CSF 2.0 added a Govern function — and with it, the argument that security is not only IT's job

Why adding Govern matters

The original five functions answer what an organisation does about risk. Govern answers who decides, on what basis, and how the results of those decisions are tracked. Raising that to a function of its own says that cybersecurity is an enterprise risk to be managed alongside the others, rather than a specialist activity belonging to the IT department.

Supply chain sits under Govern

GV.SC, the category for cybersecurity supply chain risk management, sits inside the Govern function. That placement says third-party risk is something to set policy and accountability for in advance, not something to handle case by case once a problem has already arrived.

• Be explicit about which providers can reach which systems and data.
• Put security requirements into contracts at the start, rather than negotiating them during an incident.
• Review the provider list periodically, the same way user entitlements are reviewed.

Tiers describe readiness; they are not a score

CSF 2.0 describes its Tiers with separate wording for cybersecurity risk governance and for risk management in the other functions. Their real value is as a conversation tool between IT and the executive: a way to agree where the organisation is and where it wants to be, not a number to benchmark against other organisations.

The lowest-effort place to start

NIST publishes quick-start guides aimed at particular audiences, including small businesses, enterprise risk managers and supply chain risk management. For an organisation new to the framework, those usually work better than reading the full document from page one.

• Pick the outcomes that are genuinely relevant rather than trying to satisfy every one.
• Build two Organizational Profiles — current state and target state — and treat the gap between them as the plan.
• Attach each outcome to a named person, not to a department name.