# NIST CSF 2.0 Categories Reference for Manufacturers

> Source: https://netray.co/tools/nist-csf-2-categories-manufacturing-reference
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

The six functions and 22 categories of NIST CSF 2.0, translated into a plain example for a factory so you can map your controls quickly.

## Category

compliance-legal

## Industry

Manufacturing

## Audience

- IT security lead
- CISO
- IT manager

## Tool

**Kind:** worksheet

**Mode:** reference

**Columns:**

#### Function

**Key:** func

**Type:** text

#### Category ID

**Key:** id

**Type:** text

#### Category

**Key:** name

**Type:** text

#### Plant example

**Key:** example

**Type:** text

**Rows:**

#### Organizational Context

**Func:** Govern

**Id:** GV.OC

**Example:** Know which plants, customers and contracts drive cyber obligations

#### Risk Management Strategy

**Func:** Govern

**Id:** GV.RM

**Example:** Agreed risk appetite for production downtime and data loss

#### Roles, Responsibilities, and Authorities

**Func:** Govern

**Id:** GV.RR

**Example:** Named owner for OT security and for each plant system

#### Policy

**Func:** Govern

**Id:** GV.PO

**Example:** Approved policies for access, patching, removable media and remote access

#### Oversight

**Func:** Govern

**Id:** GV.OV

**Example:** Leadership reviews cyber metrics and acts on them

#### Cybersecurity Supply Chain Risk Management

**Func:** Govern

**Id:** GV.SC

**Example:** Security terms in contracts with integrators and ERP partners

#### Asset Management

**Func:** Identify

**Id:** ID.AM

**Example:** Inventory of PLCs, HMIs, servers, software and data flows

#### Risk Assessment

**Func:** Identify

**Id:** ID.RA

**Example:** Vulnerability tracking and threat review for plant and office

#### Improvement

**Func:** Identify

**Id:** ID.IM

**Example:** Lessons from exercises and incidents feed the next plan

#### Identity Management, Authentication, and Access Control

**Func:** Protect

**Id:** PR.AA

**Example:** MFA for remote access, unique accounts on engineering stations

#### Awareness and Training

**Func:** Protect

**Id:** PR.AT

**Example:** Phishing training for office staff and OT awareness for operators

#### Data Security

**Func:** Protect

**Id:** PR.DS

**Example:** Encrypted laptops, protected drawings and controlled CUI handling

#### Platform Security

**Func:** Protect

**Id:** PR.PS

**Example:** Baseline configurations, patching and removal of unused services

#### Technology Infrastructure Resilience

**Func:** Protect

**Id:** PR.IR

**Example:** Network segmentation and redundant paths to critical lines

#### Continuous Monitoring

**Func:** Detect

**Id:** DE.CM

**Example:** Monitoring of firewalls, endpoints, remote sessions and OT traffic

#### Adverse Event Analysis

**Func:** Detect

**Id:** DE.AE

**Example:** Triage of alerts and correlation across IT and OT sources

#### Incident Management

**Func:** Respond

**Id:** RS.MA

**Example:** A tested playbook that stops spread and decides when to halt production

#### Incident Analysis

**Func:** Respond

**Id:** RS.AN

**Example:** Forensic evidence preserved before systems are rebuilt

#### Incident Response Reporting and Communication

**Func:** Respond

**Id:** RS.CO

**Example:** Notifying insurer, customers and authorities on schedule

#### Incident Mitigation

**Func:** Respond

**Id:** RS.MI

**Example:** Isolating a cell, disabling accounts, blocking indicators

#### Incident Recovery Plan Execution

**Func:** Recover

**Id:** RC.RP

**Example:** Restoring ERP and MES in the order the plant needs

#### Incident Recovery Communication

**Func:** Recover

**Id:** RC.CO

**Example:** Telling staff and customers when operations are back and what changed

**Notes:** Category names follow NIST CSF 2.0. The plant examples are our own plain-language illustrations, not NIST text. Read the official subcategories before claiming a mapping.

## Content

**Intro:** NIST CSF 2.0 added a Govern function and grew to 22 categories. This table lists them all with a factory-floor example, so you can map existing controls quickly and see where nothing exists.

**Sections:**

#### How to use it

**Body:** Filter by function, then for each category write down the control that covers it today and its owner. Export to Excel and add columns for current maturity and target. Categories where you can name nothing are your gaps. This produces a simple heat map that a board or insurer can read without a framework training course.

**Bullets:**

- Filter on Govern to see the new 2.0 function
- Add owner and maturity columns after export
- Review quarterly, not once

#### What changed in 2.0

**Body:** Version 2.0 added Govern, covering strategy, roles, policy, oversight and supply chain risk. It also widened the target audience beyond critical infrastructure to organizations of any size and sector. For manufacturers, GV.SC is especially relevant because customer flow-down clauses and integrator access make suppliers part of your attack surface.

#### Mapping to other frameworks

**Body:** CSF is a taxonomy, not a certification. Most organizations map it to the requirements they must meet: NIST SP 800-171 or CMMC for defense work, IEC 62443 for the plant floor, ISO 27001 for a management system. Use CSF categories as the common language and keep the detailed mapping in one spreadsheet.

#### Common mistakes

**Body:** Do not treat the tiers as a score to maximize. They describe how rigorous and integrated your practices are and should match risk. Avoid a one-time mapping that sits in a drawer. Assign an owner per category, review them on a calendar, and tie gaps to funded actions.

**Cta:** If you want a CSF-based gap view for your plants and ERP estate, Netray can facilitate the mapping workshop with your team.

**Faq:**

#### How many categories does CSF 2.0 have?

**Answer:** Six functions and 22 categories, each with subcategories beneath. The functions are Govern, Identify, Protect, Detect, Respond and Recover.

#### Is CSF 2.0 mandatory?

**Answer:** Not for private manufacturers as a rule. It is voluntary guidance, though customers, insurers and regulators often reference it, and federal suppliers may map it to required controls.

#### Is it suitable for OT?

**Answer:** Yes as a governance structure. It is technology neutral, so pair it with OT specific guidance such as IEC 62443 or NIST SP 800-82 for the technical controls on the plant floor.

#### Where do I find the subcategories?

**Answer:** In the official NIST CSF 2.0 document and the CSF reference tool published by NIST. This table stops at the category level to keep it quick to scan.

## Search terms

nist csf 2.0 categories list, nist csf 2.0 govern function, nist csf for manufacturing, csf 2.0 gv.oc pr.aa de.cm, nist cybersecurity framework cheat sheet, csf 2.0 functions explained, csf categories spreadsheet

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json