NIST CSF 2.0: the 2026 guides, in practice

NIST published CSF 2.0 on February 26, 2024. Since then, it has been extending the framework through small publications rather than a new version. In 2026, four of them change how it is used: a quick-start guide on enterprise risk and workforce (SP 1308, final in March), Revision 5 of SP 800-70 on configuration checklists (final on May 8), a guide on informative references (SP 1347, final in August) and a draft on using AI for CSF analysis (SP 1353, comments closed on October 15, 2026).

What the sources say

The framework itself. CSF 2.0 organizes its outcomes into profiles. A Current Profile "specifies the Core outcomes that an organization is currently achieving," and a Target Profile states the outcomes selected and prioritized. The document proposes five steps: scope the profile, gather the information, create it, analyze the gaps and build an action plan, then carry it out and update the profile. It also defines Informative References as mappings between the CSF Core and other standards, guidelines or regulations.

SP 1308, final in March 2026. This guide connects enterprise risk management, cybersecurity risk management and workforce management. Its stated aim is to help organizations "improve communication about cybersecurity risks" and to plan staffing decisions around actual risk and planned responses.

SP 800-70 Rev. 5, final on May 8, 2026. According to the announcement, the National Checklist Program adds "enhanced mapping concepts between checklist settings, NIST Cybersecurity Framework (CSF) 2.0 outcomes, SP 800-53 controls" and CCE identifiers, for evidence-ready automation and reporting.

SP 1347, final in August 2026. The guide explains what informative references are and which NIST tools give access to them: direct download, the CSF 2.0 Reference Tool and the Online Informative References (OLIR) program. The NIST informative references page lists, among others, ISO/IEC 27001:2022, PCI DSS 4.0.1, CIS Controls 8.1, the Cloud Controls Matrix 4.0 and SP 800-53 Rev. 5. NIST states: "NIST does not conduct correctness testing on non-NIST submitted mappings."

SP 1353, draft of August 19, 2026. This guide illustrates how AI could be used to analyze, plan and monitor CSF outcomes, with structured prompts and three notional use cases. The comment period closed on October 15, 2026.

Why it matters

Most organizations do not adopt the CSF from scratch. They already run an ISO 27001 management system, hold a SOC 2 report or both, and a client, an insurer or a board now asks "where do you stand against the NIST CSF?" The 2026 publications answer that situation: the ISO/IEC 27001:2022 to CSF 2.0 reference lets you reuse the controls already in place, and SP 800-70 ties technical configuration settings to the same outcomes.

For SOC 2, the picture is less clear. The AICPA publishes a mapping between the 2017 Trust Services Criteria and the NIST CSF, dated May 4, 2018, so it predates CSF 2.0 and its Govern function. It remains useful as a starting point, but it needs manual review, especially for governance and supply chain.

Finally, SP 1308 is a reminder that a profile is not just a technical table: it is how you talk about risk with leadership and decide who does what.

What we think at Sentrix

1. Start from a scoped profile, not the whole organization. CSF 2.0 explicitly allows it: a profile can cover a single system or a single threat. Begin with the scope your clients ask about. Our NIST CSF page describes the functions and how to scope.
2. Reuse the ISO 27001 reference instead of redoing the mapping. If your ISO 27001 is in place, the informative reference listed by NIST gives you a first Current Profile. Review it: NIST does not test mappings submitted by third parties.
3. Treat the SOC 2 mapping as a draft. It predates CSF 2.0; check every link, especially in Govern. See also SOC 2.
4. Link evidence to outcomes, once. Evidence collected for an ISO control should feed the matching CSF outcome without double entry. That is the job of compliance automation.
5. Read SP 1353 as a draft. Its prompts can speed up a review, but a profile remains a human decision, signed by someone accountable for it.

The next step

Pick a scope, take your ISO 27001 statement of applicability and the NIST informative reference, and produce a first Current Profile. The CSF outcomes with no matching control, Govern in particular, are your gap list. If you want to do this exercise with us, contact us.