The cybersecurity roadmap and culture change
NIST CSF 2.0: profiles, tiers and the Govern function
30 min
NIST Cybersecurity Framework 2.0 (CSWP 29, February 26, 2024) is the common language for a security program. It added a sixth function, Govern, and widened the audience from critical infrastructure to all organizations. Structure: 6 functions, 22 categories, 106 subcategories.
| Function | Outcome |
|---|---|
| Govern (GV) | Strategy, expectations and policy for cybersecurity risk are set, communicated and monitored |
| Identify (ID) | Assets, risks and improvement opportunities are understood |
| Protect (PR) | Safeguards manage risk: identity, training, data security, platform, resilience |
| Detect (DE) | Attacks and compromises are found and analyzed |
| Respond (RS) | Actions are taken on a detected incident |
| Recover (RC) | Assets and operations affected by an incident are restored |
| Govern category | Covers |
|---|---|
| GV.OC Organizational Context | Mission, stakeholders, legal and regulatory requirements |
| GV.RM Risk Management Strategy | Risk appetite, tolerance, priorities |
| GV.RR Roles, Responsibilities, and Authorities | Leadership accountability, resourcing |
| GV.PO Policy | Policy set, review and enforcement |
| GV.OV Oversight | Strategy results reviewed and adjusted |
| GV.SC Cybersecurity Supply Chain Risk Management | Supplier risk program |
- Organizational Profile: Current Profile (outcomes achieved now) and Target Profile (outcomes to reach). The gap between them is the roadmap's backlog.
- Tiers characterize risk governance and management rigor: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable, Tier 4 Adaptive.
- Community Profiles give a sector's baseline target, such as manufacturing or financial services.
Tiers are not a maturity score to maximize. The right tier follows risk appetite and cost; Tier 4 everywhere is rarely justified.
Word bank
All definitions →- CSF Tiers
- Partial, Risk Informed, Repeatable, Adaptive: rigor of cybersecurity risk governance and management.
- Current and Target Profile
- CSF outcomes achieved today versus outcomes the organization intends to achieve; the gap drives the action plan.
- Govern function
- CSF 2.0 function covering cybersecurity risk strategy, roles, policy, oversight and supply chain risk.
Knowledge check
Which function did CSF 2.0 add?
The gap between Current and Target Profiles is used to: