If you work in an Australian organisation, NIST probably reached you secondhand. Maybe it was a defence prime’s supplier questionnaire, a DISP application, a parent company overseas, or a board member who read about it on a plane.

The NIST Cybersecurity Framework (CSF) comes from the US National Institute of Standards and Technology, but it has become a common language for cyber risk well beyond the US. For organisations pursuing Defence Industry Security Program (DISP) membership, it’s one of three frameworks on the table, alongside the Essential Eight and ISO 27001.

So it’s worth understanding properly, and worth running in a way that doesn’t fall over the moment someone asks for an update.

What NIST CSF 2.0 actually is

NIST CSF is an outcomes-based framework. It tells you what good looks like, not exactly which product or setting gets you there. Version 2.0 organises those outcomes into six functions:

Govern: who owns cyber risk, how it’s set, measured and reported. New in 2.0, and arguably the most important addition.
Identify: knowing your assets, data, suppliers and risks.
Protect: the safeguards that keep things running, from identity and access to training and data security.
Detect: spotting anomalies and incidents quickly.
Respond: what happens once something is detected.
Recover: getting back to normal and learning from it.

You describe where you are today in a Current Profile and where you need to be in a Target Profile. The gap between the two is your work program. CSF also uses Tiers to describe how rigorous and repeatable your risk practices are.

Where it goes wrong in practice

The framework itself is sensible. The way it often gets used is the problem.

A profile gets built once, usually under deadline, for one bid or one partner request. It lives in a spreadsheet. Evidence sits in screenshots, emails and shared drives. Six months later the spreadsheet is a historical document, and the next questionnaire starts the scramble again.

If that sounds familiar to Australia’s Essential Eight audits, it should. It’s the same cycle: effort spikes around a review, then visibility drops away.

Treat it as progress, not a snapshot

A few habits make NIST CSF far easier to live with.

Start with Govern. Agree who owns the profile and how often it’s reviewed. Without an owner, nothing else stays current.
Set a target profile for a reason. Tie it to what you actually need: a DISP application, a partner’s requirements, an insurer’s questions. A target you can’t explain is hard to fund.
Collect evidence as you go. Capture proof when a control is put in place, not when someone asks for it.
Get it reviewed by someone who knows. An outcomes-based framework leaves room for interpretation. An experienced assessor tells you early whether your evidence would hold up.
Report movement, not just position. Showing how far you’ve come since last quarter is often more persuasive than a single score.

Already working on the Essential Eight?

You’re not starting from zero. Much of the Essential Eight work, such as multi-factor authentication, patching, backups and restricting admin privileges, shows up inside NIST CSF outcomes. The difference is scope. NIST goes wider, into governance, supplier risk, detection and recovery.

Where Constant fits

Constant brings the same always-on approach to NIST CSF that it brings to the Essential Eight. You get a live view of where you stand against your target profile, with automated evidence collection and AI-powered pre-reviews to flag gaps early. Then certified assessors review your controls and evidence as the work progresses. These are human reviews, so you’re not relying on AI alone. And everything is designed, owned and operated in Australia, with customer data stored onshore.

The result: when a partner, prime or board asks where you stand on NIST, the answer is already there.

See what NIST CSF progress looks like in Constant. Book a call with our Australian based assessment team today.