Compliance & Regulation
ISO 27001 Certification: A Practical Guide for 2026
What the 2022 edition actually asks of you, how the certification audit works, and the six decisions that determine whether you certify in five months or fifteen.
Key takeaways
- CSF 2.0 was published by NIST in February 2024 and is designed for organisations of every size and sector.
- It adds a sixth function, Govern, alongside Identify, Protect, Detect, Respond and Recover.
- Supply chain risk management and cybersecurity strategy now sit explicitly under governance.
- Profiles and tiers turn the framework into a measurable current-to-target roadmap.
Why version 2.0 matters
The original NIST Cybersecurity Framework was written for US critical infrastructure. It became a global reference anyway, because it gave boards and security teams a shared language. Version 2.0, published in February 2024, formally widens the audience to all organisations, regardless of size, sector or country.
The framework remains voluntary and outcome-based. It tells you what good looks like, not which products to buy, and it points to other standards — ISO 27001, the CIS Controls, NIST SP 800-53 — for implementation detail.
The headline change: Govern
CSF 2.0 introduces a sixth function, Govern, which sits at the centre of the other five. It captures things that were previously implicit or scattered:
- Organisational context — mission, stakeholder expectations and legal obligations
- Risk management strategy, appetite and tolerance
- Roles, responsibilities and authorities
- Policy
- Oversight — reviewing whether the strategy is working
- Cybersecurity supply chain risk management
The practical effect is that cybersecurity is framed as an enterprise risk owned by leadership, not a technical function reporting through IT. If your board cannot describe your cyber risk appetite, Govern is where to start.
The structure at a glance
| Function | What it answers |
|---|---|
| Govern | How is cybersecurity risk directed, owned and overseen? |
| Identify | What assets, suppliers and risks do we have? |
| Protect | What safeguards reduce the likelihood and impact of incidents? |
| Detect | How do we find attacks and anomalies quickly? |
| Respond | What do we do when an incident is detected? |
| Recover | How do we restore operations and learn from what happened? |
Beneath the six functions sit 22 categories and 106 subcategories. NIST also publishes implementation examples, quick-start guides for small businesses and a searchable online reference tool that maps each subcategory to other standards.
Other meaningful changes
- Supply chain risk now has its own category under Govern, reflecting how many recent breaches started with a supplier.
- Continuous improvement is emphasised across the functions, not treated as an annual exercise.
- Implementation examples make abstract outcomes concrete — useful when explaining a gap to a non-specialist.
- Community profiles allow sectors to publish shared target states that individual organisations can adopt and adapt.
How to use CSF 2.0 in practice
The framework is most useful when it becomes a roadmap rather than a checklist. A proven approach:
- Build a Current Profile. Rate each relevant subcategory based on evidence, not opinion. Interviews help; configuration and records settle arguments.
- Agree a Target Profile. Leadership decides the level of capability the business actually needs, informed by risk appetite, regulation and customer expectations.
- Choose a tier. Tiers — Partial, Risk Informed, Repeatable and Adaptive — describe how rigorously risk is managed overall. Most organisations aim for Repeatable before Adaptive.
- Prioritise the gaps. Rank by risk reduction per unit of cost and effort, not by the order they appear in the framework.
- Report in business terms. Show the board movement from current to target over time, with named owners and dates.
What this means if you already use ISO 27001
CSF 2.0 and ISO 27001 complement each other. ISO gives you a certifiable management system; CSF gives you an outcome view that boards and regulators find easy to read. Mapping your ISO controls to CSF subcategories typically shows strong coverage in Protect and Identify, and gaps in Govern — particularly around formal risk appetite and supplier oversight.
Pitfalls when adopting CSF 2.0
- Treating it as a checklist. Scoring every subcategory without agreeing a target produces a long report and no roadmap.
- Self-assessment without evidence. Optimistic ratings feel good but mislead leadership and regulators alike.
- Skipping Govern. Technical improvements stall when risk appetite, ownership and oversight are not defined.
- Aiming for Adaptive everywhere. The highest tier is expensive and rarely justified across the whole organisation.
- Ignoring suppliers. Supply chain risk now sits in the framework's core; excluding it leaves a visible gap.
A focused first cycle — current profile, target profile, prioritised roadmap and quarterly reporting — delivers more value than an exhaustive assessment that nobody acts on.
Frequently asked questions
Is NIST CSF 2.0 mandatory?
No. It is voluntary guidance. However, many regulators, customers and insurers reference it, which makes it a practical baseline even where it is not required.
Do we need to redo our CSF 1.1 assessment?
Not from scratch. Most existing mappings carry over, but you should assess the new Govern function and supply chain category, and refresh your profiles against the updated subcategories.
Can small organisations use CSF 2.0?
Yes. NIST publishes small-business quick-start guides, and the framework is explicitly intended for organisations of any size.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
