NIST CSF 2.0 is converging with the AI Risk Management Framework, and CISOs need a single compliance approach that covers both. In December 2025, NIST released a preliminary draft of the Cyber AI Profile. In short, it applies the six CSF functions (Govern, Identify, Protect, Detect, Respond and Recover) directly to AI-specific risks. The Govern function added in NIST CSF 2.0 also turns cybersecurity into a strategic discipline with clear board-level accountability. Yet this arrives alongside framework sprawl, as organizations also deal with the EU AI Act, NIS2, DORA, ISO 42001 and sector rules. This guide explains why the convergence matters, what the Cyber AI Profile asks for and how CISOs can build one integrated compliance program.
What Changed in NIST CSF 2.0 and Why It Matters
NIST CSF 2.0 is the first major revision of the Cybersecurity Framework since it was created in 2014. It changes cybersecurity governance in three ways that CISOs need to act on.
First, the new Govern function makes cybersecurity strategy, risk ownership and executive accountability explicit. By contrast, in version 1.1, governance sat inside the Identify function without a clear structure. Now, however, Govern sits at the center of the framework and shapes how every other function is carried out. So CISOs are expected to show how security decisions link to enterprise strategy and board oversight, not just which controls exist.
Second, the scope widened from critical infrastructure operators to every organization, whatever its size, sector or maturity. As a result, organizations that once saw the framework as optional now feel pressure to adopt it, because customers and cyber insurers increasingly use it as a baseline. Third, the subcategories were reorganized from 108 to 106, with overlapping outcomes merged and wording focused on measurable results instead of prescribed controls.
NIST CSF 2.0 organizes cybersecurity outcomes across six functions. Govern sets strategy, policy, oversight and supply chain risk management. Identify works out which assets, data and systems need protection, and Protect puts safeguards around them. Detect spots cybersecurity events and anomalies, Respond acts on detected incidents and Recover restores operations afterwards. Also, the six functions run together as a continuous process, not a step-by-step checklist.
How the Cyber AI Profile Bridges NIST CSF 2.0 and AI RMF
The Cyber AI Profile, released in draft in December 2025, connects NIST CSF 2.0 with the AI Risk Management Framework. So organizations can manage AI-related cybersecurity risk without building a separate compliance program.
The Compliance Convergence CISOs Must Navigate with NIST CSF 2.0
The convergence of NIST CSF 2.0, the AI RMF and the Cyber AI Profile sits within a wider set of overlapping frameworks and regulations that CISOs must manage at the same time.
| Framework or Regulation | Scope | NIST CSF 2.0 Alignment |
|---|---|---|
| NIST AI RMF | AI trustworthiness: govern, map, measure, manage | ✓ Bridged through Cyber AI Profile |
| ISO 42001 | First certifiable AI Management System standard | ✓ Complements CSF with lifecycle oversight |
| EU AI Act | Legal requirements for AI ethics, safety, transparency | ◐ Maps to CSF outcomes but adds regulatory mandates |
| NIS2 | EU network and information security for critical sectors | ✓ Pillars closely aligned with CSF functions |
| CSA AICM | Cloud-specific AI controls: 243 objectives, 18 domains | ◐ Operationalizes NIST strategies with specific controls |
These frameworks rarely add entirely new requirements. Instead, they expose weaknesses in static, siloed compliance programs and reward continuous oversight, measurable outcomes and executive ownership. Many regulators are also moving from periodic audits toward continuous compliance, so a unified structure matters. CISOs who anchor governance in the framework and extend it through the Cyber AI Profile can build one compliance backbone that maps to many requirements, instead of a separate program for each.
Implementing every framework separately creates overhead that uses resources without reducing risk in proportion. A better approach layers a small set of foundation frameworks anchored in NIST CSF 2.0, extends them with AI governance through the Cyber AI Profile and ISO 42001, and adds regulatory overlays only where a mandate requires extra controls. This layered model cuts duplication while covering cybersecurity, AI governance and regulation together.
Talk to an ExpertJuggling CSF 2.0, the AI RMF and NIS2? Map them into one program with us.
Practical Steps for Integrating NIST CSF 2.0 with AI Governance
For organizations without unlimited compliance resources, the overlap between NIST CSF 2.0 and the AI RMF can be handled with a focused approach that starts small and scales. Begin where the two frameworks meet in their Govern functions, because both set organizational accountability, risk ownership and policies that link security operations to business strategy.
Five Priorities for NIST CSF 2.0 Compliance in 2026
Based on the framework updates and the regulatory picture, here are five priorities for CISOs building an integrated program around NIST CSF 2.0:
- Build out the Govern function first: Formal governance is the main gap for many organizations, so audit current practices and map them to the six Govern categories. That establishes executive accountability.
- Fold the Cyber AI Profile into your existing CSF program: The profile applies CSF structure to AI risk, so extend your current program instead of creating a parallel one for AI. AI governance then runs through existing processes.
- Create full AI asset inventories: The profile calls for inventories of models, agents, APIs and datasets, so start cataloging every AI system. Then map data flows to see where exposure sits.
- Use NIST CSF 2.0 as the backbone for multi-framework compliance: NIS2, DORA and ISO 42001 map to CSF outcomes, so build one integrated program instead of separate silos. That reduces duplication while meeting several mandates.
- Move from periodic audits to continuous compliance: Regulators are moving toward continuous oversight, so invest in automated control monitoring. You then stay ahead of expectations instead of catching up.
The Bottom Line
Key Takeaway NIST CSF 2.0 and the AI RMF are converging through the Cyber AI Profile, which gives one framework for cybersecurity and AI risk. The new Govern function makes cybersecurity a board-level discipline. The Cyber AI Profile applies CSF structure across three focus areas: secure AI systems, defend with AI and thwart AI-enabled attacks. CISOs who anchor governance in CSF 2.0 and extend it through the profile can build one compliance backbone that maps to NIS2, the EU AI Act, ISO 42001 and sector rules, which cuts framework sprawl.
Looking Ahead: NIST CSF 2.0 and AI Governance Beyond 2026
The framework is likely to become the common anchor for cybersecurity and AI governance as regulations converge. The AI RMF is also being revised under the US AI Action Plan, and later versions may align more closely with CSF structure. Meanwhile, continuous compliance is replacing static audits, so integrating frameworks becomes a practical necessity.
The pace of AI change, however, will keep testing governance frameworks. Organizations with adaptable, layered compliance designs will handle regulatory change better than those locked into a single rigid framework. The CISOs who succeed will treat frameworks as connected tools for making decisions, not as obligations to tick off.
For compliance and risk leaders, the framework is the foundation for every other governance requirement. Its outcome-based, sector-neutral design suits programs that must span cybersecurity, AI governance, privacy and operational resilience across many jurisdictions, as AI rules keep growing in scope.
Our SolutionCybersecurity Risk Assessment and Security Posture Management
Frequently Asked Questions
References
- Cyber AI Profile Draft, Three Focus Areas, CSF 2.0 + AI RMF Integration, AI Inventories: National Law Review — NIST Issues Preliminary Draft of Cyber AI Profile
- Framework Convergence, Layered Operating Model, ISO 42001, Regulatory Pressures: CyberSaint — Top Security, Risk, and AI Governance Frameworks for 2026
- CSF 2.0 Structure, Six Functions, 106 Subcategories, Govern Function, Implementation: Isora GRC — NIST CSF 2.0 Complete Guide 2026
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.