NIST CSF 2.0: The Significant Changes
NIST released Cybersecurity Framework 2.0 in February 2024. The update is the most significant revision since the original 2014 framework. If your organization uses NIST CSF as the basis for your security program assessment or your board reporting, the 2.0 update has specific implications for how you measure and communicate your security posture.
CyberOne’s cybersecurity strategy engagements use NIST CSF 2.0 as the primary framework for organizations that don’t have a more specific compliance driver (HIPAA, PCI, CMMC), and the Govern function introduced in 2.0 has changed how we structure those engagements.
The New Govern Function
NIST CSF 1.1 had five functions: Identify, Protect, Detect, Respond, and Recover. CSF 2.0 adds a sixth: Govern.
The Govern function addresses the organizational context for the security program: risk management strategy and risk tolerance, organizational context (legal requirements, regulatory obligations, business objectives that security must enable), cybersecurity policy, roles and responsibilities, and oversight of the security program by leadership. These topics existed in CSF 1.1 — they lived in the Identify function’s Governance category. Moving them to a dedicated function at the same level as the other five reflects their foundational role: Govern is what everything else runs on top of.
For security teams, this means NIST CSF 2.0 assessments now explicitly score governance maturity as a first-class measurement rather than a sub-category inside Identify. Organizations that have strong technical controls but weak governance documentation — no formal risk tolerance statement, no security roles and responsibilities that are actually understood across the organization — will score worse under 2.0 assessments than they did under 1.1.
Supply Chain Risk Management
CSF 2.0 significantly expands supply chain risk management guidance. Third-party risk now has its own category (GV.SC — Supply Chain Risk Management) within the Govern function with 10 subcategories addressing supplier identification and classification, supplier agreements and their security requirements, supplier performance monitoring, and response to supply chain incidents.
The expanded supply chain guidance reflects the threat environment: SolarWinds, Kaseya, XZ Utils, and similar incidents have established that software supply chain compromise is an active, sophisticated attack vector. CSF 2.0 treats third-party risk as a foundational governance concern, not a compliance checkbox.
CyberOne’s cybersecurity risk assessments now explicitly cover the GV.SC subcategories, and third-party risk assessment is a component of our cyber strategy development engagements for organizations that haven’t formalized their vendor security program.
Expanded Scope: All Organizations, Not Just Critical Infrastructure
CSF 1.0 and 1.1 were originally designed for critical infrastructure operators and carried that framing throughout. CSF 2.0 explicitly expands the scope to organizations of all types and sizes — small businesses, nonprofits, academic institutions, and commercial enterprises, not just energy, finance, and healthcare operators.
This change has practical implications. The framework now includes guidance specifically for small and medium-sized organizations that don’t have dedicated security staff. The Implementation Examples in 2.0 show practical controls for resource-constrained organizations alongside those for large enterprises. This makes CSF 2.0 more applicable as a baseline for mid-market organizations that previously found the framework’s examples too large-enterprise-focused to be directly useful.
Profiles and Tiers: How They Work Together in 2.0
CSF Profiles and Implementation Tiers existed in 1.1, but 2.0 clarifies how they’re meant to be used together.
Profiles describe a specific organization’s cybersecurity state — current state or target state — by selecting which subcategories are in scope and what the desired outcome is for each. Two organizations with the same industry classification might have very different profiles based on their specific risk context, business model, and existing investments.
Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe cybersecurity risk management maturity. Tier selection is based on the organization’s overall approach to cybersecurity risk, not performance against specific controls. CSF 2.0 clarifies that tiers don’t describe security program maturity in absolute terms — a Tier 3 organization isn’t necessarily more secure than a Tier 2, but its risk management practices are more formalized and repeatable.
The combination: a current-state profile shows where you are against your in-scope subcategories; a target-state profile shows where you want to be; the gap between them is the basis for your security roadmap. Tiers provide context for how consistently and intentionally your organization approaches the roadmap.
What Organizations Should Update
For organizations already using NIST CSF as their framework:
- Review current-state profiles against the new Govern function subcategories — governance gaps that weren’t explicitly scored before may now be visible
- Assess supply chain risk management maturity against the expanded GV.SC subcategories
- Update board and executive reporting templates to reflect the new six-function structure
- Review Implementation Tier selection against CSF 2.0 definitions (the tier descriptions were refined)
For organizations not yet using NIST CSF, 2.0’s broader scope and more accessible implementation guidance makes it the right starting point for a structured security program. CyberOne’s cybersecurity risk assessments produce a NIST CSF 2.0 current-state profile as a standard deliverable.