compare the Current and Target Profiles, then prioritize the gaps by risk, effort and buyer demand.

1. List every gap. Any outcome rated below its target becomes a line item.
2. Score each gap. Use your risk method to estimate impact and likelihood. Our guide to a risk assessment matrix shows a simple approach.
3. Assign owners and dates. Each gap needs one owner and a realistic target date.
4. Map to other frameworks. If you also pursue SOC 2 or ISO 27001, check which gaps those programs already close so you do not duplicate work.
5. Review on a schedule. Re-rate the Current Profile after major changes and at least at each leadership review under GV.OV.

How SecureSlate helps

SecureSlate includes NIST CSF as a built-in framework, mapped to SOC 2, ISO 27001, HIPAA and the other frameworks you run, so one control can satisfy several outcomes.

• Multi-framework control mapping shows where your existing SOC 2 or ISO 27001 controls already cover CSF Categories.
• Agentless, read-only cloud integrations and a device agent help with asset and configuration evidence for IDENTIFY and PROTECT.
• Access reviews, vendor risk management and risk management workflows produce evidence for PR.AA, GV.SC and ID.RA.
• Audit management keeps evidence, owners and due dates for every gap in one place.

Start your free SecureSlate trial

FAQ

How many Categories are in NIST CSF 2.0?

CSF 2.0 has 22 Categories across six Functions: six in GOVERN, three in IDENTIFY, five in PROTECT, two in DETECT, four in RESPOND and two in RECOVER. Each Category is broken into more specific Subcategories.

Can you be certified against NIST CSF?

No. There is no official NIST CSF certification. Organizations show alignment with documented Profiles and evidence, and some commission an independent assessment when customers ask for one.

Is CSF 1.1 still usable?

CSF 2.0 replaced 1.1 as NIST's current version in February 2024. If your program was built on 1.1, map it to 2.0 and pay particular attention to the new GOVERN Function and the expanded supply chain Category.

How long does a NIST CSF assessment take?

For a small or mid-sized SaaS company with a focused scope, building a first Current Profile often takes a few weeks of part-time effort. The time depends mostly on how much evidence already exists.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.