EdLaw nat/us/nist-csf/README.md

language: en · status: in-force · last checked: 2026-10-26

NIST Cybersecurity Framework (CSF) 2.0

Voluntary cybersecurity risk-management framework published by the US National Institute of Standards and Technology: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 2024-02-26 (doi:10.6028/NIST.CSWP.29). Per the document, it "provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks" and "offers a taxonomy of high-level cybersecurity outcomes"; it "does not prescribe how outcomes should be achieved". The CSF Core is a hierarchy of Functions, Categories, and Subcategories; the six Functions are Govern, Identify, Protect, Detect, Respond, Recover (Govern was added in 2.0).

Applicability to EdTech

Not law — but the reference point US K-12 cybersecurity guidance is aligned to (the CDT K-12 brief recommends institutional policies "ideally aligned with the NIST Cybersecurity Framework"), and a common ask in district procurement alongside SOC 2. Mapping product security controls to CSF 2.0 functions answers a large share of US security questionnaires.

Contents

Document Covers
CORE.md Appendix A, the CSF Core: the six Functions, 22 Categories and 106 Subcategories, each anchored by its NIST identifier (GV → CORE.md#gv, GV.OC → CORE.md#gv-oc, GV.OC-01 → CORE.md#gv-oc-01), with the appendix introduction and Table 1

The rest of CSWP 29 (the introduction, Profiles, Tiers and Appendix B, the glossary in Appendix C) is described here, not reproduced. CORE.md is generated by tools/nist-csf/build_csf_core.py from the archived PDF; its verify mode re-checks the text, the counts and the PDF's hash.

Licence

The corpus reproduces Appendix A of CSWP 29, the CSF Core, verbatim in CORE.md; this README describes the rest of the framework, and the archived sources/NIST.CSWP.29.pdf is kept as the source of record. The PDF carries no copyright notice on its first four pages; its cover says "This publication is available free of charge from: https://doi.org/10.6028/NIST.CSWP.29", and its final page points to the NIST Technical Series Policies, "Copyright, Use, and Licensing Statements". That statement (nist.gov, Copyright, Fair Use, and Licensing Statements for SRD, Data, Software, and Technical Series Publications, read 2026-10-01) says: "Works authored by NIST employees are not subject to Copyright protection within the United States; foreign rights are reserved. To the extent NIST may assert rights outside of the United States, the public is granted the non-exclusive, perpetual, paid-up, royalty-free, worldwide right to reprint works in all formats including print, electronically, and online, and in all subsequent editions, and derivative works." NIST is a federal agency, so the statutory basis is 17 U.S.C. § 105(a) (govinfo, United States Code 2024 edition, title 17 § 105, read 2026-10-01) provides: "Copyright protection under this title is not available for any work of the United States Government, but the United States Government is not precluded from receiving and holding copyrights transferred to it by assignment, bequest, or otherwise."

Conditions: NIST asks: "Please use the recommended citation format below followed by “Republished courtesy of the National Institute of Standards and Technology.”" The PDF's own recommended citation ("How to Cite this NIST Technical Series Publication", on its final page) is: "National Institute of Standards and Technology (2024) The NIST Cybersecurity Framework (CSF) 2.0. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29". The corpus meets the condition in CORE.md's {.meta} provenance line, which gives that citation followed by "Republished courtesy of the National Institute of Standards and Technology.", and here:

National Institute of Standards and Technology (2024) The NIST Cybersecurity Framework (CSF) 2.0. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29 Republished courtesy of the National Institute of Standards and Technology.

The worldwide grant covers the corpus's use outside the United States, commercial use included.

Sources