After several years of deliberation and collaboration with industry experts, NIST has released the newest version of the NIST CSF. The NIST CSF 2.0 builds on the draft version released in September 2023. NIST has made several changes to the cybersecurity risk management framework in response to the changing security and threat landscape and the rollout of several industry regulations. This update marks a pivotal moment as NIST extends its guidance to cater to all organizations, irrespective of industry sector or size, reinforcing its commitment to bolstering cybersecurity resilience across the board.
NIST CSF 2.0 has been tailored to apply to all organizations. Whereas previous iterations of the NIST CSF were targeted towards critical infrastructure organizations, the NIST CSF 2.0 is now a flexible guideline for all companies looking to mature their cybersecurity practices. This expansion reflects NIST's acknowledgment of the universal importance of cybersecurity and the pressing need for comprehensive risk management strategies in today's digital landscape.
NIST aims to shift how organizations refer to and rely on the CSF by expanding how it supports organizations. Instead of viewing the CSF as a static framework, NIST aims to provide a suite of resources and tools that organizations can customize to their company size, requirements, and maturity.
One of the key highlights of the CSF 2.0 is its enhanced emphasis on governance and supply chains. The framework underscores the imperative for informed decision-making at all levels of an organization and recognizes cybersecurity as a fundamental enterprise risk. This shift highlights the critical role of senior leaders in shaping cybersecurity strategies alongside other business priorities.
“GOVERN (GV) — The organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored. The GOVERN Function provides outcomes to inform what an organization may do to achieve and prioritize the outcomes of the other five Functions in the context of its mission and stakeholder expectations. Governance activities are critical for incorporating cybersecurity into an organization’s broader enterprise risk management (ERM) strategy. GOVERN addresses an understanding of organizational context; the establishment of cybersecurity strategy and cybersecurity supply chain risk management; roles, responsibilities, and authorities; policy; and the oversight of cybersecurity strategy.”
The NIST CSF Core Functions will expand to include Govern in its list. Initially, there were five functions: Identify, Protect, Detect, Respond, and Recover. The six core functions will expand into 23 categories and 106 subcategories.
To facilitate seamless adoption and implementation, NIST has augmented CSF 2.0 with a suite of resources tailored to different user groups. These resources range from implementation examples to quick-start guides, catering to the specific needs and challenges faced by organizations, whether small businesses, enterprise risk managers, or those aiming to secure their supply chains. These resources also offer implementation examples and suggest creating a community profile to connect and discuss with peers.
NIST does not offer guidance on steps that need to be taken; rather, it describes desired outcomes intended to be understood by a broad audience, including executives, managers, and practitioners, regardless of their cybersecurity expertise. With this approach, organizations have the flexibility to address their unique risks and technologies. The outcomes are mapped directly to a list of potential security controls for immediate consideration to mitigate cybersecurity risks.
The introduction of the CSF 2.0 Reference Tool simplifies the implementation process, offering users easy access to core guidance in both human-readable and machine-readable formats. Moreover, the searchable catalog of informative references enables organizations to map their current actions onto the CSF, fostering alignment with over 50 other cybersecurity documents, including NIST SP 800-53 Rev. 5.
NIST aims to foster a cohesive global approach to cybersecurity. Collaborations with organizations such as the ISO and the IEC further enhance alignment and standardization efforts worldwide.
As organizations navigate an increasingly complex cybersecurity landscape, NIST remains steadfast in its commitment to evolving the CSF to meet emerging challenges. Continued feedback and collaboration with the community will be pivotal in shaping future iterations and ensuring that the CSF remains a cornerstone resource for organizations worldwide.
The release of NIST CSF 2.0 signifies a significant milestone in NIST's ongoing mission to empower organizations to manage cybersecurity risks effectively. This shift will lead to more holistic cyber risk management strategies among organizations. With its expanded scope, emphasis on governance, and enhanced resources, the framework equips organizations of all types and sizes with the tools and guidance needed to navigate the ever-evolving threat landscape and build resilience in the digital age.
Schedule a demo to learn how CyberSaint leverages the NIST CSF to benchmark organizations and track cyber risk maturity.