NIST Cybersecurity Framework 2.0
Six functions for managing cybersecurity risk, now including Govern.
- Issued by
- NIST
- Applies in
- United States, Global standards
- Edition
- 2.0 (2024)
- Area
- Information security
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- GVGovern: strategy, roles, policy and supply chain riskFunction
- IDIdentify: assets, risks and improvementsFunction
- PRProtect: access, awareness, data and platform securityFunction
- DEDetect: continuous monitoring and adverse event analysisFunction
- RSRespond: incident management and communicationFunction
- RCRecover: recovery planning and communicationFunction
How Amoreg keeps you on it.
Enable the NIST Cybersecurity Framework 2.0 and add NIST’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 6 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read NIST’s pages
- Check the library against 6 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: govern: strategy, roles, policy and supply chain risk
- Rule
- NIST Cybersecurity Framework 2.0, GV
- Area
- Function
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- Cyber EssentialsThe UK government-backed baseline: five technical controls, self-assessed or Plus-audited.United Kingdom · 5 controls
- EU Artificial Intelligence ActRisk-based obligations for providers and deployers of AI systems; general-purpose AI duties from August 2025, high-risk from August 2026.European Union · 6 controls
Also in United States
- FATF RecommendationsThe 40 Recommendations — the international standard every national AML/CFT/CPF regime is measured against.Global · 8 controls
- Wolfsberg Group StandardsIndustry standards for correspondent banking, the CBDDQ/FCCQ questionnaires and effectiveness-based AML programmes.Global · 4 controls
- US Bank Secrecy Act / FinCEN AML ProgramBSA AML programme requirements: the pillars, CDD rule, SAR/CTR reporting and beneficial ownership.United States · 6 controls
- OFAC Sanctions Compliance ProgramThe five essential components of an effective sanctions compliance programme.United States · 5 controls
- US Foreign Corrupt Practices ActAnti-bribery and books-and-records provisions, assessed against the DOJ's Evaluation of Corporate Compliance Programs.United States · 4 controls
- ISO 37001 — Anti-bribery management systemsRequirements for establishing, implementing and improving an anti-bribery management system.Global · 6 controls
Questions
Does Amoreg watch for changes to the NIST Cybersecurity Framework 2.0?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the NIST Cybersecurity Framework 2.0?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records 2.0 (2024). Editions were last verified in August 2026, and the Monitor records new publications as they appear.