NIST CSF 2.0 primer: what changed and how to use it

The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, represents a significant evolution from its predecessors. Designed for broader…

The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, represents a significant evolution from its predecessors. Designed for broader applicability beyond critical infrastructure, CSF 2.0 introduces a new "Govern" function and refines existing categories, making it a comprehensive tool for organizations of all sizes to manage and improve their cybersecurity posture. This iteration has rapidly become a widely cited reference for cybersecurity program development and assessment.

Key Changes in NIST CSF 2.0

CSF 2.0 builds upon the established five functions (Identify, Protect, Detect, Respond, Recover) by adding a sixth core function: Govern. This change reflects a growing recognition of the criticality of strategic cybersecurity management. Furthermore, the framework has been re-architected to be more accessible and applicable to a wider array of organizations, including small and medium-sized businesses (SMBs) and those not designated as critical infrastructure.

Govern (GV): This new function is foundational, establishing the organizational context for a cybersecurity program. It encompasses strategy, risk management, oversight, and communication. It defines how an organization makes and monitors decisions regarding its cybersecurity risk.
Expanded Scope and Language: The updated framework uses more inclusive language and examples, moving away from a primary focus on critical infrastructure. This broadens its utility, allowing various sectors and organizational types to adopt it effectively.
Implementation Examples: CSF 2.0 now includes detailed implementation examples for each subcategory, offering concrete actions and considerations to achieve the desired outcomes.
NIST CSF Tiers: While the tiered structure (Partial, Risk Informed, Repeatable, Adaptive) remains, CSF 2.0 provides clearer guidance on how organizations can assess their current tier and strategize for advancement.

The "Govern" Function: A Deeper Dive

The addition of the Govern function is perhaps the most impactful change. In CSF 1.x, elements of governance were distributed across the other five functions. CSF 2.0 consolidates these, providing a dedicated space for strategic decision-making and oversight. This function addresses questions often posed by executive boards and regulators, such as "How do we measure our cybersecurity risk?" or "What is our organization's risk tolerance?"

The Govern function is structured into six categories:

Organizational Context (GV.OC): Understanding the organization's mission, stakeholders, and external requirements.
Risk Management Strategy (GV.RM): Defining and communicating the organization's cybersecurity risk appetite and strategy.
Roles, Responsibilities, and Authorities (GV.RR): Establishing clear roles for cybersecurity decisions and actions.
Policy (GV.PO): Developing, approving, and disseminating cybersecurity policies.
Oversight (GV.OV): Monitoring and reviewing the effectiveness of the cybersecurity program.
Cybersecurity Supply Chain Risk Management (GV.SC): Managing cybersecurity risks associated with third-party vendors and supply chains.

The Six Functions Explained

The framework's core comprises six distinct, yet interlinked, functions:

Govern (GV): As discussed, this is the strategic core. It involves defining the cybersecurity strategy, establishing risk tolerance, and setting organizational policies.
Identify (ID): Focuses on developing an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. Key categories include Asset Management (ID.AM), Business Environment (ID.BE), Governance (ID.GV), Risk Assessment (ID.RA), and Risk Management Strategy (ID.RM).
Protect (PR): Develops and implements appropriate safeguards to ensure the delivery of critical services. This includes Access Control (PR.AC), Awareness and Training (PR.AT), Data Security (PR.DS), Information Protection Processes and Procedures (PR.IP), Maintenance (PR.MA), and Protective Technology (PR.PT).
Detect (DE): Develops and implements appropriate activities to identify the occurrence of a cybersecurity event. Categories include Anomalies and Events (DE.AE), Continuous Monitoring (DE.CM), and Detection Processes (DE.DP).
Respond (RS): Develops and implements appropriate activities to take action regarding a detected cybersecurity incident. Encompasses Response Planning (RS.RP), Communications (RS.CO), Analysis (RS.AN), Mitigation (RS.MI), and Improvements (RS.IM).
Recover (RC): Develops and implements appropriate activities to restore any capabilities or services that were impaired due to a cybersecurity incident. Categories are Recovery Planning (RC.RP), Improvements (RC.IM), and Communications (RC.CO).

CSF Tiers: Assessing Program Maturity

The Tiers describe the degree to which an organization's cybersecurity risk management practices are integrated into its overall risk management approach. They range from partial to adaptive, indicating increasing rigor and sophistication.

Tier	Description	Characteristics
1: Partial	Ad-hoc and reactive cybersecurity risk management.	Informal processes, limited awareness, minimal risk integration.
2: Risk Informed	Some risk management practices are in place, but not fully institutionalized.	Policies exist, informal communication, some awareness.
3: Repeatable	Formalized and regularly reviewed cybersecurity risk management processes.	Documented policies, executive approval, regular updates, consistent application.
4: Adaptive	Continuous improvement and adaptation to current and emerging threats.	Proactive, shared threat intelligence, resilient, highly integrated.

Organizations should assess their current tier for each function or category and determine a target tier based on their risk appetite, regulatory requirements, and business objectives. This gap analysis forms the basis for improvement planning.

Implementing CSF 2.0 in Practice: A Small Organization's Approach

For smaller organizations with limited resources, a pragmatic approach to CSF 2.0 is essential. Instead of attempting to implement every subcategory, focus on high-impact areas that address significant risks.

Step 1: Focus on the "Govern" Function
Even for SMBs, establishing basic governance is crucial. Define who is responsible for cybersecurity (GV.RR), what your primary cybersecurity risks are (GV.RM), and communicate basic cybersecurity policies (GV.PO) to employees.

Step 2: Select High-Value Subcategories
Prioritize 20-30 subcategories that address your most pressing risks. For example:

ID.AM-01: Physical devices and systems within the organization are inventoried.
PR.AC-03: Users are managed, and authorized to access resources. (e.g., Implementing multi-factor authentication for all critical systems).
PR.AT-02: Personnel are trained to understand and enact cybersecurity policies.
DE.CM-01: Networks and network services are monitored for potential cybersecurity events. (e.g., Basic logging and alert setup for firewalls).
RS.RP-01: A cybersecurity incident response plan is established.
RC.RP-01: A recovery plan is in place to restore systems and data. (e.g., Regular backups with verified recovery procedures).

Step 3: Conduct a Gap Analysis
For each chosen subcategory, assess your current state (Current Tier) and define a desired future state (Target Tier). Document gaps and prioritize them based on their impact and likelihood.

# Example: Gap analysis for a small business
# Subcategory: PR.AC-03 (Users are managed, and authorized to access resources.)

# Current State Assessment:
# - Users primarily rely on username/password.
# - Some critical systems have unique, strong passwords enforced.
# - No formal process for revoking access on termination.
# Current Tier: 1 (Partial) - ad-hoc, not consistently applied.

# Target State:
# - All critical business applications use Multi-Factor Authentication (MFA).
# - Formal onboarding/offboarding process includes access provisioning/revocation.
# - Regular access reviews performed.
# Target Tier: 3 (Repeatable) - Documented processes, consistently applied.

# Actions to close gap:
# 1. Implement MFA for Microsoft 365/Google Workspace (e.g., Azure AD Conditional Access policies, Google Advanced Protection).
# 2. Document HR/IT process for employee lifecycle access management.
# 3. Schedule quarterly access reviews for administrative accounts.

Step 4: Map Existing Controls
Many cybersecurity activities you already perform can be mapped directly to CSF subcategories. This helps you demonstrate compliance and identify areas where you might already be strong.

Implementing MFA across all user accounts → PR.AC-03, PR.AA-05 (Access rights are managed)
Deploying Endpoint Detection and Response (EDR) software on all workstations → DE.CM-01 (Networks and network services are monitored), PR.PT-03 (Endpoint protection)
Maintaining an up-to-date inventory of all servers and network devices → ID.AM-01 (Physical devices and systems are inventoried)
Conducting quarterly phishing simulation exercises for employees → PR.AT-02 (Personnel are trained to understand and enact cybersecurity policies)
Having a documented and tested incident response plan → RS.RP-01 (A cybersecurity incident response plan is established)

Where CSF 2.0 Stops: The "How" Question

CSF 2.0 excels at describing "what" an organization should do to manage cybersecurity risk. It is a framework of outcomes and desired states. However, it generally does not prescribe specific technical controls or detailed implementation steps – that's where other standards and control sets come in.

For concrete "how-to" guidance, organizations often pair CSF 2.0 with:

NIST Special Publication 800-53 (Rev. 5 or later): A comprehensive catalog of security and privacy controls primarily used by U.S. federal agencies, but highly applicable to any large enterprise. It provides detailed control statements and enhancement for granular implementation.
CIS Critical Security Controls (CIS Controls) v8: A prioritized set of actions to protect organizations and data from known cyberattack vectors. This is particularly popular with SMBs due to its prescriptive nature and focus on practical, actionable steps.
ISO/IEC 27002:2022: An international standard providing a set of generic information security controls. Often used in conjunction with ISO 27001 for establishing an Information Security Management System (ISMS), it offers a broad range of control guidance.

Each of these control sets can be mapped to CSF subcategories, providing the necessary depth for implementation. CSF 2.0 includes a "CSF 2.0 Reference Tool" that assists with such mappings, connecting CSF subcategories to various control sources.

Common Pitfalls and Troubleshooting

"Boiling the Ocean": Trying to implement every subcategory simultaneously. For new adopters, especially SMBs, this leads to burnout and failure. Start small, prioritize, and iterate.
Lack of Executive Buy-in for Govern Function: Without leadership understanding and commitment to the GV function, other functions will struggle. Frame cybersecurity as a business risk, not just an IT problem.
Treating CSF as a Checklist: CSF is a framework for continuous improvement, not a one-time compliance checklist. Regular assessment and adaptation are key.
Ignoring Supply Chain Risk: The GV.SC category is critical. Many breaches originate from third parties. Failing to assess and manage vendor risk is a significant oversight.
Stagnant Tiers: Assessing your current tier is only the first step. Failing to define and work towards target tiers means your program won't mature.
No Integration with Existing Risk Management: Cybersecurity risk should be integrated into an organization's overall enterprise risk management (ERM) strategy, not treated as a siloed IT concern. The Govern function directly addresses this.