Where can I get NIST CSF 2.0 policy templates?

Start with the free routes. NIST publishes Quick Start Guides, Implementation Examples, the CSF 2.0 Reference Tool and an Organizational Profile template. SANS and CIS publish free policy templates. CIS also offers a free mapping of its Controls to CSF 2.0; SANS policies you map to the CSF yourself. For a packaged set built around the six CSF 2.0 Functions, ComplianceDocs sells the NIST CSF 2.0 Complete Toolkit for $79 one-time: 15 editable policies and plans plus a Profile and Assessment workbook covering all 106 Subcategories.

Are there free NIST CSF 2.0 templates?

Yes. NIST publishes a free Organizational Profile template, a spreadsheet for recording Current and Target Profiles, and a free Small Business Quick-Start Guide. ComplianceDocs publishes all 106 Subcategories as a free Excel list with no email required. For written policies, SANS and CIS offer free templates, though neither library is organized by CSF Function. A free 2019 MS-ISAC guide maps CSF 1.1 subcategories to SANS templates, but it predates CSF 2.0.

Is there a NIST CSF certification?

Not from NIST. NIST says it "does not offer certifications or endorsements of CSF-related products, implementations, or services, and there are no plans to develop a conformity assessment program." Private programs exist. Some firms sell CSF assessments; one we checked on October 17, 2026, says its result is a findings report and a Tier rating. The Secure Controls Framework says an "SCR Certified - NIST CSF 2.0" certification can be obtained through a conformity assessment governed by The Cyber AB. Those are private programs, not NIST certifications. What you can produce yourself is a documented self-assessment: your Current and Target Profiles.

How much do NIST CSF policy templates cost?

NIST's own CSF resources cost nothing, and the SANS and CIS policy templates are free. Paid template sets vary by seller; the ComplianceDocs NIST CSF 2.0 Complete Toolkit is $79 one-time for one organization. Compliance platforms are priced by the vendor, and consultants or assessors quote per scope. None of these prices buys a NIST certificate, because NIST does not issue one.

Will NIST CSF templates make my organization compliant?

No. No template, free or paid, makes an organization compliant or certified. Templates give you written policies and a place to record your Profile. You still assess your organization honestly, operate the controls the documents describe, train your people and keep the Profile current. If a customer or contract requires the CSF, ask them what evidence they expect.

Where to Buy NIST CSF 2.0 Policy Templates (2026): Free NIST Resources, Paid Sets and Consultants

There are four routes to NIST CSF 2.0 policy templates: free resources, paid editable template sets, compliance software platforms, and consultants or outside assessors. Start with the free resources. NIST publishes Quick Start Guides, Implementation Examples, a Reference Tool and a Profile template. SANS and CIS publish free policy templates. The CSF is voluntary for most organizations, and NIST does not certify anyone against it. No template, free or paid, makes an organization compliant or certified. Our NIST CSF 2.0 Complete Toolkit is one paid option at $79 one-time: 15 editable policies and plans plus 3 Excel workbooks.

Reviewed by Dor Israel, Founder · Updated October 18, 2026

Related toolkit: NIST CSF 2.0 Complete Toolkit ($79)

Free: all 106 NIST CSF 2.0 subcategories as an Excel list →

What NIST CSF 2.0 is, and why NIST issues no CSF certificate

NIST published the Cybersecurity Framework (CSF) 2.0 on February 26, 2024, as NIST CSWP 29. It is a set of cybersecurity outcomes that any organization can use, whatever its size or sector. NIST says the CSF "does not prescribe how outcomes should be achieved."

The CSF is voluntary for most organizations. In NIST's words, "most organizations use the CSF on a voluntary basis." NIST names two exceptions. Executive Order 13800 made it mandatory for US federal agencies, and "some companies require the CSF for their customers or within their supply chain." If a customer or contract asks for it, the requirement comes from that customer or contract, not from NIST, which is not a regulator.

NIST does not certify anyone against the CSF. It states that it "does not offer certifications or endorsements of CSF-related products, implementations, or services, and there are no plans to develop a conformity assessment program." Private programs exist. Some firms sell CSF assessments. One we checked on October 17, 2026, says its assessment produces a findings report and a Tier rating, not a pass or fail.

On October 17, 2026, the Secure Controls Framework website said an "SCR Certified - NIST CSF 2.0" certification can be obtained through a conformity assessment governed by The Cyber AB. These are private programs, not NIST certifications. What NIST describes is an Organizational Profile you build yourself, including a Current Profile that you can use to communicate your capabilities to "business partners or prospective customers."

Functions, Profiles and Tiers: what your documents must support

CSF 2.0 organizes its outcomes into six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new in 2.0. NIST describes it as the Function where "the organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored." Below the Functions sit 22 Categories and 106 Subcategories. NIST says these outcomes "are not a checklist of actions to perform."

Policy is one of those outcomes. Subcategory GV.PO-01 reads: "Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced." The CSF does not hand you a list of documents to write. Your policies should match the outcomes you choose and how you actually operate.

Profiles are where you record your position. A Current Profile states which outcomes you achieve today and to what extent. A Target Profile states the outcomes you have chosen and prioritized. The gap between them becomes your action plan, which NIST says can take the form of a risk register.

Tiers describe how rigorous your risk practices are: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). Using the Tiers is optional: NIST says an organization "can choose to use the Tiers to inform its Current and Target Profiles." NIST encourages moving up a Tier "when risks or mandates are greater or when a cost-benefit analysis indicates a feasible and cost-effective reduction of negative cybersecurity risks."

Start with the free resources

Much of what a CSF program needs is free, and some of it comes from NIST itself:

Quick Start Guides, including the Small Business Quick-Start Guide (NIST SP 1300) for businesses "who have modest or no cybersecurity plans in place."
Implementation Examples: "notional examples of concise, action-oriented steps" for each Subcategory. NIST adds that they do not represent "a baseline of required actions."
The CSF 2.0 Reference Tool, which lets you explore and export the Core, the Informative References and the Implementation Examples.
The Organizational Profile template, a NIST spreadsheet for building Current and Target Profiles side by side.
Our free NIST CSF 2.0 subcategories list: all 106 Subcategories in one Excel file, with the Function, the Category and the toolkit document for each Category. No email required.

For the policies themselves, two free libraries are worth checking. SANS, with the Cybersecurity Risk Foundation, publishes a library of free security policy templates. Its listing showed 36 templates on October 17, 2026, and the template page we opened offered PDF and Word downloads. CIS publishes policy templates aligned to CIS Controls v8 and v8.1, written for Implementation Group 1 safeguards only. Each of its 13 English v8.1 templates downloaded as a Word file with no sign-up when we checked on October 17, 2026. Neither library is organized by the six CSF Functions.

CIS also publishes a free spreadsheet that maps its v8.1 Controls and Safeguards to CSF 2.0, including sheets that list what does not map. It downloaded with no sign-up when we checked on October 17, 2026. We found no CSF mapping on the SANS pages we checked that day.

The Multi-State Information Sharing and Analysis Center (MS-ISAC) published a free 2019 guide, hosted on the CIS website, that maps CSF subcategories to SANS policy templates. It predates CSF 2.0: it uses the CSF 1.1 subcategory codes and has no Govern Function. If you use it, check that the templates it names are still in the SANS library. For CSF 2.0, plan to map SANS policies to the CSF yourself.

The routes compared

The table covers the documentation layer only: the policies, plans and Profile workbook. No route on this list operates your controls for you, and none ends in a NIST certificate.

You do not need a consultant to use the CSF. NIST says outside experts "are not required to implement the CSF," and that it "does not provide recommendations for consultants or assessors."

Route	What you get	Cost
NIST free resources	Quick Start Guides, Implementation Examples, the CSF 2.0 Reference Tool and an Organizational Profile spreadsheet	$0
Free policy libraries (SANS, CIS)	Individual editable policies, not organized by CSF Function. CIS publishes a free mapping of its Controls to CSF 2.0; for SANS, you map the policies yourself	$0
Paid editable template set	A packaged set of policies and plans in editable files; contents vary, so check for a Profile workbook	Varies by seller; ours is $79 one-time
Compliance platform	A policy library plus task and evidence tracking in a software product	Priced by the vendor
Consultant or outside assessor	Outside help, or an independent findings report and Tier rating; never a NIST certificate	Quoted per scope

The ComplianceDocs price is our published one-time price. We do not quote other sellers' prices here; check each seller's current page. Free offerings change, so confirm current terms at the source.

What to check before you buy NIST CSF templates

The same checks apply to free and paid sources:

Check	Why it matters
Built to CSF 2.0, including Govern	CSF 2.0 has six Functions; CSF 1.1 had five. Check that the set maps to Govern, including its Categories on policy, oversight and supply chain risk management.
A Profile or assessment workbook	You need a place to record a priority and a status for each of the 106 Subcategories. NIST publishes a free Profile template if a set lacks one.
Editable Word and Excel files	A policy must describe how you actually operate. You need to edit every line and assign real owners.
A free preview of real content	Read actual policy text before you pay, not only a table of contents.
Clear license terms	Know whether you get a perpetual license for one organization or rent access through a subscription.

No template set, however complete, makes an organization compliant or certified. You still perform the self-assessment and run the controls.

Where ComplianceDocs fits, and what no template does

ComplianceDocs is one paid option. The free routes above are real, and for some teams they are enough. The NIST CSF 2.0 Complete Toolkit is $79 one-time. It contains 15 editable Word policies, procedures and plans that span all six Functions, from the Cybersecurity Governance Policy to the Incident Recovery Plan. It also contains 3 Excel workbooks: a Profile and Assessment workbook that lists all 106 Subcategories, a risk register and an audit evidence checklist.

In the Profile workbook you set a priority, a status and a target date for each Subcategory, and note where the evidence lives. Every status starts at "Not started." Thirty rows carry a suggested priority and name the document that covers them; you set the priority for the rest. Files arrive by instant download under a single-organization license, and you can read a free preview of the governance policy before you buy.

What the toolkit does not do: it does not assess your organization, complete your Profile, operate your controls or train your staff. You tailor documents instead of drafting from a blank page, but the self-assessment and the operating work stay with you. These are professional templates, not legal advice. No template makes an organization compliant or certified, and for the CSF no NIST certificate exists to earn.

Frequently asked questions

Where can I get NIST CSF 2.0 policy templates?: Start with the free routes. NIST publishes Quick Start Guides, Implementation Examples, the CSF 2.0 Reference Tool and an Organizational Profile template. SANS and CIS publish free policy templates. CIS also offers a free mapping of its Controls to CSF 2.0; SANS policies you map to the CSF yourself. For a packaged set built around the six CSF 2.0 Functions, ComplianceDocs sells the NIST CSF 2.0 Complete Toolkit for $79 one-time: 15 editable policies and plans plus a Profile and Assessment workbook covering all 106 Subcategories.Related: NIST CSF 2.0 Complete Toolkit · Free preview of the governance policy
Are there free NIST CSF 2.0 templates?: Yes. NIST publishes a free Organizational Profile template, a spreadsheet for recording Current and Target Profiles, and a free Small Business Quick-Start Guide. ComplianceDocs publishes all 106 Subcategories as a free Excel list with no email required. For written policies, SANS and CIS offer free templates, though neither library is organized by CSF Function. A free 2019 MS-ISAC guide maps CSF 1.1 subcategories to SANS templates, but it predates CSF 2.0.Related: Free NIST CSF 2.0 subcategories list (Excel) · NIST CSF 2.0 Profiles and template · NIST CSF 2.0 Quick Start Guides · MS-ISAC NIST CSF policy template guide (2019, PDF)
Is there a NIST CSF certification?: Not from NIST. NIST says it "does not offer certifications or endorsements of CSF-related products, implementations, or services, and there are no plans to develop a conformity assessment program." Private programs exist. Some firms sell CSF assessments; one we checked on October 17, 2026, says its result is a findings report and a Tier rating. The Secure Controls Framework says an "SCR Certified - NIST CSF 2.0" certification can be obtained through a conformity assessment governed by The Cyber AB. Those are private programs, not NIST certifications. What you can produce yourself is a documented self-assessment: your Current and Target Profiles.Related: NIST CSF FAQs
What policies does NIST CSF 2.0 require?: The CSF does not prescribe a list of documents. It describes outcomes, and NIST says they "are not a checklist of actions to perform." The Govern Function does include policy outcomes. GV.PO-01 reads: "Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced." Our toolkit's 15 documents are our product structure, not a NIST requirement.Related: Documents per compliance framework · Cybersecurity Governance Policy template · NIST CSF guide
How much do NIST CSF policy templates cost?: NIST's own CSF resources cost nothing, and the SANS and CIS policy templates are free. Paid template sets vary by seller; the ComplianceDocs NIST CSF 2.0 Complete Toolkit is $79 one-time for one organization. Compliance platforms are priced by the vendor, and consultants or assessors quote per scope. None of these prices buys a NIST certificate, because NIST does not issue one.Related: NIST CSF 2.0 Complete Toolkit · Free preview of the governance policy
Will NIST CSF templates make my organization compliant?: No. No template, free or paid, makes an organization compliant or certified. Templates give you written policies and a place to record your Profile. You still assess your organization honestly, operate the controls the documents describe, train your people and keep the Profile current. If a customer or contract requires the CSF, ask them what evidence they expect.Related: NIST CSF guide · Free preview of the governance policy

Related guides: NIST CSF 2.0

Toolkits that help

NIST CSF 2.0

NIST CSF 2.0 Complete Toolkit

15 editable policies and plans covering all six CSF 2.0 functions, plus a Profile & Assessment workbook with every one of the 106 subcategories, a risk register, and an audit evidence checklist.

$79View toolkit

Get new templates and guides by email

An occasional email when we publish a new free template, guide, or dataset. Unsubscribe any time.

← All articles