NIST CSF 2.0 Is Now in Effect
NIST released the Cybersecurity Framework 2.0 on February 26, 2024. The updated framework helps organizations of all sizes and sectors understand, assess, prioritize, and communicate cybersecurity risk.
CSF 2.0 adds Govern as a sixth core function alongside Identify, Protect, Detect, Respond, and Recover. Govern places cybersecurity strategy, policy, roles, oversight, and supply chain risk at the center of the framework.
The six NIST CSF 2.0 functions are:
- Govern: Establish and monitor the organization’s cybersecurity risk management strategy, expectations, and policies.
- Identify: Understand the organization’s current cybersecurity risks.
- Protect: Use safeguards to manage cybersecurity risks.
- Detect: Find and analyze possible cybersecurity incidents.
- Respond: Take action when a cybersecurity incident occurs.
- Recover: Restore affected assets and operations after an incident.
CSF 2.0 was developed through a public process that included a request for information, draft publications, workshops, and stakeholder feedback. That development process is now complete, and CSF 2.0 is the current version of the framework.
How NIST CSF 2.0 Supports More Organizations
Broader Use and Expanded Scope
NIST CSF 2.0 is designed for organizations of any size, sector, or maturity level. While the original framework focused primarily on critical infrastructure, the current scope explicitly includes organizations across government, industry, academia, and the nonprofit sector.
Emphasis on SMBs
CSF 2.0 provides additional resources to help smaller organizations use the framework. These include implementation examples, quick-start guides, and profiles that show how cybersecurity outcomes can be applied in specific organizational and risk contexts.
International Collaboration
NIST continues to support international use of the framework. CSF 2.0 uses outcome-based guidance that organizations can apply across different countries, industries, technologies, and regulatory environments.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
CSF Mappings to Other Frameworks
One recurring theme that came up in responses to the RFI was the need to improve the alignment of the framework with other NIST and non-NIST security frameworks. Respondents to the RFI expressed interest in mappings to close to 50 other cybersecurity frameworks. In the concept paper, NIST states that it would like to work with the community to “encourage and enable the production of mappings that support the CSF 2.0.
Reflect Changes But Remain Vendor Neutral
NIST plans on reviewing the CSF so that its applicability can continue to be leveraged by a wide scope of organizations, regardless of the technology or services they employ. At the same time, guidance that tailors to specific technologies will be provided by mapping to s[ecofoc standards, providing guidance, and providing implementation examples.
Additional Guidance on Implementation
To help clarify the meaning and intent of the framework guidelines, the CSF 2.0 will include “notational implementation examples of the concise, action-oriented process, and activities to help achieve the outcomes” of the CSF categories and subcategories.
New Govern Function
NIST believes that, although the five core NIST functions have gained widespread adoption, there are many benefits of NIST CSF expanding the existing functions to include a new “governance” function. The proposed governance function is described as “crosscutting”, in that it will inform and support the other functions and will make it clear that governance practices inform the prioritization and implementation of each of the current functions.
Supply Chain Risk Management
The new framework will, for the first time, place a significant emphasis on supply chain risk management, assisting and encouraging businesses to address third-party risks of all kinds, including those posed by non-technology supply chains, and cloud computing as well as by computers, software, and networking hardware. Respondents to the RFI unanimously agreed that supply chain risks are a top risk across organizations. They didn’t necessarily agree on how these concerns should be addressed in the CSF update. As of the publication of the concept paper, NIST believes the CSF 2.0 should include additional C -SCRM-specific outcomes to provide additional guidance to help address supply chain risks.
Centraleyes and CSF 2.0 Compliance
Compliance is an ongoing process that requires constant updates and adjustments to keep pace with changes in standards and technology. Our updated platform will reflect final changes to the CSF along with additional mappings to other standards. Centraleyes’s automated remediation planner identifies gaps and produces actionable remediation tickets with quantifiable risk tools that allow you to track and compare progress over time, supporting the collection and organization of required information before an audit.
As the cybersecurity policy landscape changes, you can trust Centraleyes to keep your compliance programs up-to-date with the CSF and other regulatory and voluntary security objectives.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
