NIST CSF 2.0: What Changed and What It Means for Your Program

NIST released version 2.0 of the Cybersecurity Framework in February 2024 — the first major update since the framework launched in 2014. For organizations that have been using CSF 1.1, the update introduces meaningful changes that are worth understanding. For organizations new to the framework, CSF 2.0 is the right place to start.

The good news for existing CSF users: the update is evolutionary, not revolutionary. The core structure is intact. The changes reflect a decade of real-world implementation experience and a recognition that cybersecurity is fundamentally a governance challenge, not just a technical one.

The Most Significant Change: The Govern Function

CSF 1.1 had five functions: Identify, Protect, Detect, Respond, and Recover. CSF 2.0 adds a sixth: Govern. This is the most significant structural change in the update.

The Govern function establishes and monitors the organization's cybersecurity risk management strategy, expectations, and policy. It covers organizational context, risk management strategy, roles and responsibilities, policy, oversight, and supply chain risk management. In CSF 1.1, governance was a cross-cutting concern embedded in other functions. CSF 2.0 elevates it to a standalone function, reflecting the reality that cybersecurity risk management requires explicit organizational commitment and clear accountability.

For organizations with mature CSF 1.1 programs, the Govern function is largely a reorganization of existing activities rather than new requirements. The governance activities you were already performing — risk management strategy, policy development, roles and responsibilities — now have a dedicated home in the framework.

Broader Applicability

CSF 1.1 was explicitly designed for critical infrastructure. CSF 2.0 is designed for all organizations — any sector, any size, any maturity level. The language and examples reflect this broader scope. This is a meaningful change for small and mid-sized companies that have been using CSF 1.1 despite not being critical infrastructure operators — CSF 2.0 is now explicitly designed for them.

Supply Chain Risk Management Expanded

CSF 2.0 gives significantly more attention to cybersecurity supply chain risk management (C-SCRM). The Govern function includes a dedicated category for supply chain risk management, and the Identify function expands its treatment of third-party risk. This reflects the reality that supply chain attacks have become one of the most significant and most common vectors for security incidents.

How to Update Your Program Without Starting Over

For organizations with existing CSF 1.1 programs, the update path is straightforward. Map your existing Identify, Protect, Detect, Respond, and Recover activities to the updated subcategories — most will map cleanly. Then assess your governance activities against the new Govern function. Identify gaps and add them to your roadmap.

The most common gap we see in CSF 1.1 programs transitioning to 2.0 is supply chain risk management. Organizations that have been treating vendor risk as a secondary concern will need to elevate it to address the expanded C-SCRM requirements in the Govern and Identify functions.

For organizations new to CSF, start with the Govern function. Establishing the governance foundation — risk management strategy, roles and responsibilities, policy framework — before diving into technical controls is the approach that produces the most durable programs.