NIST Cybersecurity Framework 2.0<\/a>\u00a0is a flexible set of guidelines that helps US organizations manage and reduce cybersecurity risk.\u00a0<\/p>\n\n\n\nRather than prescribing specific technologies or controls, it provides a common structure for understanding the current security posture, identifying gaps, setting priorities, and improving how cybersecurity decisions are made. <\/p>\n\n\n\n
What Changed in NIST CSF 2.0? <\/h2>\n\n\n\n
The biggest change in NIST CSF 2.0 is the addition of Govern as a sixth core function, alongside Identify, Protect, Detect, Respond, and Recover. <\/p>\n\n\n\n
This change reflects a broader view of cybersecurity. It is no longer treated only as a technical issue for security teams. CSF 2.0 places greater emphasis on leadership, business priorities, risk ownership, regulatory requirements, and third-party relationships. <\/p>\n\n\n\n
The Govern function covers six key areas: <\/p>\n\n\n\n
\n- Organizational context <\/li>\n\n\n\n
- Risk management strategy <\/li>\n\n\n\n
- Roles, responsibilities, and authority <\/li>\n\n\n\n
- Cybersecurity policies <\/li>\n\n\n\n
- Review of security performance <\/li>\n\n\n\n
- Cybersecurity supply chain risk management <\/li>\n<\/ul>\n\n\n\n
In practice, this means CISOs are expected to connect security decisions with the organization\u2019s mission, risk appetite, legal obligations, and business dependencies. It also places clearer responsibility on leadership to provide the right resources, review performance, and adjust the security strategy when risks change. <\/p>\n\n\n\n
Another important update is the stronger focus on suppliers and third parties. US companies are expected to understand which suppliers are critical, assess the risks they introduce, include them in incident planning, and manage those risks\u00a0throughout the relationship.\u00a0<\/p>\n\n\n\n
CSF 2.0 is also designed for a wider audience. While the original framework was closely associated with critical infrastructure, the updated version is intended for organizations of any size, sector, or level of security maturity. <\/p>\n\n\n\n
The six functions are now: <\/p>\n\n\n\n
\n
\n\n \n | \n CSF 2.0 function\u00a0 <\/th>\n | \n What it helps the organization do\u00a0 <\/th>\n <\/tr>\n |
\n | \n Govern\u00a0 <\/td>\n | \n Set risk priorities, assign\u00a0responsibility,\u00a0establish\u00a0policies, and review performance\u00a0 <\/td>\n <\/tr>\n |
\n | \n Identify\u00a0 <\/td>\n | \n Understand assets, suppliers,\u00a0threats, vulnerabilities, and current risk\u00a0 <\/td>\n <\/tr>\n |
\n | \n Protect\u00a0 <\/td>\n | \n Put safeguards in place to reduce the likelihood and\u00a0impact\u00a0of incidents\u00a0 <\/td>\n <\/tr>\n |
\n | \n Detect\u00a0 <\/td>\n | \n Find and\u00a0analyze\u00a0signs of\u00a0possible attacks\u00a0or compromise\u00a0 <\/td>\n <\/tr>\n |
\n | \n Respond\u00a0 <\/td>\n | \n Validate, investigate,\u00a0contain, and communicate incidents\u00a0 <\/td>\n <\/tr>\n |
\n | \n Recover\u00a0 <\/td>\n | \n Restore affected operations and coordinate recovery activities\u00a0 <\/td>\n <\/tr>\n <\/table>\n<\/div> |