Most security advice tells you what to do. Frameworks tell you how to organize the doing. This article explains two widely cited ones, the US National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and the UK National Cyber Security Centre (NCSC) Cyber Assessment Framework, and what each can and cannot tell an organization.
What is a cybersecurity framework, and why use one?
A framework is a structured vocabulary for security work. It groups related activities, such as knowing what you own, protecting it, spotting trouble and recovering, so that technical staff, executives, auditors and suppliers can talk about the same thing in the same terms.
A framework is not a product, a law or a guarantee. It does not stop an attack by itself. Its value is in making gaps visible: if no one can say who is responsible for backups, or how a suspicious login would be noticed, a framework turns that silence into a line on a page that someone must fill in.
Both frameworks covered here are public and free to read. Neither prescribes a specific tool or vendor.
What did NIST publish in CSF 2.0?
NIST released version 2.0 of its Cybersecurity Framework (CSF) on February 26, 2024, according to NIST. The original framework appeared in 2014 after a presidential executive order and was aimed at critical infrastructure, meaning the systems society depends on, such as energy and finance. According to NIST, version 2.0 is designed for all organizations in any sector, from small schools and nonprofits to large agencies and corporations.
NIST describes the CSF as a taxonomy of high-level outcomes that any organization can use to understand, assess, prioritize and communicate its cybersecurity efforts, whatever its size, sector or maturity. Crucially, it does not prescribe how to reach those outcomes. Instead it links to online resources on practices and controls.
NIST also says it expanded the core guidance with more emphasis on governance and supply chains, and added supporting material:
- Quick-start guides for particular audiences, including small businesses, enterprise risk managers and organizations securing their supply chains.
- Implementation examples drawn from other organizations.
- A reference tool for browsing, searching and exporting the framework in human-readable and machine-readable formats.
- A searchable catalog that maps the framework to more than 50 other cybersecurity documents, including NIST Special Publication 800-53 Revision 5.
Which six functions make up the CSF core?
The heart of the framework is its “core,” organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover. In plain terms:
| Function | Plain-language question it answers |
|---|---|
| Govern | Who decides our cybersecurity strategy, and how does it fit our wider business risks? |
| Identify | What systems, data and suppliers do we depend on, and what could go wrong? |
| Protect | What safeguards keep attackers and mistakes from causing harm? |
| Detect | How would we notice that something had gone wrong? |
| Respond | What do we do once an incident is confirmed? |
| Recover | How do we restore normal operations and learn from it? |
Govern is the new addition in version 2.0. According to NIST, it covers how an organization makes and carries out informed decisions about cybersecurity strategy, and it treats cybersecurity as an enterprise risk that senior leaders should weigh alongside concerns like finance and reputation. NIST’s own graphics place Govern at the center of the other five.
The plain-language questions in the table are a simplified reading for this article, not NIST’s wording; the framework’s detailed outcomes are far more granular.
What is the NCSC Cyber Assessment Framework?
The Cyber Assessment Framework (CAF) comes from the NCSC, part of the UK’s signals intelligence agency GCHQ. According to the NCSC, it is the UK’s approach to assessing and improving cyber resilience, focused on systems that support essential functions or critical services. The NCSC states that it is not a certification scheme.
The NCSC says the CAF is used by organizations in sectors regulated under the UK’s network and information systems rules and wider critical national infrastructure, by government, and by other sectors where operational resilience matters. Organizations outside those groups can also use it as a structured approach to managing cyber risk. The NCSC lists version 4.0, published April 18, 2024, and marks the page for review on October 30, 2026. As of November 6, 2026, that review date has just passed, so readers should check the NCSC’s page for any newer version.
How is the CAF structured?
According to the NCSC, the framework has four objectives, which break down into 14 principles. Each principle is divided into lower-level “contributing outcomes,” which together make up 41 assessments. The four objectives are:
- Managing security risk: governance, risk management, asset management and supply chain security.
- Protecting against cyber attack: protecting systems, data and services from compromise.
- Detecting cyber security events: identifying malicious activity and potential incidents.
- Minimising the impact of cyber security incidents: preparing for, responding to and recovering from incidents.
Each contributing outcome comes with “indicators of good practice,” which the NCSC says guide expert judgment and are not an exhaustive or mandatory checklist.
Are the two frameworks competitors?
Not really, though they are built for different jobs. The CSF is mainly a shared language for describing and prioritizing outcomes. The CAF is mainly an assessment tool: it asks an assessor to judge whether specific outcomes are met.
| Feature | NIST CSF 2.0 | NCSC CAF 4.0 |
|---|---|---|
| Publisher | NIST (US) | NCSC (UK) |
| Main structure | Six functions | Four objectives, 14 principles |
| Primary use | Describing, prioritizing and communicating security outcomes | Assessing whether outcomes are achieved |
| Intended audience | Organizations in any sector | Essential-service operators, with wider use possible |
| Certification | The pages reviewed describe none | The NCSC says it is not a certification scheme |
Their themes overlap in an obvious way. The CAF’s “managing security risk” objective echoes the CSF’s Govern and Identify functions, and its detection and impact objectives cover similar ground to Detect, Respond and Recover. That comparison is an editorial reading rather than an official mapping, and the two documents split topics differently.
How does the CAF decide whether an outcome is met?
The NCSC describes the CAF as “outcome-based.” Rather than listing steps to follow, it describes what an organization must achieve, and an assessor judges whether each outcome is met in that organization’s own context. The NCSC says this discourages tick-box exercises.
Each contributing outcome is rated as one of three levels:
- Achieved: the typical characteristics are present.
- Partially achieved: where this level applies, it must still deliver specific, worthwhile benefits.
- Not achieved: the presence of any one indicator is normally enough to justify this rating.
The third rule is a strict one: a single indicator of weakness can be enough, so strong results elsewhere do not necessarily offset it.
Worked example: two small outcomes, one honest rating
Consider a hospital laboratory that backs up its results database nightly but has never tried restoring from those backups. Under an outcome-focused reading, having backups is not the same as being able to recover. An assessor might rate a recovery-related outcome as partially achieved at best, because the evidence shows effort but not proof it works. Running a restore test and recording the result is what would move the rating. This scenario is illustrative and does not describe a real organization or an official CAF finding.
Can a small business use these frameworks?
Yes, with care. NIST publishes a Small Business Quick Start Guide (NIST SP 1300) for small and medium-sized businesses with modest or no cybersecurity plans, along with a separate guide for one-person firms with minimal IT. According to NIST, it offers considerations for starting a risk management strategy based on CSF 2.0.
A sensible approach for a small team is to treat a framework as a checklist of questions, not a project to complete. Start with ownership (Govern), a simple inventory (Identify) and a tested recovery plan (Recover), then work outward. Specific defenses sit underneath these headings: strong sign-in methods such as multi-factor authentication or passkeys support Protect, while knowing which flaws attackers are using, as in the CISA exploited-vulnerabilities approach, supports both Identify and Protect.
What do frameworks leave unanswered?
Several limits deserve attention.
- They are not evidence of safety. Alignment with a framework describes an organization’s practices, not the absence of weaknesses. None of the pages reviewed offer data showing that framework use reduces breaches.
- They do not choose tools. NIST says the CSF does not prescribe how to achieve outcomes, and the NCSC says its indicators are not mandatory.
- They depend on honest self-assessment. An outcome-based approach relies on assessors and staff interpreting evidence fairly.
- They age. Threats shift, which is why the NCSC schedules reviews and why NIST reworked its original framework a decade after launch. The ransomware overview shows how quickly attacker methods change the questions worth asking.
Choosing a framework as a starting point, not a finish line
For most readers the practical question is not which framework is better, but which one matches the conversation they need to have. Leaders and suppliers who need a common language may find the CSF’s six functions easier to adopt, while operators of essential services and their regulators may lean on the CAF’s graded outcomes. Either way, the useful work is the same: name an owner, list what matters, test what you claim to have, and revisit the answers on a schedule.
This article offers general information and is not a substitute for professional security advice.
Sources: National Institute of Standards and Technology; National Cyber Security Centre
