NIST CSF 1.1 to 2.0 assessment update steps

How do you update a NIST CSF 1.1 assessment to CSF 2.0 without starting over?

Start by remapping what you already have. NIST's transition resources, including a crosswalk informative reference in Excel and the Core Transition Changes spreadsheet, let you move CSF 1.1 Subcategory results into CSF 2.0 identifiers, and NIST says no content was removed from CSF 1.1 in CSF 2.0. The update is an internal exercise. It produces no certificate, and NIST offers no conformity assessment for it. Your organization owns the assessment and its conclusions, and only an independent assessor issues a report on it. How much work you save depends on three things. First, how many of your CSF 1.1 Subcategories split. The crosswalk shows that one old Subcategory can map to several new ones, for example PR.AC-1 mapping to both PR.AA-01 and PR.AA-05, so each split needs its own answer. Second, how many of the 11 new Subcategories apply to you. These include the GV.OV Oversight Subcategories, GV.RR-01, GV.RM-07, ID.IM-01, PR.AA-04 and several recovery and response outcomes, and they will not have prior ratings. Third, how current your old evidence is. A rating backed by a 2021 screenshot is weaker than one backed by a recent log export.

Work through the transition spreadsheet in the order your team can verify. Mark each old Subcategory as carried forward, split, or new, then record which evidence supports each new identifier and the date it was collected. Confirm the crosswalk against the CSF 2.0 Reference Tool before you rely on it, because the mappings are reference material that NIST can update. Ask your implementation partner, if you use one, to prepare the evidence package and the remapped workbook, and keep the decisions about ratings and target Tiers in your own governance process. Agree in writing what the partner delivers and what your staff must confirm, so the updated assessment can be reviewed by an independent assessor later.

What NIST changed between CSF 1.1 and CSF 2.0

CSF 2.0 keeps the outcomes of CSF 1.1 but reorganizes them around a new Govern Function. The cards below cover the structural shifts you will meet when you map an existing assessment, and they note where the counts in NIST's transition materials come from.

Five Functions became six

CSF 2.0 adds Govern to the five Functions of CSF 1.1: Identify, Protect, Detect, Respond and Recover. Govern sits over the other five and covers how cybersecurity strategy, risk appetite, roles, policy, oversight and supplier risk are set and reviewed. If your CSF 1.1 assessment has no column for governance decisions, expect to add one before any outcome can be scored under the new structure.

Categories fell from 23 to 22

NIST's Core Transition Changes spreadsheet lists 23 Categories for CSF 1.1 and 22 for CSF 2.0. The drop is not a removal of content: Categories were regrouped, and the Govern Function holds several that used to sit under Identify. Check your Category counts against the spreadsheet before reporting coverage, because a total that looks lower can hide moved items.

Subcategories fell from 108 to 106

CSF 1.1 had 108 Subcategories and CSF 2.0 has 106, according to the transition spreadsheet and the CSF 2.0 Reference Tool export. Two Subcategories fewer does not mean less work: one CSF 1.1 Subcategory can split across several CSF 2.0 Subcategories, and 11 new Subcategories were added. Compare outcomes by content, not by count.

Identify Categories moved into Govern

Business Environment became GV.OC, Governance became GV.RR and GV.PO, Risk Management Strategy became GV.RM, and Supply Chain Risk Management became GV.SC. Evidence that once sat under ID.GV or ID.SC must now be cited under the Govern identifiers. Update your evidence index so each artifact points to its current Subcategory, or an assessor will find it under the old label and question whether it is current.

Broader audience beyond critical infrastructure

CSF 1.1 was written mainly for critical infrastructure operators. CSF 2.0 is intended for all organizations regardless of size, sector or maturity. For your assessment, this means the Current Profile and Target Profile should reflect your own mission and risk appetite, not a sector template. Ask which Subcategories your organization actually needs before scoring the rest.

Why one CSF 1.1 Subcategory can become several in CSF 2.0

A split Subcategory means one old assessment answer may now need two or more new answers, each with its own evidence. NIST's crosswalk shows CSF 1.1 PR.AC-1 mapping to PR.AA-01 and PR.AA-05 in CSF 2.0. If your 1.1 assessment recorded one rating for PR.AC-1, you cannot carry that rating forward unchanged. Identity management (PR.AA-01) and access permissions (PR.AA-05) now have separate outcomes, so an answer that covered both must be re-examined for each. Check whether your existing evidence, such as an identity inventory, an access review record or a credential policy, actually answers both outcomes or only one of them.

The numbering tells you where content went. NIST's Reference Tool export lists 106 active Subcategories alongside 79 withdrawn identifiers, and each withdrawn identifier is marked with the Subcategory that absorbed its content. For example, ID.BE-01 was incorporated into GV.OC-05. Gaps in the 2.0 numbering therefore flag relocated items, and NIST did not reuse withdrawn identifiers when meaning changed. For a practical check, filter your 1.1 assessment for every identifier that appears among the 79 withdrawn entries and confirm its new home in the Reference Tool. Do not assume a withdrawn ID kept its old meaning.

The crosswalk tells you where to look, not what the answer is. It is a mapping resource, not a scoring tool, so it will not tell you whether a split outcome is met or what rating to assign. Ask your assessor or internal owner to re-rate each new Subcategory on its own terms, and record which evidence supports each rating. Expect some 1.1 answers to become one 2.0 answer with narrower wording, and some to become several with separate owners. Confirm the current spreadsheet version directly from NIST, NIST's CSF 1.1 to CSF 2.0 Core Transition Changes spreadsheet, before you rebuild the mapping.

Steps to carry a CSF 1.1 assessment into CSF 2.0

This sequence moves an existing CSF 1.1 assessment into CSF 2.0 without losing the evidence already gathered, because NIST states that no content was removed from CSF 1.1. Each step produces a named output that the next step depends on, ending with a CSF 2.0 Current Profile for internal use.

Freeze and inventory the CSF 1.1 assessment
Before any mapping starts, record the assessment as it stands: the Profile or self-assessment file, its version and date, the people who rated each item, and the evidence attached to each rating. Lock the file so later edits do not blur what was assessed. The owner of the assessment signs off the inventory. The step is done when every CSF 1.1 Subcategory in scope has a current rating, a date and a pointer to its evidence, and the frozen copy is stored where auditors or customers can later see what was assessed at that point.
Map each CSF 1.1 Subcategory with the crosswalk
Download NIST's CSF 1.1 to 2.0 crosswalk and the Core Transition Changes spreadsheet, then list every CSF 1.1 Subcategory against its CSF 2.0 destination. Mark each row as unchanged, relocated, split or merged. The transition spreadsheet is the reference for where content moved, including Categories that now sit under Govern. The assessment lead and one technical reviewer complete the mapping together. The output is a mapping sheet with one row per CSF 1.1 Subcategory and a destination for each, reviewed by a second person.
Resolve splits and relocations line by line
Some CSF 1.1 Subcategories map to several CSF 2.0 Subcategories. The crosswalk shows, for example, that PR.AC-1 maps to both PR.AA-01 and PR.AA-05. For each split, decide which new Subcategory owns the existing evidence and which needs its own evidence. Record the decision and its reason in the mapping sheet. Check the withdrawn identifiers in the Reference Tool export, which show where each retired ID's content now lives, so no legacy row is dropped. The output is a resolved mapping in which every CSF 2.0 Subcategory under a split has an owner and a note on the evidence it inherits.
Add the 11 new Subcategories
Add the 11 Subcategories that the transition spreadsheet flags as new in CSF 2.0: GV.RM-07, GV.RR-01, GV.OV-01, GV.OV-02, GV.OV-03, ID.IM-01, PR.AA-04, RS.AN-07, RC.RP-04, RC.RP-05 and RC.RP-06. These have no CSF 1.1 predecessor, so the existing assessment cannot rate them. Assign an owner to each, identify the evidence that would show the outcome, and mark the rating as unassessed until that evidence is collected. The output is a list of 11 open items with owners and evidence requests, which the Govern and recovery teams can act on.
Re-rate the affected outcomes
Re-rate every CSF 2.0 Subcategory whose meaning, scope or evidence changed through the mapping. Ratings from CSF 1.1 do not carry over automatically when content was split, relocated or added to a Category with a different focus. Re-rate against the CSF 2.0 wording, using the rating scale your organization already uses, and note which earlier rating each new one replaces. Where the evidence is older than the period the assessment covers, mark the rating as needing confirmation. The output is a re-rated Profile with a change log that links each new rating to its source.
Confirm evidence age and gaps
Review the evidence behind the re-rated outcomes and check its date, scope and owner. Evidence from before a system change, a reorganization or a new Govern decision may describe a state that no longer exists. Flag stale items, collect replacements where needed, and record any outcome that now has no supporting evidence. The effort depends on the number of Subcategories in scope and the age of the evidence, so ask your assessor or internal team to size it from the mapping sheet rather than from a fixed estimate. The output is an evidence register with a status for each item.
Issue a CSF 2.0 Current Profile for internal use
Compile the mapped, re-rated and evidence-checked outcomes into a CSF 2.0 Current Profile and circulate it to the owners named in the mapping. Label it as an internal working document, state its date and the frozen CSF 1.1 version it came from, and keep the open items from the new Subcategories visible. Leadership or the board reviews it against the risk register. The step is done when each owner has accepted their rows and the Profile, mapping sheet, change log and evidence register are stored together for the next assessment cycle.

Which NIST transition resource answers which question

The crosswalk is an Excel informative reference that maps CSF 1.1 Subcategories to CSF 2.0 Subcategories. Use it when you hold a CSF 1.1 profile or assessment and need to find where each existing line item now lives. A single old Subcategory can map to more than one new one. For example, the transition spreadsheet maps CSF 1.1 PR.AC-1 to both PR.AA-01 and PR.AA-05, so one answer you already recorded may need two entries in the new profile.

Best used for: line-by-line mapping of an existing CSF 1.1 profile into CSF 2.0 identifiers.
Does not tell you: whether your controls actually meet the new Subcategory, or how mature they are.
Watch for: one-to-many mappings, which require you to assess each destination Subcategory separately.
Watch for: Subcategories that gained new outcomes, such as PR.AA-04, which have no CSF 1.1 source to inherit evidence from.
Your judgment: the mapping is a starting point. Your team still decides whether the existing evidence supports each new identifier.

Before relying on it, confirm on the NIST CSF FAQs page that the crosswalk is the current version and that no later revision has replaced it.

Which new CSF 2.0 outcomes need fresh evidence

NIST's transition spreadsheet flags the GV.OV Oversight Category and 11 Subcategories as new in CSF 2.0. A CSF 1.1 profile can be carried forward for most outcomes, but these outcomes have no direct predecessor, so an assessor will look for dated records created under the new outcome language. The four groups below show what evidence to gather for each.

Govern oversight and risk direction

This group covers GV.OV-01, GV.OV-02, GV.OV-03, GV.RM-07 and GV.RR-01. GV.OV asks leaders to review strategy outcomes, strategy coverage and risk management performance, so the evidence is dated leadership review records: meeting minutes, board or committee packs and decisions that changed direction. GV.RM-07 and GV.RR-01 need a current risk method output and named accountability for cybersecurity. Check that each review record shows what was reviewed and what the leadership decided. A CSF 1.1 governance policy alone does not show that oversight happens.

Improvement from evaluations and operations

ID.IM-01 asks the organization to identify improvements from evaluations, tests, exercises and day-to-day operations. An assessor will look for an improvement log that links each finding to an owner, a decision and a closure date. Sources include internal audits, penetration test reports, tabletop exercise after-action notes and incident reviews. Check that the log captures improvements from operations as well as formal audits. A CSF 1.1 gap register from a past assessment usually lacks this feedback loop, so it needs new entries.

Privileged and non-human access

PR.AA-04 is new in CSF 2.0 and concerns identity assertions, so the evidence is an identity assertion record showing how users and services prove who they are to systems and to each other. For a self-hosted platform, this means documented SSO or federation configuration, token issuance and expiry settings, and service account inventories. Check that service accounts and automated workloads are covered, not only staff logins. A CSF 1.1 access control matrix addresses permissions but rarely records how identity assertions are issued and verified.

Response analysis and recovery verification

This group covers RS.AN-07, RC.RP-04, RC.RP-05 and RC.RP-06. RS.AN-07 concerns incident data collection and integrity, so the evidence is chain-of-custody and data integrity records for incident artifacts. RC.RP-04 through RC.RP-06 cover post-incident norms, verifying restored assets and backups, and declaring recovery complete. Expect recovery test records with timestamps, restore logs and sign-off by a named role. Check that a restore test was performed, not just planned. A CSF 1.1 recovery plan without restore evidence will not satisfy these outcomes.

Remap the existing assessment or rebuild it on the CSF 2.0 Core

This table compares remapping an existing CSF 1.1 assessment with rebuilding it against the CSF 2.0 Core, plus outsourcing preparation to an implementation partner. Read each row against your scope, the age of your evidence and what your customers or contracts ask for, then choose the path that matches your situation.

Option	What it involves	When it fits and what to confirm
Remap the CSF 1.1 assessment	Use NIST's CSF 1.1 to 2.0 crosswalk and Core Transition Changes spreadsheet to move each existing answer to its CSF 2.0 Subcategories. Split answers where one CSF 1.1 Subcategory maps to several, such as PR.AC-1 mapping to PR.AA-01 and PR.AA-05. Then assess the 11 new Subcategories and the GV.OV Oversight Category from scratch.	Fits a narrow scope with recent, well-documented evidence. Confirm that every mapped Subcategory has its own evidence, that no CSF 1.1 answer relied on a relocated item whose meaning changed, and that the new Govern outcomes are covered.
Rebuild against the 106 CSF 2.0 Subcategories	Start a fresh Current Profile across all six Functions and 22 Categories, using the old answers and evidence as input rather than as final ratings. Each Subcategory is rated on current practice, with new evidence collected where the old record is thin or outdated.	Fits a broad scope, stale ratings, or a customer requirement for a current CSF 2.0 Current Profile. Confirm the scope boundary, the rating scale you will use, and who signs off each rating before the work starts.
Outsource preparation to an implementation partner	A partner can prepare the crosswalk, rebuild the evidence set, organize interviews and draft the Current Profile for your review. The organization still owns every rating and the resulting Profile. Any external report requires an independent assessor, since the partner does not issue reports or certifications.	Fits teams short on time or CSF 2.0 experience. Confirm in writing that ratings remain your decisions, which deliverables are fixed in scope, and that an independent assessor will be engaged separately if a third-party review is required.

What usually breaks a CSF 1.1 to 2.0 update

Most CSF 1.1 to 2.0 updates fail in the same few places: ratings, the crosswalk, Govern, evidence, decision ownership and how the result is shared. Each card below names one failure, its cause and the check that prevents it.

Copying ratings onto split Subcategories

A CSF 1.1 Subcategory can be divided across several CSF 2.0 Subcategories. For example, CSF 1.1 PR.AC-1 maps to PR.AA-01 and PR.AA-05, so one old rating no longer describes both. Copying the old score onto each new identifier hides gaps in the part that was never measured. Re-rate each new Subcategory against current practice, and record which old rating was used as a starting point.

Treating the crosswalk as a score

The crosswalk shows where CSF 1.1 content now sits in CSF 2.0. It does not say whether your organization meets the outcome. Teams that convert old percentages through the mapping produce a score NIST never defined and that no assessor will accept as a measurement. Use the crosswalk to locate evidence, then assess each outcome on its own merits.

Leaving Govern outcomes empty

Teams often see complete Identify and Protect sections and assume the update is nearly finished. Govern is new in CSF 2.0, and the transition spreadsheet flags the GV.OV Oversight Category and 11 Subcategories as new. Some of these outcomes, such as GV.OV-01 through GV.OV-03, have no direct CSF 1.1 predecessor. Confirm that a named owner, a current policy and a board or executive review exist for each Govern outcome before calling the profile complete.

Reusing evidence from the old environment

Screenshots, scan reports and policy documents from the CSF 1.1 cycle often describe systems, vendors or processes that have since changed. Attaching them to renumbered outcomes makes the assessment look current when it is not. Date every artifact, confirm it still matches the live environment, and replace anything that predates a major change in tooling, cloud accounts or supplier relationships.

One owner deciding every Subcategory

When a single security lead rates all 106 Subcategories, the result reflects one person's view of asset, identity, supplier and recovery practices that other teams run. Ratings for Govern and supply chain outcomes especially need the people who own those decisions, such as finance, legal, procurement and HR. Assign each Subcategory a responsible owner and a reviewer, and record who agreed each rating.

Sharing a Current Profile as a certificate

A CSF 2.0 Current Profile is an internal statement of your outcomes. NIST states that it does not offer certifications or endorsements of CSF implementations or services, and no conformity assessment program exists. Customers who receive a profile and treat it as proof of compliance are misreading it. Label the document as a self-assessment, state its date and scope, and offer independent review as a separate, clearly defined engagement.

Who does what in the update, and where the independence boundary sits

The organization owns the Current Profile it carries forward from CSF 1.1 into CSF 2.0. That means deciding which systems, business units and services fall inside the profile, confirming what each Subcategory says about current practice, and choosing the ratings that describe how well each outcome is achieved today. No outside party can make those calls on the organization's behalf, and a mapped spreadsheet is not a finished profile until the owners accept it.

Profile ownership: A named executive or security lead owns the Current Profile and approves changes to its scope.
Rating decisions: Control owners justify each rating against real operating evidence, not against what the policy says should happen.
Risk acceptance: Leadership accepts, mitigates or transfers any gaps surfaced by the new Govern and Oversight outcomes, and records that decision.
Sign-off: The accountable officer signs the updated profile and the transition decisions, such as where a split CSF 1.1 Subcategory now sits.
Customer sharing: The organization decides which parts of the Current Profile are shared with customers and under what confidentiality terms.

Before signing, confirm that every new CSF 2.0 Subcategory has a named owner and a decision on whether existing evidence covers it.

Questions teams ask before updating a CSF 1.1 assessment

Can we reuse our existing CSF 1.1 assessment for CSF 2.0?

Yes, in most cases the earlier work carries forward, because NIST says no content was removed from CSF 1.1 in CSF 2.0. Its transition resources show where each CSF 1.1 Subcategory now sits, so existing ratings and evidence can be mapped rather than discarded. The catch is that one CSF 1.1 Subcategory can split across several CSF 2.0 Subcategories. For example, CSF 1.1 PR.AC-1 maps to PR.AA-01 and PR.AA-05 in the crosswalk. Each new Subcategory needs a rating and supporting evidence of its own, so treat the old assessment as a starting point, not a finished result.

How long does a CSF 1.1 to 2.0 update take?

The duration depends mainly on how much of the old assessment was documented, how many Subcategories were split or moved, and how many owners must be consulted. Teams that kept current ratings, named owners and evidence locations usually finish faster than teams starting from a loose spreadsheet. Ask any consultant or internal lead to break the work into mapping, re-rating, evidence collection and leadership review, and to state the effort for each in writing. NIST does not publish a duration for this update, so treat any figure you hear as an estimate that needs scoping.

What inputs does the team need before starting?

Gather three things before the mapping begins:

The existing CSF 1.1 assessment, including every rating, target and comment
Evidence references for each Subcategory, such as policies, configurations, logs and test results
A named owner for each Category, with the people who can confirm current practice

You also need the NIST transition spreadsheet and the CSF 2.0 Core, so the team can see which new Subcategories, such as the GV.OV Oversight outcomes, lack prior coverage. Missing owners are the most common blocker, because many new Govern outcomes sit with leadership rather than technical staff.

Can an internal team update the assessment without outside help?

Often yes, provided the team has someone who understands both frameworks and can reach the business owners who hold the evidence. An internal team usually handles the mapping and most evidence collection well. Outside help tends to add value in the re-rating of new Govern outcomes, in challenging inherited ratings, and in producing a defensible record for customers or executives. Whichever route you choose, confirm who owns each decision in writing. Your organization owns its controls and its ratings, and an outside partner can only prepare systems, evidence and documentation.

Does a CSF 2.0 update produce a certificate?

No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans to develop a conformity assessment program. A CSF 2.0 update produces an internal or shared profile and its supporting evidence, not a certificate. If a customer or contract asks for proof, ask which independent review they will accept and what document they expect to receive. Only an independent auditor or assessor can issue a report, and the wording of that report should be agreed before the work begins.

What does a customer usually ask to see?

Customers typically ask for a current profile showing which outcomes are in place, the evidence behind key ratings, and a summary of gaps with dates for remediation. They may also ask who approved the profile and when it was last reviewed. Some ask for a version history showing that CSF 1.1 ratings were carried forward correctly into CSF 2.0. Confirm with the customer which parts they need, whether they want the full profile or a summary, and what confidentiality terms apply before anything is shared.

How does this update connect to Target Profile and gap work?

The CSF 2.0 update establishes the Current Profile, meaning what the organization does today across the new Core. A Target Profile then describes the outcomes and priorities the organization wants to reach, and the gap between the two drives the remediation plan. Finish the Current Profile first, because a target set against an inaccurate baseline will misdirect investment. Newly added outcomes, such as GV.OV and ID.IM-01, often reveal the largest gaps, so plan time for them before setting targets.

Which parts of the update need the most care?

Pay closest attention to the Subcategories that were split, renumbered or moved into Govern, and to the 11 Subcategories NIST flags as new in CSF 2.0. Moved Categories include Business Environment (now GV.OC), Risk Management Strategy (now GV.RM) and Supply Chain Risk Management (now GV.SC). Old ratings for these areas may not reflect the new meaning, so re-rate them rather than copying values across. Note that gaps in the CSF 2.0 numbering mark relocated Subcategories, and identifiers were not reused when meaning changed, so check each mapping against the current text.

How DeployOpen prepares a CSF 2.0 update and its evidence

DeployOpen works on CSF 1.1 to 2.0 updates as an implementation partner. We prepare systems, mappings and evidence inside your environment so your team can review what changed and decide what it means for your profile. We do not issue assessment reports or attestations; the conclusions remain yours and any independent review remains with an independent assessor.

How we scope

Written scope lists which CSF 1.1 profile or assessment files, systems and business units the update covers.
We agree in writing which Subcategories are carried forward, split, or treated as new in CSF 2.0.
Engagements are fixed-scope, with deliverables and timelines confirmed before any work begins.

How we build

We load NIST's transition resources and map each existing CSF 1.1 answer to its CSF 2.0 Subcategories.
We flag the new Govern and Oversight outcomes and list the evidence each one needs from your environment.
We record where a single CSF 1.1 answer now covers several CSF 2.0 outcomes, so none is silently dropped.

How we hand over

You receive an updated CSF 2.0 Current Profile, a crosswalk log and a list of open evidence gaps.
Each mapping decision is documented with its source, its owner and the date it was reviewed.
Your team receives the working files so it can maintain the profile without us.

How we support

Ongoing support is available as a retainer for profile upkeep as NIST updates its informative references and guides.
Retainers can cover refreshing evidence before an internal review or a customer questionnaire.
Ask your independent assessor, if you use one, to confirm which mapping decisions they will accept before we start.

Updating a NIST CSF 1.1 assessment to CSF 2.0