NIST CSF 2.0: The Govern Function
The National Institute of Standards and Technology Cybersecurity Framework version 2.0 introduces the Govern function, expanding from 5 to 6 core functions. This addition recognizes that cybersecurity governance is the foundation upon which all other security activities rest.
The 6 Functions
GOVERN (New)
Establish and monitor cybersecurity risk management strategy, expectations, and policy:- Organizational context and risk appetite
- Cybersecurity supply chain risk management
- Roles, responsibilities, and authorities
- Policy development and communication
- Oversight and accountability
IDENTIFY
Understand organizational context, assets, and risk:- Asset management and discovery
- Risk assessment methodology
- Business environment understanding
- Improvement tracking
PROTECT
Implement safeguards for critical services:- Identity management and access control
- Awareness and training
- Data security
- Platform security
- Technology infrastructure resilience
DETECT
Identify cybersecurity events:- Continuous monitoring
- Adverse event analysis
- Detection process execution
RESPOND
Take action regarding detected incidents:- Incident management
- Incident analysis
- Incident response reporting
- Incident mitigation
RECOVER
Restore capabilities impaired by incidents:- Incident recovery plan execution
- Recovery communication
Key Changes from CSF 1.1
- Govern function added as the organizational foundation
- Supply chain risk management elevated in importance
- Measurement and metrics emphasized across all functions
- Broader applicability beyond critical infrastructure
- Implementation examples for each subcategory
Implementation Approach
- Establish governance structure (GOVERN)
- Profile current and target states
- Gap analysis between current and target
- Prioritize improvements based on risk
- Implement changes iteratively
- Measure and report progress
SuperClue NIST CSF Module
SuperClue's NIST CSF 2.0 framework scan runs 13 checks across all 6 functions, including Govern. It checks your external website and asks for evidence for the rest, with remediation guidance for failed checks.