Compliance & ContractsFree referencePDF, Excel, Word exportManufacturing

NIST CSF 2.0 Categories Reference for Manufacturers

NIST CSF 2.0 added a Govern function and grew to 22 categories. This table lists them all with a factory-floor example, so you can map existing controls quickly and see where nothing exists.

Download:

Function	Category ID	Category	Plant example
Govern	GV.OC	Organizational Context	Know which plants, customers and contracts drive cyber obligations
Govern	GV.RM	Risk Management Strategy	Agreed risk appetite for production downtime and data loss
Govern	GV.RR	Roles, Responsibilities, and Authorities	Named owner for OT security and for each plant system
Govern	GV.PO	Policy	Approved policies for access, patching, removable media and remote access
Govern	GV.OV	Oversight	Leadership reviews cyber metrics and acts on them
Govern	GV.SC	Cybersecurity Supply Chain Risk Management	Security terms in contracts with integrators and ERP partners
Identify	ID.AM	Asset Management	Inventory of PLCs, HMIs, servers, software and data flows
Identify	ID.RA	Risk Assessment	Vulnerability tracking and threat review for plant and office
Identify	ID.IM	Improvement	Lessons from exercises and incidents feed the next plan
Protect	PR.AA	Identity Management, Authentication, and Access Control	MFA for remote access, unique accounts on engineering stations
Protect	PR.AT	Awareness and Training	Phishing training for office staff and OT awareness for operators
Protect	PR.DS	Data Security	Encrypted laptops, protected drawings and controlled CUI handling
Protect	PR.PS	Platform Security	Baseline configurations, patching and removal of unused services
Protect	PR.IR	Technology Infrastructure Resilience	Network segmentation and redundant paths to critical lines
Detect	DE.CM	Continuous Monitoring	Monitoring of firewalls, endpoints, remote sessions and OT traffic
Detect	DE.AE	Adverse Event Analysis	Triage of alerts and correlation across IT and OT sources
Respond	RS.MA	Incident Management	A tested playbook that stops spread and decides when to halt production
Respond	RS.AN	Incident Analysis	Forensic evidence preserved before systems are rebuilt
Respond	RS.CO	Incident Response Reporting and Communication	Notifying insurer, customers and authorities on schedule
Respond	RS.MI	Incident Mitigation	Isolating a cell, disabling accounts, blocking indicators
Recover	RC.RP	Incident Recovery Plan Execution	Restoring ERP and MES in the order the plant needs
Recover	RC.CO	Incident Recovery Communication	Telling staff and customers when operations are back and what changed

Category names follow NIST CSF 2.0. The plant examples are our own plain-language illustrations, not NIST text. Read the official subcategories before claiming a mapping.

CSF gap workshop

Optional facilitated mapping of your controls to the 22 categories.

Optional. The tool and every export work without this. No spam.

How to use it

Filter by function, then for each category write down the control that covers it today and its owner. Export to Excel and add columns for current maturity and target. Categories where you can name nothing are your gaps. This produces a simple heat map that a board or insurer can read without a framework training course.

Filter on Govern to see the new 2.0 function
Add owner and maturity columns after export
Review quarterly, not once

What changed in 2.0

Version 2.0 added Govern, covering strategy, roles, policy, oversight and supply chain risk. It also widened the target audience beyond critical infrastructure to organizations of any size and sector. For manufacturers, GV.SC is especially relevant because customer flow-down clauses and integrator access make suppliers part of your attack surface.

Mapping to other frameworks

CSF is a taxonomy, not a certification. Most organizations map it to the requirements they must meet: NIST SP 800-171 or CMMC for defense work, IEC 62443 for the plant floor, ISO 27001 for a management system. Use CSF categories as the common language and keep the detailed mapping in one spreadsheet.

Common mistakes

Do not treat the tiers as a score to maximize. They describe how rigorous and integrated your practices are and should match risk. Avoid a one-time mapping that sits in a drawer. Assign an owner per category, review them on a calendar, and tie gaps to funded actions.

Frequently Asked Questions

How many categories does CSF 2.0 have?

Six functions and 22 categories, each with subcategories beneath. The functions are Govern, Identify, Protect, Detect, Respond and Recover.

Is CSF 2.0 mandatory?

Not for private manufacturers as a rule. It is voluntary guidance, though customers, insurers and regulators often reference it, and federal suppliers may map it to required controls.

Is it suitable for OT?

Yes as a governance structure. It is technology neutral, so pair it with OT specific guidance such as IEC 62443 or NIST SP 800-82 for the technical controls on the plant floor.

Where do I find the subcategories?

In the official NIST CSF 2.0 document and the CSF reference tool published by NIST. This table stops at the category level to keep it quick to scan.

If you want a CSF-based gap view for your plants and ERP estate, Netray can facilitate the mapping workshop with your team.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

Back to All Tools