minimum selection NIST CSF 2.0
Start package, size S
€199 net per month
- NIST CSF 2.0: Required by your customers? The framework then covers the requirements. Not a legal duty.
- GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)
Framework · NIST Cybersecurity Framework 2.0
NIST CSF 2.0: From profile to action plan
Your customer or insurer asks about the NIST Cybersecurity Framework? Complass guides you through the profile process to the action plan, with evidence from ISO 27001, NIS2 or IEC 62443.
What is NIST CSF 2.0?
The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary framework of the US National Institute of Standards and Technology. In six functions (Govern, Identify, Protect, Detect, Respond, Recover), 22 categories and 106 subcategories it describes the outcomes effective cybersecurity risk management should achieve. It is used worldwide, whatever the sector or size. There is no certificate.
Complass is not affiliated with NIST. The English outcome wording is taken from NIST CSWP 29, a freely usable work of the US federal government.
Content as of:
Does it apply to me?
The CSF concerns companies whose customers, parent groups or cyber insurers want their security described in CSF terms: suppliers to international groups, software and service providers, operators of connected plants and organisations that need one consistent picture of their position.
The CSF is not mandatory and does not replace legal duties such as NIS2. It complements them as a common language; you already have many outcomes if you work to ISO 27001 or NIS2.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Basis
- NIST CSWP 29The NIST Cybersecurity Framework (CSF) 2.0, published 26 February 2024
Key dates
There are no statutory deadlines for the CSF; your customers or insurers set the timetable. The profile is a living document; we recommend reviewing it whenever things change and at least once a year.
How Complass helps
- 5phases
- 10guided steps
- 3document templates
- 106requirements in the catalogue
Profile process in five phases
Scope, current profile, target profile with tier, gap analysis and action plan, implementation and updates, guided step by step.
106 subcategories with official identifiers
Each outcome with applicability, status, justification and evidence. Titles and hints in our own words, the NIST wording alongside in the original.
Templates
Organisational profile for current and target state, tier assessment and action plan.
Mapping to NIS2, IEC 62443 and ISO 27001
Of 106 subcategories, 102 are linked to NIS2, 103 to IEC 62443 and 106 to ISO 27001 through shared controls. In the portal each subcategory shows where the same control is also required.
Implement once, evidence many times
Complass suggests adopting measures you have already assessed for ISO 27001, NIS2 or IEC 62443.
The phases in the module
- Starting point and scope
- Create the current profile
- Define the target profile and tier
- Gap analysis and action plan
- Implement and keep up to date
Catalogue: NIST CSF 2.0 Core – 106 subcategories
NIST CSF 2.0 in Complass: what you need at a minimum
If your customers or insurers require the NIST CSF, this selection covers the requirements in Complass.
Recommended
Business
€590 net per month
More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.
With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 6 November 2026. All packages and modules in the price overview
You can also meet the requirements without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information
Frequently asked questions
Is there a CSF certificate?
No. The CSF cannot be certified. Complass helps you describe and evidence your position as a profile; no certificate or label results.
What is a tier?
The four tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how established your governance and risk management are overall. You record the current and target tier in a template.
We already work to ISO 27001. Do we have to record everything again?
No. Through the shared controls, Complass suggests adopting assessments and evidence. You check each suggestion on its merits before confirming it.
How does the CSF relate to NIS2, IEC 62443 and ISO 27001?
Complass links the subcategories with the requirements of these frameworks through shared controls. This is a content-based mapping by Complass, not an official NIST mapping, and does not replace your own assessment.
Does the CSF replace NIS2 or ISO 27001?
No. It complements them as a way to present your position to customers and insurers. Legal duties remain.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.