What it asks for. The NIST Cybersecurity Framework is a voluntary, outcome based framework for managing cybersecurity risk. Version 2.0, published in 2024, organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover, each split into categories and subcategories. It does not prescribe specific controls.
In practice. Organisations typically use it to build a current profile of where they stand and a target profile of where they want to be, then plan and prioritise the gap. Informative references map subcategories to detailed control sets, and implementation tiers describe how rigorous risk management practices are. Managers use it to report posture to boards and to align security with enterprise risk.
Common gaps. A common mistake is treating the framework as a checklist and scoring every subcategory without tying it to business risk. Profiles are often produced once and not maintained, and the Govern function added in 2.0 is frequently underdeveloped.