NIST Cybersecurity Framework 2.0
Voluntary. This is NIST guidance, not legislation. It is not Australian law and it is not a condition of legal practice unless a contract mandates it.
Voluntary guidance that organises cybersecurity outcomes into six functions. It does not prescribe how an organisation achieves them.
MaintainedLast reviewed
Key facts
- Issued by
- National Institute of Standards and Technology
- Sources listed
- 2
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
NIST Cybersecurity Framework 2.0, NIST CSWP 29, was published on 26 February 2024. NIST says it provides guidance to industry, government and other organisations to manage cybersecurity risks. It offers a taxonomy of high-level outcomes that any organisation, of any size, sector or maturity, can use to understand, assess, prioritise and communicate its cybersecurity efforts.
The document says the CSF does not prescribe how outcomes should be achieved. It links to other resources for practices and controls. The six functions are Govern, Identify, Protect, Detect, Respond and Recover. Govern is described as the function that sets strategy, expectations and policy, and that informs the other five. The outcomes apply to information technology, operational technology and the Internet of Things, and NIST says they apply to cloud, mobile and artificial intelligence environments. The order of the functions is not an order of importance.
Who it applies to
NIST wrote the framework for any organisation. It is not Australian law and it is not a condition of legal practice. A firm, or a vendor, can use it as a way to describe cybersecurity effort. Using the words is not the same as having done the work.
What it asks of a law firm using AI
- The Core is outcomes, not a checklist of actions. NIST says the actions, and who performs them, vary by organisation.
- Govern covers organisational context, cybersecurity strategy, supply-chain risk, roles and policy. Identify covers understanding assets, suppliers and risks. Protect covers safeguards, including identity, training, data security and platform security. Detect covers finding and analysing possible attacks. Respond covers action on an incident. Recover covers restoring assets and operations.
- A CSF profile is an organisation’s current or target posture expressed in those outcomes. NIST does not issue a CSF certificate.
- Do not treat a vendor’s “aligned to NIST CSF” sentence as evidence of a particular control, a particular region, or a particular AI feature.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Not set here. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | The six functions are a way to organise questions for a vendor or for the firm’s own network: who governs, what assets exist, what is protected, what is detected, and what happens in an incident. The framework does not answer those questions. |
| Confidentiality Whether client and other confidential information can go into the tool. | Protect includes data security outcomes. That is not a statement of a solicitor’s duty, and it does not decide what may be typed into a model. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Respond and Recover include communication during an incident. NIST does not set an Australian notifiable-breach test, and it does not set a client-disclosure rule. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | CSF 2.0 is not a certification. Do not record it in the ISO, SOC 2 or IRAP fields. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | Not set here. |
Sources
Checked 2026-10-10. Issued by National Institute of Standards and Technology.