Category
Definition
A subdivision of a core function that groups related cybersecurity outcomes. For example, the Identify function contains categories such as Asset Management and Risk Assessment. CSF 2.0 contains 22 categories across the six functions.
- Framework
- NIST Cybersecurity Framework (CSF 2.0)
- Role
- Subdivision of a core function grouping related outcomes
- Example
- Asset Management and Risk Assessment under Identify
- Total in CSF 2.0
- 22 categories across six functions
Common questions
How does a category relate to the six core functions of CSF 2.0?+
Each of the six functions (Govern, Identify, Protect, Detect, Respond, Recover) breaks down into several categories, and each category further breaks down into subcategories that state specific, checkable outcomes an organisation can assess itself against.
Why does grouping outcomes into categories matter for an organisation using the framework?+
Categories let an organisation assess and report maturity at a manageable grain, neither too broad to be actionable like a whole function nor too granular to summarise like every individual subcategory, which supports gap analysis and prioritisation.
Related terms
- Core Function
- The highest level of the CSF hierarchy. CSF 2.0 defines six: Govern, Identify, Protect, Detect, Respond, and Recover. Each function represents a...
- CSF Profile
- A customised selection of categories and subcategories that reflects an organisation's business environment, risk tolerance, and resources. A Current Profile describes what...
- Govern (Function)
- The sixth and newest CSF core function, introduced in CSF 2.0. It covers the organisational context, risk management strategy, roles and responsibilities,...
- Implementation Tier
- A descriptor of how mature an organisation's cybersecurity risk management practices are, on a scale from Tier 1 (Partial, reactive) to Tier...
- Subcategory
- The most granular level of the CSF core, each describing a specific outcome or practice (for example, 'Physical assets are inventoried'). CSF...