NIST CSF 1.1 vs 2.0: Every Structural Change, Mapped

Structure at a Glance

Numbering gaps in 2.0 Subcategories often indicate 1.1 items that moved. Check NIST FAQs for category moves such as supply-chain and access-control renames.

Migration Checklist

• Rebuild Profiles on the 2.0 Core; do not assume 1.1 IDs still match
• Stand up Govern (GV) Categories explicitly
• Remap Informative References and internal control libraries
• Update board reporting language from five Functions to six

How CyberSilo Helps

Compliance Standards Automation supports CSF 2.0 Subcategory mapping; function guides explain each Function in practice.

Frequently Asked Questions

Must we remake our Organizational Profile?

Yes, for accuracy. Remap Current and Target Profiles to CSF 2.0 Subcategories rather than forcing old IDs.

Did NIST remove cybersecurity content?

NIST states 1.1 meaning is carried into 2.0 through relocation and revision. Validate critical outcomes in your new Profile.

Are Tiers unchanged?

Tiers remain a Core component with four levels; use them with updated Profiles under 2.0.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · 800-171 Rev 3 Changes · Govern Function