Introduction to NIST CSF 2.0
The NIST Cybersecurity Framework 2.0, released in February 2024, represents the first major update since the framework's creation in 2014. It introduces a new Govern function and expands applicability beyond critical infrastructure to all organizations.
What's New in 2.0
New Govern Function:
Cybersecurity governance prominence
Risk management integration
Supply chain considerations
Organizational context
Enhanced Guidance:
Implementation examples
Quick start guides
Profiles and tiers updates
Small business focus
Broader Applicability:
All organization sizes
All sectors
International alignment
The Six Functions
GOVERN (New in 2.0)
Purpose: Establish and monitor cybersecurity risk management strategy, expectations, and policy.
Categories:
GV.OC: Organizational Context
GV.RM: Risk Management Strategy
GV.RR: Roles, Responsibilities, and Authorities
GV.PO: Policy
GV.OV: Oversight
GV.SC: Cybersecurity Supply Chain Risk Management
Key Outcomes:
Cybersecurity strategy aligned with business
Risk appetite defined
Clear accountability established
Policies documented and communicated
IDENTIFY
Purpose: Understand organizational context and cybersecurity risks.
Categories:
ID.AM: Asset Management
ID.RA: Risk Assessment
ID.IM: Improvement
Key Outcomes:
Complete asset inventory
Risk assessment completed
Continuous improvement process
PROTECT
Purpose: Implement safeguards to ensure delivery of services.
Categories:
PR.AA: Identity Management and Access Control
PR.AT: Awareness and Training
PR.DS: Data Security
PR.PS: Platform Security
PR.IR: Technology Infrastructure Resilience
Key Outcomes:
Access controls implemented
Staff trained on security
Data protection measures
Systems hardened
DETECT
Purpose: Discover cybersecurity events in a timely manner.
Categories:
DE.CM: Continuous Monitoring
DE.AE: Adverse Event Analysis
Key Outcomes:
Monitoring capabilities deployed
Anomalies detected and analyzed
Events correlated
RESPOND
Purpose: Take action regarding detected cybersecurity incidents.
Categories:
RS.MA: Incident Management
RS.AN: Incident Analysis
RS.CO: Incident Response Reporting and Communication
RS.MI: Incident Mitigation
Key Outcomes:
Incident response plan executed
Incidents analyzed and contained
Stakeholders notified
Impact minimized
RECOVER
Purpose: Restore capabilities impaired by cybersecurity incidents.
Categories:
RC.RP: Incident Recovery Plan Execution
RC.CO: Incident Recovery Communication
Key Outcomes:
Recovery plan executed
Operations restored
Lessons learned captured
Implementation Approach
Step 1: Scope and Prioritize
Define Scope:
Identify critical systems
Map business processes
Determine boundaries
Consider stakeholders
Prioritize:
Business impact
Regulatory requirements
Risk assessment results
Resource availability
Step 2: Orient
Understand Current State:
Document existing controls
Map to CSF categories
Identify gaps
Assess maturity
Consider Context:
Industry requirements
Threat landscape
Business objectives
Risk tolerance
Step 3: Create Current Profile
Document Present State:
For each category, assess:
Current implementation level
Existing controls
Maturity rating
Evidence available
Use Tiers:
Tier 1: Partial
Tier 2: Risk Informed
Tier 3: Repeatable
Tier 4: Adaptive
Step 4: Conduct Risk Assessment
Identify Risks:
Threat sources
Vulnerabilities
Impact potential
Likelihood
Prioritize Risks:
Risk rating methodology
Business context
Control effectiveness
Step 5: Create Target Profile
Define Desired State:
Target tier for each category
Gap from current state
Priority assignments
Resource requirements
Align with Business:
Support business objectives
Meet compliance requirements
Address key risks
Step 6: Determine Gaps
Gap Analysis:
Compare current to target
Identify shortfalls
Quantify effort needed
Prioritize actions
Action Planning:
Specific improvements
Resource allocation
Timeline development
Success criteria
Step 7: Implement Action Plan
Execute Plan:
Deploy controls
Implement processes
Train personnel
Monitor progress
Track Progress:
Milestone tracking
Status reporting
Adjustment as needed
Profiles and Tiers
Using Profiles
Current Profile:
Baseline assessment
Starting point
Gap identification basis
Target Profile:
Desired end state
Risk-based goals
Improvement objectives
Community Profiles:
Sector-specific guidance
Industry best practices
Regulatory alignment
Understanding Tiers
Tier 1 - Partial:
Ad hoc practices
Limited awareness
Reactive approach
Tier 2 - Risk Informed:
Some risk awareness
Management approved
Not organization-wide
Tier 3 - Repeatable:
Formal policies
Regular updates
Consistent implementation
Tier 4 - Adaptive:
Continuous improvement
Lessons learned integration
Predictive capabilities
Governance Integration
Board Engagement
Reporting Topics:
Risk posture summary
Key risk indicators
Incident overview
Improvement progress
Governance Activities:
Strategy approval
Risk appetite setting
Resource allocation
Oversight responsibilities
Risk Management Integration
Enterprise Risk Management:
Align with ERM framework
Consistent risk language
Integrated reporting
Shared risk ownership
Cybersecurity Risk:
Specific risk register
Technical risk assessment
Control effectiveness
Residual risk acceptance
Supply Chain Risk Management
CSF 2.0 Emphasis
New Focus Areas:
Supplier risk assessment
Contract requirements
Continuous monitoring
Incident coordination
Key Activities:
Vendor inventory
Risk tiering
Security requirements
Assessment process
Implementation
1Identify critical suppliers
2Assess supplier risks
3Define security requirements
4Include in contracts
5Monitor compliance
6Respond to incidents
Small Business Guidance
CSF 2.0 Small Business Quick Start
Focus Areas:
Basic cyber hygiene
Critical controls
Manageable scope
Incremental improvement
Priority Controls:
1Asset inventory
2Access management
3Data backup
4Security awareness
5Incident response basics
Scaled Implementation
Start with critical assets
Focus on high-impact controls
Leverage cloud security
Use managed services
Measuring Success
Key Metrics
Program Metrics:
Framework coverage percentage
Tier progression
Gap closure rate
Control effectiveness
Outcome Metrics:
Incident reduction
Detection time
Response time
Recovery time
Continuous Improvement
Review Cycle:
Annual profile updates
Quarterly progress reviews
Post-incident assessments
Threat landscape updates
Conclusion
NIST CSF 2.0 provides a flexible, risk-based approach to cybersecurity that scales from small businesses to large enterprises. The new Govern function emphasizes the importance of organizational context and risk management integration. Start with a current profile assessment, define your target state based on risk, and implement improvements systematically.