The tends to arrive in an Australian business through the side door. A US customer sends a security questionnaire built around it. A cyber insurer asks where you sit against it. A new director arrives from a company that reported against it and wants your posture described the same way. Suddenly a framework written by an American standards body is on your desk, and the question is how much of it you actually need.
What the NIST Cybersecurity Framework is
NIST CSF is published by the US National Institute of Standards and Technology. The current version, CSF 2.0, was released in February 2024 and organises security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Each function breaks down into categories and subcategories that describe outcomes, such as knowing which assets you hold or being able to restore systems after an incident.
The important word is outcomes. The framework does not prescribe controls or name products. It describes what good security looks like and leaves the how to you. In practice it works as a shared language for describing where a security program stands, which is exactly why it keeps turning up in questionnaires.
What changed in CSF 2.0
Version 2.0 made two changes worth knowing about. The framework was originally written for US critical infrastructure, and 2.0 formally broadened it to organisations of any size and sector, which is part of why it now appears in supplier questionnaires far from the United States. It also added Govern as a sixth function, so board oversight, risk appetite and supply chain expectations are now explicit parts of the framework rather than assumptions sitting behind it.
NIST CSF and the Essential Eight do different jobs
The two are often framed as a choice, and they should not be. The is a control baseline: eight specific technical mitigations with defined maturity levels, built by the to measure hardening. The NIST CSF is a risk framework. It covers governance, detection, response and recovery, areas the Essential Eight barely touches, and it prescribes almost nothing about how any of it is achieved.
In practice they layer cleanly. Many Australian organisations run the Essential Eight as the technical baseline and use the CSF to structure what sits around it: governance, incident response, third party risk and the reporting the board reads. An Essential Eight assessment tells you how hardened your systems are. A CSF-aligned review tells you whether the operation around them holds together.
How the CSF maps to the Essential Eight, function by function
Because the CSF describes outcomes and the Essential Eight prescribes controls, the mapping runs one way: each Essential Eight control satisfies part of one or two CSF functions, and most of the CSF has no Essential Eight control under it at all. That gap is the point of the table, because it shows where a business that has done the Essential Eight still has nothing to put in a CSF-based questionnaire.
| CSF 2.0 function | What the Essential Eight contributes | What it leaves uncovered |
|---|---|---|
| Govern | Nothing directly. The model expects a target maturity level to be chosen and exceptions to be documented and approved, which is a small piece of governance. | Risk appetite, roles and responsibilities, policy, supply chain expectations and board oversight. |
| Identify | The patching controls require automated asset discovery at least fortnightly and vulnerability scanning on a schedule, from Level 1. | Business context, risk assessment, and any asset that is not a device or application: data, people, suppliers. |
| Protect | All eight controls sit here. Patching, MFA, administrative privileges, application control, macros, hardening and backups are the Protect function in a hardened form. | Awareness training, data security beyond backups, and identity management beyond MFA and privilege. |
| Detect | From Level 2, four controls require events to be centrally logged, protected, and analysed in a timely manner to detect cyber security events. | Detection across the network, cloud services and identity, and any detection at Level 1. |
| Respond | From Level 2, incidents must be reported to the CISO and to ASD and the incident response plan enacted. | The plan itself, communications, analysis and lessons learned. The model requires the plan to exist and be used, not what is in it. |
| Recover | Regular backups: retention by business criticality, restoration to a common point in time, tested in disaster recovery exercises. | Recovery planning beyond restoration, and communication during recovery. |
Read down the right-hand column and the shape of most Australian security programs appears. The technical middle is covered by the Essential Eight; the governance at the top and the response and recovery planning at the bottom are where the CSF questionnaire finds the blanks. The that replaces the Essential Eight from mid-2027 is being built around the same control outcomes, so the mapping is expected to hold for its enterprise IT chapter.
The Essential Eight requirements referred to above are set out control by control in the Essential Eight controls, listed.
When an Australian business actually needs it
- You sell to US companies or multinationals whose security questionnaires reference NIST.
- A board or parent company wants posture reported against a recognised framework rather than a list of tools.
- An insurer, regulator or major customer has asked where you sit against it.
- You operate across borders, where the Essential Eight carries little recognition and the CSF is the nearest thing to a common language.
If none of those apply, you probably do not need the CSF as your primary framework. The Essential Eight, or SMB1001 for smaller businesses, is more prescriptive and easier to act on. The CSF earns its keep when security has to be explained to people outside your technical team.
How to approach it without drowning
The framework's size is the main trap. Six functions expand into more than a hundred subcategories, and organisations that treat them as a checklist tend to stall within weeks. The saner path is a gap assessment that maps what you already do onto the framework. Most businesses find they are further along than expected: existing controls, backup arrangements and response plans already satisfy a fair share of the outcomes. What remains, commonly governance and supply chain, becomes a short plan with owners and dates.
Treat the CSF as a way to organise and explain the security you already run, not a second regime bolted on beside it. Our audit and assurance team runs NIST CSF-aligned assessments alongside Essential Eight and work. If a questionnaire or a board request has put NIST on your desk, a gap assessment is the sensible first step.
