NIST Cybersecurity Framework
Also known as CSF
A voluntary framework organizing security work into functions: govern, identify, protect, detect, respond, and recover.
It is a way of structuring a program rather than a checklist to pass. Its value is showing where effort is unbalanced, and most organizations that map themselves against it find heavy investment in protect and very little in detect and recover.
Because it is outcome-based it works at any size, and it maps cleanly to more prescriptive standards when you need to demonstrate coverage.
Where this comes up
NIST Cybersecurity Framework sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.