NIST Compliance: A Practical NIST CSF 2.0 Roadmap

NIST compliance has become a common request from customers, insurers and auditors who want proof that you take cyber security seriously. The NIST Cybersecurity Framework (CSF) gives you a structured, repeatable way to reduce risk and show that your controls work, without burying the business in paperwork.

Strictly speaking, the CSF is voluntary, so “compliance” usually means showing clear alignment with it, backed by evidence. To help, this plain-English guide gives leaders and IT teams a six-step path, a 90-day starter plan, an evidence pack, a scorecard and templates you can use straight away.

NIST CSF 2.0 in 90 seconds

The Cybersecurity Framework from NIST is a flexible, outcome-based way to manage cyber risk. As a result, boards, customers, auditors and insurers accept it because it scales from small businesses to enterprises, maps well to ISO 27001, SOC 2, CIS and ASD Essentials, and is easy to explain to non-technical people. CSF 2.0 specifically organises everything into six functions.

Overall, think of the CSF as the blueprint for your security house. In other words, don’t buy tools or draft 40-page policies until you’ve agreed the plan and how you’ll prove progress.

Step 1: Scope your NIST compliance goals

Goal: define what “good” looks like for your business.

• Set the scope: legal entities, offices, endpoints, servers, SaaS tenants, cloud accounts, applications and data types.
• Map your obligations: contracts, privacy law, sector guidance and cyber insurance clauses.
• Choose a target profile, such as baseline, enhanced or advanced, based on your risk appetite and resources.

Deliverables: as a result, you’ll have a one-page scope statement, a stakeholder map showing who owns identity, logging, backups and vendors, and a target CSF profile with success criteria. As a quick win, publish a short page of security objectives and principles. It sets the direction and, therefore, saves debate later.

Step 2: Run a NIST compliance gap analysis

Goal: know exactly where you stand against the CSF, and what to fix first.

First, collect evidence: policies, network and data diagrams, asset lists, vulnerability scans, patch reports, training records, backup settings and restore logs. Next, interview the owners in IT, HR, finance, legal and your key vendors, including your MSP. Then score each area for maturity:

• 0 – Not performed · 1 – Ad hoc · 2 – Repeatable but not consistent
• 3 – Defined, documented and followed · 4 – Managed, measured and governed · 5 – Optimised, automated and continually improved

For example, useful prompts include: is your asset inventory complete? Is MFA enforced for admins and remote access? Are critical logs centralised and kept for 12 to 18 months? Is your incident response plan tested? Are restore tests documented against your recovery targets?

Deliverables: in the end, you’ll have a gap report with maturity scores, a risk register and a prioritised fix list with owners. A cyber security audit is a fast way to produce all three.

Step 3: Build a remediation roadmap

Goal: turn findings into an achievable, phased plan.

First, triage by risk, so high-impact gaps such as identity controls, admin hygiene, backups and email security come first. Then sequence the work into quick wins (0 to 30 days), foundations (30 to 90 days) and advanced capabilities (90 to 180 days). After that, assign an owner to every item, define what “done” means and what evidence proves it, and budget for tools, people and training.

Bundling related items also helps. For example, an identity hardening program might group MFA, single sign-on, separate admin accounts and privileged access management.

Step 4: Put policies and controls in place

Goal: set guardrails and enforce them with technical controls. Above all, keep policies short, ideally five to ten pages each, and move detailed steps into procedures you can update easily.

Core policy set: information security, access control (including joiners, movers and leavers), acceptable use and remote work, incident response, business continuity and disaster recovery, change and patch management, backup and recovery, third-party risk, data protection and privacy, and secure development if you build software.

Example controls by function:

Also, if personal information is involved in an incident, the Notifiable Data Breaches scheme may require you to notify the OAIC and the people affected. Likewise, businesses with turnover over $3 million must report any ransomware payment to ASD within 72 hours. Therefore, build both into your response playbooks.

Step 5: Train your people

Goal: reduce human-factor risk and make secure habits normal.

• Onboarding: security basics, phishing awareness, password managers and how to report problems.
• Quarterly micro-learning: short, role-based sessions for finance, help desk, developers and executives.
• Phishing simulations: coach rather than shame, and track the trend.
• Manager toolkits: simple talking points for team meetings.

Targets you can adopt: training completion of at least 95%, a falling phish-prone rate each quarter, same-day access removal for leavers and critical patches applied within 14 days, or faster depending on risk.

Step 6: Measure and improve NIST compliance

Goal: make security a living system, not an annual scramble. To begin, build a simple scorecard:

Then set a rhythm. Weekly, review exceptions such as new admins and failed backups. Next, each month, review patching trends and tune alerts. Every quarter, also run a tabletop exercise, a restore test and a supplier review. Finally, once a year, refresh policies and get an external assessment. Each cycle then follows the same loop: measure, analyse, prioritise, fix, validate and update your documentation.

Using AI safely under NIST CSF

In addition, AI tools are now part of everyday work, so they belong inside your framework rather than beside it. NIST’s draft Cyber AI Profile applies the CSF to three areas: securing AI systems, using AI for cyber defence and preparing for AI-enabled attacks.

In practice, that means a few concrete steps. First, under Govern, adopt an AI use policy so staff know which tools and data are allowed. Second, under Protect, review permissions before switching on tools such as Microsoft 365 Copilot, because AI can see whatever your staff can see. Third, under Detect, log how AI tools are used. As always, start with one repeated task and plan security, privacy and human review from day one.

A 90-day NIST compliance starter plan

For instance, here’s a practical first quarter. Each phase also lists the evidence that proves it’s done.

Your NIST compliance evidence pack

If you can’t prove it, it didn’t happen. So keep a controlled evidence folder with dated exports and screenshots for each area:

• Identity: MFA report, privileged role membership, joiner and leaver logs.
• Endpoints and patching: protection coverage, encryption compliance, scan exports and patch reports.
• Backups: configuration screenshots, restore test logs and recovery results.
• Logging: data sources and retention settings.
• Email: SPF, DKIM and DMARC records.
• Policies and training: policy versions, completion reports and phishing results.
• Vendors: tiering, certificates and risk assessments.
• Incidents: the signed response plan, tabletop agendas and follow-up actions.

Common pitfalls (and how to avoid them)

In our experience, most programs stall for the same few reasons. Fortunately, each one has a simple fix.

Templates you can copy

To save time, use these three templates as a starting point. Click “Copy template”, then paste into Word, Excel or your intranet and fill in the brackets. The RACI pastes straight into Excel as columns.

Getting help with NIST compliance

In short, a good partner helps you move faster, avoid pitfalls and pass audits with less friction. In particular, look for clear governance and realistic timelines, controls mapped to evidence packs, tool advice that fits your size, and coaching for exercises and reviews. Above all, you want a program that runs from assessment to roadmap to implementation and assurance, not a one-off report.

Our CSF assessment and implementation services cover exactly that: a gap assessment, a 90-day remediation plan, priority controls such as MFA, backups, logging, endpoint protection and conditional access, and an operating rhythm that keeps evidence audit-ready. Moreover, we can do it with you or for you, alongside our cyber security services and managed IT.