November 2026 · 7 free webinars on fraud and AI · English, French and Arabic · 18:00 CET · Register → Skip to content
The Tell
← AI & technology

Framework · National Institute of Standards and Technology (NIST)

NIST Cybersecurity Framework (CSF) 2.0

The most widely used free cybersecurity framework, now with a Govern function — the common reference for auditing cyber risk under the IIA Cybersecurity Topical Requirement.

Go to the official source ↗

Our summary

NIST released Cybersecurity Framework (CSF) 2.0 on 26 February 2024. It was the first major update since the framework was created in 2014. Version 2.0 widens the scope from critical infrastructure to organizations of all sizes and sectors, and adds a sixth function, Govern, to the original five: Identify, Protect, Detect, Respond and Recover. It also puts more weight on supply chain risk. The framework is voluntary and free.

The NIST CSF 2.0 Resource Center offers the framework itself, quick-start guides, organizational and community profiles, informative references (mappings to other standards), FAQs, translations and an online tool. NIST keeps adding guides: in 2026 it finalised guides on enterprise risk management and workforce, and on informative references.

How auditors use it: Many organizations already map their cyber controls to the CSF, so it is a practical baseline for cyber audits. The IIA’s User Guide for its Cybersecurity Topical Requirement includes a mapping to NIST. Use the six functions to structure the audit, check that board-level governance is covered, and use the profiles to compare current and target states.

More in AI & technology

2026 Anti-Fraud Technology Benchmarking Report

Survey data showing how organizations use AI and other technology against fraud, and how criminals now use deepfakes and GenAI, so you can benchmark your own anti-fraud program.

Achieving Effective Internal Control Over Generative AI (GenAI)

COSO shows how to apply its Internal Control framework to generative AI, with control expectations and metrics auditors can test.

Cybersecurity Topical Requirement

Since 5 February 2026, every IIA-conforming audit of cybersecurity must cover a mandatory minimum baseline of governance, risk management and controls.