NIST Cybersecurity Framework 2.0: the Govern function and wider scope

On this page

1. What the source says
2. Why it matters
3. My perspective
4. Caveats

On 26 February 2024, the US National Institute of Standards and Technology (NIST) released version 2.0 of its Cybersecurity Framework (CSF). It was the first major update since the framework was created in 2014. NIST’s announcement presents the release as more than a revised document. It adds a new Govern function, widens the intended audience to organisations of every kind and surrounds the framework with online tools and guides. This post summarises the announcement and considers what it means for cybersecurity education, research and practice.

What the source says

According to NIST, the original CSF was released in 2014 following a presidential Executive Order. Its purpose was to help organisations understand, reduce and communicate cybersecurity risk. Its first audience was critical infrastructure operators such as hospitals and power plants. Version 2.0 is written for any organisation, whatever its sector or cybersecurity maturity, from small schools and nonprofits to large agencies and corporations. NIST also presents the update as supporting the 2023 US National Cybersecurity Strategy.

The core is now organised around six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST says that together they cover the full life cycle of managing cybersecurity risk. The new Govern function is about how an organisation makes and carries out informed decisions on its cybersecurity strategy. It treats cybersecurity as a major enterprise risk that senior leaders should weigh alongside matters such as finance and reputation. The update also gives supply chains more emphasis.

The framework document itself, published as NIST CSWP 29, describes the CSF as a taxonomy of high-level cybersecurity outcomes. Any organisation can use it to understand, assess, prioritise and communicate its efforts. The CSF does not prescribe how those outcomes should be achieved. Instead, it links to online resources that describe relevant practices and controls.

Those resources are a large part of the announcement. NIST lists:

• quick-start guides for particular audiences, including small businesses, enterprise risk managers and organisations securing their supply chains
• implementation examples and success stories
• a CSF 2.0 Reference Tool for browsing, searching and exporting the core guidance in both human-readable and machine-readable formats
• a searchable catalogue of informative references that lets users cross-reference the CSF with more than 50 other cybersecurity documents, including NIST SP 800-53 Rev. 5, a catalogue of controls

NIST Director Laurie E. Locascio described CSF 2.0 as “a suite of resources that can be customized and used individually or in combination over time”. The release says the update followed a multiyear process of discussion and public comment. NIST used the many comments it received on the draft to expand the core guidance and develop the supporting resources.

The release also highlights international use. Versions 1.0 and 1.1 were translated into 13 languages, and NIST expects volunteers to translate version 2.0. NIST reports working with ISO and IEC over the previous 11 years to align cybersecurity documents. ISO/IEC resources now let organisations build frameworks and organise controls using the CSF functions.

Why it matters

Three changes stand out.

First, the Govern function moves cybersecurity explicitly into strategy and leadership. Making governance a function in its own right signals that strategic decisions belong to cybersecurity itself. These are decisions made by senior leaders who also weigh financial and reputational risk.

Second, the broader audience matters. A framework first designed with hospitals and power plants in mind can feel distant to a small business or a school. Naming those organisations and producing quick-start guides for them is an attempt to make the framework easier to adopt. Whether it succeeds will depend on the quality and uptake of those resources, which the release does not measure.

Third, the emphasis on mappings and machine-readable exports reflects the fact that the CSF sits among many other documents and standards. Organisations that use it alongside them need to show how one set of outcomes relates to controls elsewhere. The informative reference catalogue and the ISO/IEC alignment work try to make those relationships explicit and reusable.

My perspective

Seen through the lens of cybersecurity ontology and interoperability, the most interesting part of the release is arguably the infrastructure around the framework rather than the new function. A catalogue that cross-references the CSF with more than 50 documents, together with a machine-readable export of the core, amounts to a shared vocabulary with mappings to other vocabularies. This raises two questions for researchers. How are those mappings kept consistent as each referenced document changes? And how can users tell whether a mapping shows a close equivalence or only a loose relationship?

Machine-readable outcomes also connect to work on agentic AI and automation. In principle, structured outcomes could give automated tools a common reference point for tasks such as gap analysis or reporting. That possibility deserves careful evaluation rather than assumption. The CSF deliberately leaves implementation choices to each organisation, and any automated tool would need to respect that context.

For cybersecurity education, the Govern function raises a question for curriculum design. A widely used framework now treats governance as one of six core functions. Programs that focus mainly on technical controls may therefore need to ask how well they prepare graduates to discuss cybersecurity in terms of enterprise risk, strategy and supply chains.

The CSF keeps high-level outcomes separate from specific practices. That design will look familiar to anyone working in higher education quality assurance, where learning outcomes are stated separately from the methods used to achieve them. The parallel could make the framework a useful teaching device. For example, students could map a case study to outcomes before choosing controls.

Kevin Stine, chief of NIST’s Applied Cybersecurity Division, said: “As users customize the CSF, we hope they will share their examples and successes”. That invitation could extend to educators and researchers. Published accounts of how the framework is adapted in different settings would help others learn from evidence rather than assumption.

Caveats

This post draws on NIST’s news release and the summary of the framework document on NIST’s publication page. It is not based on a detailed reading of the full CSF 2.0 text. The release is the publisher’s own announcement, so it describes intentions and resources rather than evidence of effectiveness. It does not report how widely version 2.0 has been adopted or whether the new resources have helped smaller organisations. Because the CSF does not prescribe how outcomes are achieved, the value any organisation gains from it depends heavily on implementation. Readers outside the United States should also consider how the framework fits with local requirements and guidance.

Sources and further reading

1. NIST Releases Version 2.0 of Landmark Cybersecurity Framework, National Institute of Standards and Technology (NIST), 26 February 2024
2. The NIST Cybersecurity Framework (CSF) 2.0, National Institute of Standards and Technology (NIST), NIST CSWP 29, 2024