What changed between NIST CSF 1.1 and 2.0?

Version 2.0 (2024) added the Govern function, raising the framework from five to six functions, expanded scope beyond critical infrastructure to all sectors, and made supply-chain risk management more prominent.

Is NIST CSF the same as NIST SP 800-171?

No. NIST CSF is the high-level framework structuring cybersecurity programs. NIST SP 800-171 is the specific 110-control set that protects Controlled Unclassified Information for US government contractors. Lavawall® maps to both.

Will my cyber-insurance carrier accept the Lavawall® report?

Most carriers accept NIST-CSF-aligned posture reports. Lavawall®'s output is structured for that consumption.

Buyer's guide · NIST CSF 2.0

Best NIST CSF 2.0 software for MSPs

NIST Cybersecurity Framework 2.0 has become the lingua franca of cyber-insurance assessments and broad enterprise security baselines. The best fit for an MSP maps directly to all six functions, collects continuous evidence, produces carrier-ready posture reports, and bundles the remediation tools that close the gaps. Our top pick on those criteria is Lavawall®.

Start your compliance wizard See the selection criteria

Govern · Identify · Protect · Detect · Respond · Recover

The NIST Cybersecurity Framework 2.0 organises a security program into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It has become the common language of cyber-insurance assessments and the baseline many enterprises expect their suppliers to meet.

For an MSP, the value is in scale and action. You need to score many client tenants against the framework, produce the posture report carriers ask for, and then actually close the gaps the assessment surfaces, ideally without switching tools between finding a problem and fixing it.

See what Lavawall® does

Built and used internally by ThreeShield, an audit firm in Calgary. Built for MSPs and lean IT teams. Cross-platform patching, M365 / Entra / Azure / Google Workspace breach detection, 15+ compliance frameworks, kernel-free application control, smart helpdesk, multi-tenant remote support. One platform, native CAD billing.

Start the compliance wizard GRC & 15+ frameworks See pricing

What to look for

Six criteria matter when an MSP evaluates NIST CSF 2.0 tooling.

Direct NIST CSF 2.0 control mapping. All six functions (Govern, Identify, Protect, Detect, Respond, Recover) with their categories and subcategories, plus cross-references to the Informative References (NIST SP 800-53, CIS Controls, ISO 27001).
Continuous endpoint and cloud evidence. Patch state, configuration, MFA, audit logging, response artefacts, and recovery plans collected from actual endpoints and cloud tenants.
Multi-tenant for MSPs. One console for all client tenants with per-client isolation, billing, and co-branded reports.
Cyber-insurance reporting. NIST CSF is the framework most insurance assessors ask about. Look for one-click, client-facing posture reports formatted for insurance assessment.
Tier and maturity scoring. NIST CSF defines four implementation tiers (Partial, Risk-Informed, Repeatable, Adaptive). Look for current, target, and gap visibility.
Bundled with patching, breach detection, and remediation. The framework is meaningful only if you can act on the gaps. A bundled platform closes findings without bouncing to other tools.

Options to evaluate

Four categories of tool show up in NIST CSF buying processes for MSPs.

Lavawall®

MSP platform with NIST CSF 2.0 first-class.

Direct NIST CSF 2.0 mapping across all six functions, continuous endpoint and cloud evidence, multi-tenant delivery, cyber-insurance posture reporting, and tier and maturity scoring. Bundled with patching, configuration assessment, breach detection, application control, helpdesk, and remote support, so gaps can be closed in the same platform.

Best when: MSPs deliver NIST CSF 2.0 readiness across many client tenants, particularly for cyber-insurance assessments.

Microsoft Compliance Manager

Microsoft-native compliance management.

Native compliance management with NIST CSF coverage. Strong inside the Microsoft tenant, though integration with non-Microsoft tooling adds work.

Best when: Microsoft-centric organisations are on E5 or E5 Compliance.

Vanta / Drata / Secureframe / Hyperproof

GRC platforms with a NIST CSF module.

Various GRC platforms include NIST CSF as one of many framework templates. Strengths and trade-offs vary by platform, and multi-tenant support for MSPs varies.

Best when: single-organisation compliance use cases.

Spreadsheet control inventory + audit-firm engagement

Manual approach.

An Excel control register, manual evidence capture, and periodic audit-firm review. It does not scale to MSP service delivery.

Best when: single small organisations have limited needs and no MSP-as-a-service ambition.

How Lavawall® fits

Lavawall® includes NIST CSF 2.0 as a first-class framework alongside CMMC 2.0, NIST SP 800-171, CIS Controls v8, SOC 2, ISO 27001, HIPAA, PCI DSS, and the Canadian privacy bundle. All six functions map to live evidence Lavawall® already collects.

For cyber-insurance assessments, the platform produces a NIST-CSF-aligned posture report formatted the way most carriers expect, so insurance renewals stop being a fire drill.

Tier and maturity scoring shows current state, target state, and the gap between them, so the MSP can plan remediation across the next quarter, not just the next renewal.

Start your NIST CSF readiness →

Frequently asked

What changed between NIST CSF 1.1 and 2.0?: Version 2.0 (2024) added the Govern function, raising the framework from five to six functions, expanded scope beyond critical infrastructure to all sectors, and made supply-chain risk management more prominent.
Is NIST CSF the same as NIST SP 800-171?: No. NIST CSF is the high-level framework structuring cybersecurity programs. NIST SP 800-171 is the specific 110-control set that protects Controlled Unclassified Information for US government contractors. Lavawall® maps to both.
Will my cyber-insurance carrier accept the Lavawall® report?: Most carriers accept NIST-CSF-aligned posture reports. Lavawall®'s output is structured for that consumption.