How NIST CSF 2.0 is used where regulators and sector bodies build on it: healthcare under HIPAA's recognized security practices, banks after the FFIEC CAT, manufacturing and OT, federal agencies and critical infrastructure.
Why healthcare organizations adopt NIST CSF 2.0: the 2021 HITECH amendment that makes NIST-developed practices count in HIPAA enforcement, the 12-month evidence rule, what the law does not require, and how a CSF program is documented for OCR.
What banks and credit unions use now that the FFIEC Cybersecurity Assessment Tool is gone: NIST CSF 2.0 and CISA's CPGs as named replacements, the CRI Profile built on CSF 2.0 for financial institutions, and the sector cloud profile.
Applying NIST CSF 2.0 to factories and operational technology: the draft CSF 2.0 Manufacturing Profile, SP 800-82 Rev. 3 and its OT overlay, how the CSF Core applies to OT and IoT, and the CPGs for critical manufacturing.
How US federal agencies use NIST CSF 2.0 alongside FISMA and the Risk Management Framework: the 2017 executive order, how the CSF complements SP 800-53 control selection, NIST's CSF to SP 800-53 crosswalk and ERM guidance for agency officials.
Using NIST CSF 2.0 in critical infrastructure: the framework's origins in critical infrastructure, CISA's CPGs 2.0 aligned to the CSF Functions, the sector Community Profiles for transit, telecommunications and timing, and CISA's free assessment tool.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.