The framework shape: five goals, six NIST CSF 2.0 functions

Every senior CISO who reads the CSCRF master circular for the first time hits a structural question in the first five pages: is this a NIST-style function-based framework, or is it something else? The answer is both. CSCRF has two dimensions and understanding both is the difference between a CISO who can navigate the framework and one who is perpetually looking things up in the annexures. The two dimensions are the five resilience goals borrowed from CERT-In's National Cyber Crisis Management Plan and the six functional domains from NIST CSF 2.0. Together they form a two-axis map on which every specific control in CSCRF locates.

Why the shape matters more than any individual control

New CISOs at Regulated Entities frequently make one of two mistakes when they open CSCRF for the first time. Some try to memorise every control; the framework has hundreds of them and this approach collapses within days. Others skim the framework at a high level and then get lost in specific control language during audit preparation. The right approach is to internalise the shape first — five resilience goals, six NIST CSF functions — and let that shape function as a mental filing cabinet into which every control finds its natural home. With the shape internalised, a specific control question becomes a two-step lookup rather than a document search: which goal is served, which function is engaged, then which specific control within that function. This is what senior CISOs do in practice.

Dimension one: five cyber-resilience goals

SEBI adopts CERT-In's five cyber-resilience goals from the National Cyber Crisis Management Plan [L2-C1]. Every control in CSCRF ultimately serves at least one of these five:

• Anticipate. Situational awareness before an incident. Threat intelligence consumption. Attack surface management. Third-party risk mapping.
• Withstand. Controls that reduce the blast radius when an incident occurs. Access controls, encryption, network segmentation, secure architecture.
• Contain. Detection and response controls that stop lateral spread. SIEM correlation, EDR containment, playbook execution.
• Recover. Business continuity and disaster recovery. RTO / RPO management. Backup integrity. Interoperability invocation.
• Evolve. Post-incident learning. Threat model updates. Playbook revisions. Board reporting cycles.

Dimension two: six NIST CSF 2.0 functional domains

The five goals are implemented through the six functions of NIST Cybersecurity Framework 2.0 [L2-C2]:

1. Govern. Board Technology Committee, CISO reporting line, policies, risk appetite, third-party risk governance.
2. Identify. Asset inventory, data classification, threat identification, vulnerability management planning.
3. Protect. Access management, awareness training, data security, encryption, secure configuration.
4. Detect. Continuous monitoring, SIEM, anomaly detection, threat intelligence integration.
5. Respond. Incident response planning, communications, analysis, mitigation, improvements.
6. Recover. Recovery planning, improvements, communications.

NIST released CSF 2.0 in February 2024 and CSCRF was written to align to that version. The Govern function was newly elevated to a top-level function in CSF 2.0 (in CSF 1.1 it was a category within Identify). SEBI's decision to align to CSF 2.0 signals that Board governance is not an afterthought.

Reading the Govern function elevation as a signal

NIST CSF 2.0's elevation of Govern to a top-level function (rather than a Category within Identify as it was in CSF 1.1) reflects a shift in what regulators worldwide now expect. Governance is no longer a documentation exercise; it is the operating discipline that ties cyber-risk to enterprise risk, that connects the CISO to the Board Technology Committee, and that ensures cyber-risk appetite is defined at the Board level rather than inferred from operational choices. SEBI's alignment to CSF 2.0 rather than CSF 1.1 signals its expectation that Regulated Entity CISOs operate with meaningful Board mandate. Practitioner action: review your Board Technology Committee charter against the Govern function's Categories (GV.OC, GV.RM, GV.RR, GV.PO, GV.OV, GV.SC) and identify any gaps.

Standards CSCRF explicitly cross-references

• NIST CSF 2.0. Functional domain structure.
• ISO/IEC 27001:2022. Clauses 5 and 6 and Annex A. Certification became voluntary rather than mandatory in the 28 August 2025 Technical Clarifications [L2-C3].
• CIS Controls v8. Practical control catalogue.
• ISO 22301. Business Continuity Management.

NIST CSF 2.0 Implementation Tiers as a maturity vocabulary

NIST CSF 2.0 also defines four Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive) that describe how mature an organisation's cybersecurity posture is across the functions. CSCRF does not adopt Implementation Tiers as a formal element, but Qualified RE CCI submissions implicitly track a similar maturity progression. Practitioner action: map your CCI parameter scores to the NIST Implementation Tier vocabulary in your Board briefings — "we are at Repeatable across Protect and Detect, Partial in Govern" is more actionable Board language than a bare CCI number.

Where the CCI sits inside this shape

The Cyber Capability Index (Annexure K, covered in depth in Module 2) is a quantitative measurement of a Regulated Entity's maturity across the five goals through the six functions. Its 23 parameters are drawn from every functional domain. A high CCI score means functional coverage across all six functions in service of all five resilience goals. A low CCI score usually reveals concentration risk: an RE has invested heavily in Protect and Detect but has thin Govern or thin Recover, and that imbalance shows up in the score.

Practitioner shortcut

Whenever you read a specific CSCRF control, ask two questions:

1. Which of the five resilience goals is this control serving?
2. Which of the six NIST CSF 2.0 functions is this control located in?

Answering both places the control in the framework. This is how a senior CISO reads a 205-page document in an afternoon and comes out with a working mental model.

The 5 May 2026 AI Advisory as a Govern-function pull

The May 2026 AI Vulnerability Detection Advisory sits primarily in the Govern function of NIST CSF 2.0. It requires Board Technology Committee attention, an added risk-appetite statement covering AI-driven threats, and CISO-office alignment with the cyber-suraksha.ai task force. The subsequent operational implementations reach into Identify (adding AI attack vectors to threat models), Protect (virtual patching workflows), and Detect (updating SIEM correlation rules for autonomous-agent attack signatures). The Govern-first posture reflects SEBI's operating philosophy: elevate emerging systemic risks to Board attention before pushing them to operational teams.

How the goals-and-functions dimensions interact

Every CSCRF control lives at the intersection of one or more resilience goals and one or more functional domains. A concrete example: multi-factor authentication for privileged users serves the Withstand goal (reducing the blast radius of a credential compromise) and lives in the Protect function (specifically Access Management). Network segmentation for the trading platform serves both the Withstand goal (containing initial compromise) and the Contain goal (limiting lateral movement), and lives in the Protect function. Continuous monitoring of critical assets serves the Anticipate goal (situational awareness) and the Contain goal (fast detection) and lives in the Detect function. Practitioner exercise: pick any five controls from your CSCRF register and map each to its dominant goal and its NIST function. The mapping becomes a communication tool for Board briefings and audit-report drafts.

Comparing CSCRF against RBI Cybersecurity Framework and CERT-In Directions

For CISOs at hybrid entities (say, a bank-owned broker or an insurance-affiliated mutual fund) the CSCRF sits alongside the RBI Cybersecurity Framework (banks and NBFCs) and the CERT-In Directions of 28 April 2022 (all body corporates). All three share the NIST CSF backbone, and CSCRF's Principle of Equivalence permits reliance on RBI or IRDAI cyber audits where scope overlaps and evidence is preserved. Practitioner design: build one integrated compliance programme that satisfies the strictest requirement per obligation, and use the Equivalence principle to avoid duplicate audits where the scope truly overlaps. The 28 August 2025 Technical Clarifications gave this Equivalence principle formal life.