Articles & Blogs
NIST Cybersecurity Framework Version 2.0: New Release
In a landmark move for cybersecurity, the National Institute of Standards and Technology (NIST) has released version 2.0 of the Cybersecurity Framework (CSF), an essential resource referenced in President Biden’s National Cybersecurity Strategy. This update represents a significant expansion of cybersecurity risk management protocols, transitioning from safeguarding critical infrastructure to encompassing organizations across all sectors.
Designed for Universal Adoption
NIST CSF 2.0 offers a universally applicable framework with detailed guidance and resources tailored to the diverse needs of various entities, from small businesses and schools to large corporations.
Introduction of the “Govern” Function
Six functions, 22 categories, and 106 subcategories make up the CSF 2.0
The framework historically comprised five core functions for a comprehensive cybersecurity strategy:
- Identify
- Protect
- Detect
- Respond
- Recover
NIST has now introduced a sixth function, Govern, in CSF 2.0, expanding the framework to offer a holistic view of managing cybersecurity risks throughout their lifecycle. This addition promotes a more comprehensive approach to organizational security, emphasizing managing cybersecurity risks throughout their entire lifecycle.
Furthermore, within the Govern function, particular emphasis is placed on the critical role of supply chain risk management, highlighting the necessity for robust cybersecurity practices that extend throughout supply chains.
Salient Features and Major Changes
- The “Govern” function comprises several categories to provide organizations with a structured approach to effectively addressing cybersecurity challenges. These categories include Organizational Context, Risk Management Strategy, Roles, Responsibilities and Authorities, Policy, Oversight, and Cybersecurity Supply Chain Risk Management.
- A notable enhancement in CSF 2.0 is incorporating the "Govern" function, promoting a more comprehensive approach to organizational security. Furthermore, there is greater emphasis on the critical role of supply chain risk management within the "Govern" function, highlighting the necessity for robust cybersecurity practices that extend throughout supply chains. The older Governance category in CSF 1.0 has been made into a function. There are a few concepts from Identify, Protection, and Detection in the form of procedures to be laid down.
- Govern, CSF 2.0 now comprises six core functions, collectively offering an integrative perspective on the lifecycle management of cybersecurity risk. The Govern (GV) function focuses on the following categories:
- Organizational Context (GV.OC)
- Risk Management Strategy (GV.RM)
- Roles, Responsibilities, and Authorities (GV.RR)
- Policy (GV.PO)
- Oversight (GV.OV)
- Cybersecurity Supply Chain Risk Management (GV.SC)
Expanded Guidance on Profiles and Implementation
- Substantial revisions and expansions to profile guidance
- In-depth examples and steps for creating and using profiles
- Profile template to help organizations create profiles
- Implementation examples
- Quick start guides
- Mappings
Realignment of Categories
Ten categories from NIST CSF 1.0 have been realigned to enhance clarity and coherence. Notable realignments include the Business Environment, Governance, Identity Management, Access Control, Information Protection Processes and Procedures, Maintenance, Protective Technology, Detection Processes, Response Planning, and Improvements from Response and Recovery.
Note: The previous improvement category from Respond & Recover is now consolidated to 1 under identity.
Innovative Tools and Resources
- CSF 2.0 introduces the CSF 2.0 Reference Tool, an innovative platform that allows users to access, search, and export the framework's guidance in user-friendly and machine-readable formats.
- CSF 2.0's searchable catalog of informative references helps organizations align their ongoing efforts with the framework's principles. It links to over fifty cybersecurity documents, including NIST's SP 800-53 Rev. 5.
- CSF's global impact grows with translations into multiple languages and efforts to align with ISO/IEC standards.
- The Cybersecurity and Privacy Reference Tool (CPRT) compiles NIST guidance into a cohesive, accessible set, positioning the CSF within a broader context of respected resources and facilitating communication across organizational levels.
- The information protection processes and procedures category has now been divided into seven categories. Roles, Responsibilities & authorities, Asset Management, Risk Assessment, Improvement, Data Security, Platform Security, Technology Infrastructure Resilience
Improved Categorization
The information protection processes and procedures category has been divided into seven distinct categories: Roles, Responsibilities & Authorities, Asset Management, Risk Assessment, Improvement, Data Security, Platform Security, and Technology Infrastructure Resilience.
CSF Tiers Remain Unchanged
The four CSF tiers (Partial, Informed, Repeatable, Adaptive) remain unchanged in CSF 2.0.
Partner with Accorian for Your NIST CSF Framework
NIST CSF 2.0 represents a significant advancement in cybersecurity risk management. Offering a comprehensive framework with a broader scope, improved resources, and a focus on supply chain risk management empowers organizations of all sizes to build more robust and holistic cybersecurity postures.
Accorian is a global cybersecurity firm that partners with corporations throughout their security journey. We offer expert services in strategy, compliance, testing, and security staffing solutions, empowering businesses to navigate the intricate cybersecurity landscape with assurance and success.
Over the past five years, our team has successfully executed numerous NIST CSF projects across diverse sectors and regions. Through our comprehensive preparedness and implementation services, we have assisted organizations in meeting NIST criteria and navigating through the assessment or assurance process.