NIST CSF 1.1 to 2.0: where the withdrawn subcategories went

NIST published CSF 2.0 in February 2024 with a new Govern function and a reorganised core. Many CSF 1.1 subcategories didn't survive in their old form: they were moved to a new identifier or incorporated into a broader one. NIST recorded where every one went, in the withdrawal notes of its CSF 2.0 data.

That matters more than it sounds. Policies, risk registers, GRC tools, vendor questionnaires and countless spreadsheets still cite CSF 1.1 identifiers. A mapping to a withdrawn subcategory isn't an error anyone notices; it's a link to nowhere. ControlMapping's build fails on any withdrawn ID for exactly this reason.

The full table

Every CSF 1.1 subcategory that NIST withdrew in 2.0, and what NIST says happened to it:

CSF 1.1	What happened in CSF 2.0 (NIST)
DE.AE-01	Incorporated into ID.AM-03
DE.AE-05	Moved to DE.AE-08
DE.CM-04	Incorporated into DE.CM-01, DE.CM-09
DE.CM-05	Incorporated into DE.CM-01, DE.CM-09
DE.CM-07	Incorporated into DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09
DE.CM-08	Incorporated into ID.RA-01
DE.DP-01	Incorporated into GV.RR-02
DE.DP-02	Incorporated into DE.AE
DE.DP-03	Incorporated into ID.IM-02
DE.DP-04	Incorporated into DE.AE-06
DE.DP-05	Incorporated into ID.IM, ID.IM-03
ID.AM-06	Incorporated into GV.RR-02, GV.SC-02
ID.BE-01	Incorporated into GV.OC-05
ID.BE-02	Incorporated into GV.OC-01
ID.BE-03	Incorporated into GV.OC-01
ID.BE-04	Incorporated into GV.OC-04, GV.OC-05
ID.BE-05	Incorporated into GV.OC-04
ID.GV-01	Incorporated into GV.PO, GV.PO-01, GV.PO-02
ID.GV-02	Incorporated into GV.OC-02, GV.RR, GV.RR-02
ID.GV-03	Moved to GV.OC-03
ID.GV-04	Moved to GV.RM-04
ID.RM-01	Incorporated into GV.RM-01, GV.RM-06, GV.RR-03
ID.RM-02	Incorporated into GV.RM-02, GV.RM-04
ID.RM-03	Moved to GV.RM-02
ID.SC-01	Incorporated into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10
ID.SC-02	Incorporated into GV.OC-02, GV.SC-03, GV.SC-04, GV.SC-07, ID.RA-10
ID.SC-03	Moved to GV.SC-05
ID.SC-04	Incorporated into GV.SC-07, ID.RA-10
ID.SC-05	Incorporated into GV.SC-08, ID.IM-02
PR.AC-01	Incorporated into PR.AA-01, PR.AA-05
PR.AC-02	Moved to PR.AA-06
PR.AC-03	Incorporated into PR.AA-03, PR.AA-05, PR.IR-01
PR.AC-04	Moved to PR.AA-05
PR.AC-05	Incorporated into PR.IR-01
PR.AC-06	Moved to PR.AA-02
PR.AC-07	Moved to PR.AA-03
PR.AT-03	Incorporated into PR.AT-01, PR.AT-02
PR.AT-04	Incorporated into PR.AT-02
PR.AT-05	Incorporated into PR.AT-02
PR.DS-03	Incorporated into ID.AM-08, PR.PS-03
PR.DS-04	Moved to PR.IR-04
PR.DS-05	Incorporated into PR.DS-01, PR.DS-02, PR.DS-10
PR.DS-06	Incorporated into PR.DS-01, DE.CM-09
PR.DS-07	Incorporated into PR.IR-01
PR.DS-08	Incorporated into ID.RA-09, DE.CM-09
PR.IP-01	Incorporated into PR.PS-01
PR.IP-02	Incorporated into ID.AM-08, PR.PS-06
PR.IP-03	Incorporated into PR.PS-01, ID.RA-07
PR.IP-04	Moved to PR.DS-11
PR.IP-05	Moved to PR.IR-02
PR.IP-06	Incorporated into ID.AM-08
PR.IP-07	Incorporated into ID.IM, ID.IM-03
PR.IP-08	Moved to ID.IM-03
PR.IP-09	Moved to ID.IM-04
PR.IP-10	Incorporated into ID.IM-02, ID.IM-04
PR.IP-11	Moved to GV.RR-04
PR.IP-12	Incorporated into ID.RA-01, PR.PS-02
PR.MA-01	Incorporated into ID.AM-08, PR.PS-03
PR.MA-02	Incorporated into ID.AM-08, PR.PS-02
PR.PT-01	Incorporated into PR.PS-04
PR.PT-02	Incorporated into PR.DS-01, PR.PS-01
PR.PT-03	Incorporated into PR.PS-01
PR.PT-04	Incorporated into PR.AA-06, PR.IR-01
PR.PT-05	Moved to PR.IR-03
RC.CO-01	Incorporated into RC.CO-04
RC.CO-02	Incorporated into RC.CO-04
RC.IM-01	Incorporated into ID.IM-03, ID.IM-04
RC.IM-02	Incorporated into ID.IM-03
RS.AN-01	Incorporated into RS.MA-02
RS.AN-02	Incorporated into RS.MA-02, RS.MA-03, RS.MA-04
RS.AN-04	Moved to RS.MA-03
RS.AN-05	Moved to ID.RA-08
RS.CO-01	Incorporated into PR.AT-01
RS.CO-04	Incorporated into RS.MA-01, RS.MA-04
RS.CO-05	Incorporated into RS.CO-03
RS.IM-01	Incorporated into ID.IM-03, ID.IM-04
RS.IM-02	Incorporated into ID.IM-03
RS.MI-03	Incorporated into ID.RA-06
RS.RP-01	Incorporated into RS.MA-01

The main patterns

• ID.BE (Business Environment) and ID.GV (Governance) moved into the new Govern function, as GV.OC (Organisational Context), GV.RR, GV.PO and GV.OV.
• ID.SC (Supply Chain Risk Management) became GV.SC, expanded to ten subcategories.
• PR.AC (Access Control) became PR.AA (Identity Management, Authentication and Access Control), with network segregation moving to PR.IR.
• PR.IP (Information Protection Processes) was broken up: configuration and maintenance outcomes moved to PR.PS (Platform Security), improvement outcomes to ID.IM.
• DE.DP (Detection Processes) was withdrawn, with its outcomes folded into DE.CM, DE.AE and ID.IM.
• Many RS and RC subcategories were consolidated into fewer, broader outcomes under RS.MA, RS.AN, RS.CO and RC.RP.

How to update old mappings

1. Search your documents and tools for CSF identifiers, and check each against the table above. CSF 1.1 identifiers use one digit (PR.AC-1); CSF 2.0 uses two (PR.AA-01).
2. Replace "moved to" links directly. Where NIST says a subcategory moved, the new identifier is a straight swap.
3. Review "incorporated into" links. The broader 2.0 outcome may cover more than your control does; check the mapping still makes sense.
4. Add the new Govern outcomes. CSF 2.0 introduced outcomes with no 1.1 predecessor, especially in supply chain risk and oversight.

Every CSF 2.0 subcategory has a page here with its mappings to ten other frameworks; start from the CSF 2.0 framework page. For what the Govern function means in practice, see which frameworks cover it. The withdrawal notes above come from NIST's own CSF 2.0 data, through its Cybersecurity and Privacy Reference Tool; see the methodology.

Questions

What replaced PR.AC in NIST CSF 2.0?

Most of the CSF 1.1 PR.AC (Access Control) subcategories moved to the new PR.AA (Identity Management, Authentication and Access Control) category; NIST's withdrawal notes give the exact destination of each.

Can I still use CSF 1.1?

You can, but NIST's current version is 2.0, and new crosswalks and informative references are published against 2.0. Updating old references avoids mappings that silently point at withdrawn subcategories.