Watch the Deep Dive of this post

NIST Cybersecurity Framework 2.0: Navigating the Generational Update in Federal Guidance

The cybersecurity landscape has undergone rapid changes since 2018, and federal guidance is keeping pace. On February 26, 2024, the National Institute of Standards and Technology (NIST) released the Cybersecurity Framework version 2.0 (CSF 2.0), marking a generational update to the foundational guidance previously seen in version 1.1. For executives and cybersecurity professionals, understanding and integrating this new framework is critical.

The most significant structural changes defining CSF 2.0 revolve around risk governance and supply chain risk management.

Understanding the New Framework

CSF 2.0 is the culmination of years of collaborative effort involving NIST, the private sector, and government agencies worldwide. Like its predecessor, it provides flexible, risk-based guidance intended to help organizations manage cybersecurity risks. The framework outlines a set of common cybersecurity activities and outcomes. Although NIST did not intend for the CSF to be a maturity model, many organizations rely on it to measure their security programs and track progress in implementing risk management practices.

The CSF 2.0 is composed of multiple components, including the Framework Core, Implementation Tiers, and Framework Profiles. These materials offer guidance on mapping the CSF 2.0 to other resources and communicating internally and externally about risk management to suppliers and partners. The Framework Core specifically organizes cybersecurity outcomes by Function, Category, and Subcategory.

The Major Shift: The Govern Function

The biggest structural difference between CSF 1.1 and 2.0 is the addition of the new Function: Govern.

This new Govern Function houses the most significant additions and reorganizations, particularly focusing on a new Category dedicated to cybersecurity supply chain risk management (C-SCRM). This material reflects evolving expectations regarding third-party and supply chain risks.

The C-SCRM updates add outcomes covering:

• Due diligence.
• Assessment of business partners for criticality.
• Lifecycle management.

Furthermore, CSF 2.0 integrates new outcomes focused on protecting against unauthorized software and the crucial process of integrating secure software development practices.

NIST has also rolled out comprehensive explanatory materials, including Profile templates, quick start guides for creating different Profiles, and detailed explanations around Tiers and using CSF 2.0 for C-SCRM and Enterprise Risk Management. New online functionality includes Informative References and Implementation Examples designed to illustrate how organizations might implement the Subcategories.

What Organizations Should Do Now

Organizations widely utilize the CSF as the baseline for their cybersecurity risk management programs. Now is the time to update internal programs and risk management frameworks to align with the new content and structure of CSF 2.0.

Organizations should examine the framework and incorporate new or amended material as relevant. Given the evolving expectations reflected in the new guidance, key focus areas for updating existing risk management programs include: governance, supply chain risk management, and secure software development.

It is also vital to consider how CSF 2.0 interacts with new federal requirements. The National Cybersecurity Strategy Implementation Plan tasks NIST with assisting agencies in aligning regulations with the CSF. Regulated companies must review CSF 2.0 and incorporate its changes, especially as government interest grows in establishing mandatory cybersecurity baselines. For instance, the Federal Communications Commission (FCC) has already begun requiring recipients of certain program funding to certify risk management plans based on the CSF.

Organizations should be prepared to adapt or expand their risk management activities. Building an individual or Community Profile using NIST’s guidance is an effective way to prioritize how CSF 2.0 outcomes would apply to a particular company, industry, or sector.

Tags NIST, NIST Cybersecurity Framework, CSF 2.0, Cybersecurity, Risk Management, Supply Chain Risk, Federal Guidance, Governance, marketus