NIST · Cybersecurity Framework 2.0

Consulting and Implementation
NIST CSF 2.0

In a digital environment where threats are constantly evolving, proactive cybersecurity management is more than a necessity; it is a strategic advantage.

Phase I, Organizational Understanding
Initial diagnosis and context
Phase II, Risk Assessment
Threats, vulnerabilities, and impact
Phase III, Current vs. Target Profile
Gap analysis and action plan
Phase IV, Operational Implementation
Technical and organizational controls
Phase V, Governance and Continuous Improvement
Monitoring and sustainable evolution
The frame

What is NIST CSF 2.0?

The NIST Cybersecurity Framework (CSF) 2.0 represents the most significant evolution in cyber risk management, expanding its scope to be applicable to organizations of any size and sector. Its approach focuses not only on protecting critical infrastructure but on integrating cybersecurity into the core of business strategy.

The NIST Cybersecurity Framework 2.0 has been updated to reflect current cyberspace challenges, and incorporates the Govern function in addition to the traditional Identify, Protect, Detect, Respond, and Recover functions.

Our services

How we work

01Organizational understanding / initial assessment
In the initial phase, activities are carried out to understand the organization, its context, resources, critical processes, and security maturity level. To perform this task, it will be necessary to:
  • Analyze products, services, and operating models.
  • Review existing regulations, policies, and controls.
  • Inventory assets, information flows, and technological infrastructure.
  • Engage in conversations with key stakeholders to identify priorities and risk tolerance.
02Risk assessment
This phase constitutes the fundamental pillar for understanding the organization's real level of exposure to cyber threats. At this point, the objective is to identify, analyze, and prioritize the risks that could compromise the confidentiality, integrity, and availability of critical assets, considering both internal and external threats.
  • Identification of critical assets.
  • Identification of threats and vulnerabilities.
  • Assessment of the impact and probability of adverse events.
  • Determination of risk appetite/tolerance.
  • Mapping risks in relation to CSF functions.
03Current profile vs. target profile and action plan design
Establish where the organization stands today (current maturity), where it aims to be (target), and plan how to close gaps. In this phase, a plan will be drafted to identify the measures that must be developed to achieve improvements in the organization's security maturity.
  • Assessment of the current state according to CSF 2.0 functions and categories.
  • Definition of the target profile aligned with strategy, resources, and regulation.
  • Identification of critical gaps.
  • Design of a roadmap or action plan with priorities, responsibilities, timelines, and resources.
04Operational implementation
This phase is the moment when the strategy defined in previous phases is converted into tangible actions. Here, the action plan designed during the gap analysis comes to life through the execution of security controls, processes, and practices that strengthen the organization's cybersecurity posture.
  • Development or improvement of policies, procedures, and roles.
  • Implementation of technical and organizational controls (protection, detection, response, recovery, governance).
  • Staff training and awareness.
  • Security architecture, monitoring, incident response, backups, and recovery.
05Governance, monitoring, and continuous improvement
Ensuring that the implementation of the NIST CSF 2.0 is not a one-time project, but rather a sustainable and constantly evolving process, will be the purpose of this final phase. A clear governance framework will be established, with roles, responsibilities, and oversight mechanisms that ensure cybersecurity remains aligned with the strategic objectives of the business.
  • Establish governance mechanisms: responsibilities, committee, reports to management.
  • Metrics, internal/periodic audits, performance reviews.
  • Lessons learned after incidents or tests.
  • Updating the target profile as threats, technology, and regulations change.
Related Services
ISO 27032 Cybersecurity Framework ISO 27001 Management Systems ISO 42001 AIMS Implementation NIS2 Implementation CRA Evaluation and Support DORA Implementation GDPR / LOPDGDD Consulting

Scope of service

What this service covers

Risk visibility

Clear visibility of risks, threats, and critical assets across the organization

Investment prioritization

Strategic prioritization of security investments to maximize return and minimize exposure.

Continuous improvement

Continuous improvement and progress measurement through current vs. target profiles.

Corporate governance

Strengthening corporate governance and assigning responsibilities.

Incident resilience

Cyber incident resilience of all kinds: ransomware, data breaches, operational failures, etc.

Standards and regulations

Compliance with local and international standards and regulations, facilitating audits and building customer/user trust.

Testimonials

What our clients say

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental to strengthening our information security management system.

Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona

The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.

CISO
RACC

On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.

Yulian Colmenares
Information Security Office · Outsourcing SAS BIC

Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.

Andrés Mejía
Head of GRC · Payválida

As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner for the implementation of the requirements set by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…

Victoria Villarreal Palazón
Vice-Rector & Associate VP CFO · Saint Louis University

As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.

Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain

As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the fact that PCI-CPP regulations require us to perform four internal and external vulnerability scans and an annual internal and external penetration test, but also because of the security and peace of mind our company aims to provide to each and every one of our clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.

Sergio Sainz de la Maza
CISO · Intaremit

At Grupo Arbulu, we have collaborated closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.

Marcos Montes de Oca
CIO · Arbulu Group

As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently perform a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

Miguel Acosta
Global CEO · Beruby

At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.

Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group

Frequently Asked Questions

We answer your questions

What is NIST CSF 2.0?

The NIST Cybersecurity Framework (CSF) 2.0 is an international reference framework that helps organizations manage and reduce their cybersecurity risks. Published by the U.S. National Institute of Standards and Technology, it is applicable to organizations of any size and sector. Its 2.0 version incorporates the Governance function alongside the five traditional functions.

What are the six functions of the NIST CSF 2.0?

The six functions are: Govern, Identify, Protect, Detect, Respond, and Recover. The Govern function is the main novelty of version 2.0, which establishes strategic oversight and responsibilities for cyber risk management.

Who is this service for?

For any organization that needs to manage its cybersecurity risks in a structured way, regardless of its size or sector. It is especially relevant for companies looking to align their security strategy with international standards, comply with regulations, or improve their cybersecurity posture in a measurable way.

Is NIST CSF 2.0 certifiable?

NIST CSF 2.0 is not a certifiable standard like ISO 27001. It is a voluntary framework that allows organizations to assess and improve their cybersecurity posture. However, its implementation is widely recognized and complements certifications such as ISO 27001 and regulatory frameworks like NIS2 or DORA.

What is the difference between NIST CSF 2.0 and ISO 27001?

ISO 27001 is a certifiable standard focused on an Information Security Management System (ISMS), while NIST CSF 2.0 is a flexible framework oriented toward cyber risk management. Both are complementary: NIST CSF 2.0 provides a strategic and maturity-based view, and ISO 27001 defines detailed operational controls.

Contact

Do you need to implement NIST CSF 2.0?

Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.

Offices
Barcelona · Madrid · Bogotá
R
Ricardo Andrés Cárdenas
2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.

A
Andrés Mejía
3 months ago

Your team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

V
Victoria Villarreal Palazón
4 months ago

They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.

M
Miguel Acosta
5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend your services to any company in need of cybersecurity solutions.

S
Sergio Sainz de la Maza
6 months ago

We have been working with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility. I recommend them without hesitation.

Request information

We will contact you as soon as possible.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88
25
years of experience in cybersecurity
Contact us