NIST is the National Institute of Standards and Technology, a U.S. federal agency within the Department of Commerce that develops measurement science, standards and guidance. In security conversations, "NIST" usually means the publications it produces, above all the Cybersecurity Framework (CSF) and the SP 800 series of controls. These documents are used to structure security programs, answer customer due diligence and prepare for audits. We will walk through the agency, the frameworks, what "NIST compliant" does and does not mean, and how NIST compares with ISO.
TL;DR
- NIST is a nonregulatory U.S. agency founded in 1901. It publishes standards and guidance, and it does not certify companies.
- The NIST Cybersecurity Framework 2.0, published February 26, 2024, organizes security outcomes into six Functions: Govern, Identify, Protect, Detect, Respond and Recover.
- The CSF is generally voluntary for private companies. It is mandatory for U.S. federal agencies, and some customers ask suppliers to align with it.
- "NIST compliant" usually means you map your controls to a NIST publication, not that you hold a certificate. ISO/IEC 27001, by contrast, can be certified.
- Security questionnaires often ask how you align with NIST, so a well-organized evidence library saves real time.
Table of Contents
- What NIST is and what it does
- The NIST publications security teams actually use
- What is the NIST Cybersecurity Framework?
- The six Functions of CSF 2.0
- What does it mean to be NIST compliant?
- NIST vs. ISO: how they differ
- Putting NIST to work in a technology company
- Why NIST shows up in your security questionnaires
- Our perspective
- Handling NIST questions faster with Skypher
- FAQ
- Sources
What NIST is and what it does
The National Institute of Standards and Technology was founded in 1901 and is part of the U.S. Department of Commerce. It was created because the U.S. measurement infrastructure lagged behind its economic rivals. Its stated purpose is to advance measurement science, standards and technology to promote U.S. innovation and industrial competitiveness, strengthen economic security and improve quality of life.
The breadth surprises people who know NIST only from security. NIST says that products and services ranging from health records and atomic clocks to computer chips and communications networks rely on its technology, measurement and standards. It also supports industry, academia and government with reference materials, data products, instruments and calibrations, with work that spans nanotechnology, advanced manufacturing, semiconductors, healthcare and communications.
Two points matter for anyone in security or compliance:
- NIST is a nonregulatory agency. It writes standards and guidance. It does not inspect companies, issue fines or hand out certificates.
- Its security work is publicly available. NIST publishes its frameworks and special publications free of charge, which is a large part of why they became a common vocabulary across industries.
The NIST publications security teams actually use
When a prospect writes "please describe your alignment with NIST," they are rarely asking about the agency. They mean one of a handful of documents. Here is how they fit together.
| Publication | What it is | Typical use |
|---|---|---|
| Cybersecurity Framework (CSF) 2.0 | High-level outcomes for managing cybersecurity risk | Structuring a program, reporting to leadership, answering questionnaires |
| SP 800-53 | A catalog of security and privacy controls | Detailed control selection, federal systems, mapping from the CSF |
| SP 800-171 | Requirements for protecting controlled unclassified information | Suppliers handling U.S. government data |
| AI Risk Management Framework | Guidance for managing risks of AI systems | Governing AI products and internal AI use |
The controls catalog is worth knowing by name. NIST describes SP 800-53 Rev. 5 as security and privacy controls for information systems and organizations, designed to be flexible, customizable and applied as part of an organization-wide risk process. If you want to see how the high-level CSF outcomes connect to those detailed controls, our guide on mapping the CSF to 800-53 with OLIR and OSCAL shows the steps. If you handle government data, see our overview of NIST 800-171 requirements, controls and steps. For AI governance, we cover the NIST AI Risk Management Framework in practical terms.
What is the NIST Cybersecurity Framework?
The CSF is the document most people mean by "NIST" in a business setting. According to NIST's own FAQ, it is a flexible taxonomy of high-level cybersecurity outcomes that helps organizations understand, assess, prioritize and communicate their cybersecurity efforts. Related NIST resources point to practices and controls that may achieve those outcomes, and the framework does not prescribe a single method.
A short history helps. The original framework was released in 2014. NIST then updated it, and CSF 2.0 was published on February 26, 2024. It is intended for industry, government agencies and other organizations regardless of size, sector or cybersecurity maturity. That last point is a real change from earlier thinking, when the framework was associated mainly with critical infrastructure.
The same document explains that the framework leaves implementation open. It links to resources with possible practices and controls, so the way you meet an outcome can vary with your mission, risks, technology and risk tolerance. In practice, two companies can both align with the CSF and look quite different.
How the CSF is organized
CSF 2.0 has three parts, according to NIST's resource and overview guide:
- The CSF Core expresses the desired outcomes.
- Organizational Profiles describe your current and target cybersecurity posture.
- Tiers characterize the rigor of your risk governance and management practices.
A useful way to start is to write a Current Profile (what you do today), a Target Profile (what you need to do given your customers and risks) and a gap list between them. That gap list becomes your roadmap, and it is also a strong artifact to share when a customer asks how mature your program is.
The six Functions of CSF 2.0
The six Functions are Govern, Identify, Protect, Detect, Respond and Recover. NIST presents them as concurrent and continuous aspects of risk management, not a sequence you finish one by one. Here is what each means in plain terms.
Govern. Govern establishes, communicates and monitors your cybersecurity risk strategy, expectations and policy, and connects cybersecurity to broader enterprise risk management. Govern is the new Function in version 2.0. In a questionnaire, this is where answers about policies, roles, board reporting and supplier oversight belong.
Identify. Identify builds an understanding of your current cybersecurity risks, including assets, suppliers and related risks, so you can prioritize effort consistently with your mission and risk strategy. Asset inventories and third-party risk reviews live here.
Protect. Safeguards that reduce the likelihood or impact of an incident: access control, data protection, training, secure configuration. Identity and permission design are a good example of Protect work. A checklist such as this one on designing OAuth scopes shows how least privilege applies to the integrations your product exposes.
Detect. Finding anomalies and possible attacks in time to act, through monitoring and analysis of events.
Respond. Taking action once an incident is detected: incident management, analysis, communication and mitigation.
Recover. Restoring affected operations and services, and communicating about recovery.
For a broader view of how teams choose between frameworks and put them into operation, our guide to IT risk management frameworks compares the options.
What does it mean to be NIST compliant?
This is where most confusion starts. The honest answer is that it depends on which NIST document and who is asking.
The CSF itself is generally used voluntarily, and NIST is not a regulatory agency. There is no CSF certificate and no NIST audit body issuing one. The U.S. Federal Trade Commission describes CSF 2.0 as free, voluntary and flexible, and recommends using its six Functions as an outline for deciding where to spend cybersecurity time and money.
There are still three situations where NIST alignment becomes an expectation:
- Federal agencies. NIST's FAQ notes that Executive Order 13800 made the CSF mandatory for U.S. federal agencies.
- Supply chains. The same FAQ notes that some companies require the CSF of their customers or within their supply chains.
- Government data. Suppliers that handle controlled unclassified information are asked to meet specific requirements, covered in our 800-171 guide.
So when a customer asks whether you are "NIST compliant," a good answer names the publication, the scope and how you map to it. For example: "We align our security program to CSF 2.0, with a Current and Target Profile reviewed annually, and we map our controls to SP 800-53." That is specific, truthful and easy for a reviewer to accept.
NIST vs. ISO: how they differ
People also ask about the difference between ISO and NIST. The short version: NIST is a U.S. government agency that publishes guidance, while ISO/IEC 27001 is an international standard for an information security management system. ISO/IEC 27001:2022 is published by ISO, and organizations can be assessed against it and certified. The CSF is guidance without an associated certification or auditing process.
| NIST CSF 2.0 | ISO/IEC 27001 | |
|---|---|---|
| Publisher | U.S. government agency | International standards body |
| Nature | Outcome-based framework, free to read | Management system standard |
| Certification | None | Available through accredited auditors |
| Flexibility | Very high, via Profiles and Tiers | Defined requirements with a risk-based scope |
| Typical buyer ask | "Aligned with" or "mapped to" | "Certified to" |
Many companies use both. They build the program around the CSF's outcomes and then pursue ISO certification when buyers want an independent attestation. Our posts on ISO 27001 and its impact on security compliance and on choosing between ISO 27001 and SOC 2 can help you decide what to add. For a view across the whole landscape in tech and finance, see our summary of key compliance frameworks.
Putting NIST to work in a technology company
Reading the framework is easy. Using it consistently is harder. These are the steps we see work for B2B software and finance teams.
- Scope it. Decide which products, environments and data the profile covers.
- Write a Current Profile. For each Function, note what exists today and where the evidence lives: policies, tickets, scan reports, training records.
- Set a Target Profile. Base it on customer demands, regulation and your own risk assessment, not on an attempt to maximize every outcome.
- Rank the gaps. Put governance and asset visibility first, since everything else depends on them.
- Map to detailed controls. Use SP 800-53 or another catalog where a customer wants control-level answers.
- Keep evidence current. Review it on a regular schedule so that answers stay accurate.
Brand trust also depends on the basics being visible to customers. Public-facing security hygiene matters alongside internal controls, as this piece on website security and customer trust argues. And if you want a wider checklist of practices for large organizations, our cybersecurity best practices for enterprises is a good companion.
Why NIST shows up in your security questionnaires
If you sell software to enterprises or financial institutions, NIST appears in nearly every security review. Buyers ask which framework you follow, whether you map to SP 800-53, how you govern AI and how you manage suppliers. Each answer draws on the same evidence, yet the questions arrive in spreadsheets, portals and PDFs, each worded differently.
That is why we recommend treating your NIST alignment as a single, maintained body of knowledge: current policies, your CSF profile, control mappings and the latest approved answers. When that knowledge base is organized, a team can respond consistently, whoever is asked and whichever format arrives.
Our perspective
Across the security reviews our customers handle, NIST is the shared language. Buyers use it to frame questions, and security teams use it to frame answers. The framework is not the hard part. The hard part is repeating the same truthful answer, with the right evidence, across hundreds of questionnaires a year.
We built Skypher around that problem. Our proprietary retrieval AI draws on your own knowledge base, including policies, prior answers and documents in tools such as Confluence, Notion, Google Drive, OneDrive and SharePoint, and attaches a confidence score to each suggested answer so your reviewers know where to look first. Because answers come from your approved content, a NIST-aligned response written once can be reused with consistency, and document versioning keeps it current.
We also believe the answers should not stay locked in spreadsheets. A customizable Trust Center lets you publish your security posture, including your framework alignment, so that many buyers find what they need before they ask. Our aim is to give CISOs, GRC leads and sales engineers time back, without lowering the standard of accuracy a security review deserves.
Gaspard
Handling NIST questions faster with Skypher
Once your NIST alignment is documented, the next challenge is answering the questions that arrive about it. Skypher is an AI-powered platform for automating security questionnaire responses. It supports every document format, connects with more than 40 third-party risk management platforms and enterprise tools such as OneTrust, ServiceNow, Slack, MS Teams and Salesforce, and lets your whole team collaborate in real time with unlimited users.
If you want to see how it works with your own framework documentation, explore the Questionnaire Automation Tool, publish your posture through a Trust Center, or look at Fiduciary-Grade DDQ Automation for due diligence questionnaires. You can also review our pricing page to see how to get started.
FAQ
What is NIST and what is its purpose?
NIST is the National Institute of Standards and Technology, a nonregulatory agency within the U.S. Department of Commerce, founded in 1901. Its purpose is to advance measurement science, standards and technology to support U.S. innovation, industrial competitiveness and quality of life. In cybersecurity, it is best known for the CSF and the SP 800 series of guidance.
What are the six functions of the NIST Cybersecurity Framework?
They are Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in CSF 2.0, published in February 2024. NIST presents the Functions as concurrent and continuous, so you work on all of them together.
Is the NIST Cybersecurity Framework mandatory?
For most private companies it is voluntary. U.S. federal agencies are required to use it under Executive Order 13800, and some customers expect it from suppliers. Your contracts and sector regulations decide whether it applies to you.
Can you get NIST certified?
There is no certification for the CSF, and NIST does not audit or certify companies. Organizations typically state that they align with or map to the framework. If a buyer wants an independent certificate, ISO/IEC 27001 is one that can be certified.
What is the difference between NIST CSF and NIST SP 800-53?
The CSF describes high-level outcomes for managing cybersecurity risk. SP 800-53 is a detailed catalog of security and privacy controls. Teams often use the CSF to set direction and SP 800-53 to select and document specific controls.
Sources
- About NIST | NIST
- Federal Register: National Institute of Standards and Technology
- Work with NIST | NIST
- Frequently Asked Questions | NIST Cybersecurity Framework
- CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 | CSRC
- The NIST Cybersecurity Framework (CSF) 2.0 (PDF)
- NIST Cybersecurity Framework 2.0: Resource & Overview Guide
- NIST Releases Version 2.0 of Landmark Cybersecurity Framework
- Cybersecurity for Small Business | Federal Trade Commission
- NIST SP 800-53 Rev. 5, Security and Privacy Controls | CSRC
- ISO/IEC 27001:2022 | ISO
- OAuth Scope Design: 6-Step Checklist for Engineers
- Website Security: Safeguarding Brands and Customer Trust