NIST updates Cybersecurity Framework after a decade of lessons

After ten years operating under the original model, and two years working to revise it, the National Institute of Standards and Technology (NIST) has released version 2.0 of its Cybersecurity Framework (CSF).

Unlike the original, which was designed with critical infrastructure sectors in mind, CSF 2.0's scope has been expanded to suitable security tips for organizations in any sector and of any size "regardless of their degree of cybersecurity sophistication," NIST said.

For those unfamiliar with the CSF, it's a set of best practices and recommendations from NIST to help organizations improve their cybersecurity posture and raise organizational awareness of how to operate safely.

Along with broadening its scope, the new CSF [PDF] goes beyond being a best practices recommendation document, said NIST director Laurie Locascio.

CSF 2.0 "is about a suite of resources that can be customized and used individually or in combination over time as an organization's cybersecurity needs change and its capabilities evolve," Locascio said. According to NIST, CSF 2.0 was written with President Biden's National Cybersecurity Strategy, adopted in early 2023, in mind.

New resources in CSF 2.0 include quick-start guides for different types of organizations and use cases (e.g. enterprises, SMBs, cyber supply chain risk management etc.), implementation examples, a mapping catalog where companies can plug in data to see how well they're already conforming with the CSF, reference tools, and more. 

Kevin Stine, NIST's applied cybersecurity division chief, said the new tools were introduced after several years of work with stakeholders, as well as incorporating lessons learned from a decade of security challenges.

"This update aims to make the framework even more relevant to a wider swath of users in the United States and abroad," Stine said. The CSF is used widely outside the US, and has been translated into 13 languages through the efforts of volunteers. NIST said it expects CSF 2.0 to similarly be translated for use in non-English speaking countries. 

The biggest change is a new core risk management function

Those who've perused or used the original (and 1.1 version) of NIST's CSF are likely familiar with its five core functions of identify, protect, detect, respond, and recover, named for high-level summaries of what each function should contribute to a good security posture.

What's been missing from that group of five is the new sixth function – govern – which has been added in CSF 2.0. 

According to NIST, an organization properly implementing the governance function is one whose "cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored."

In other words, governance is all about elevating the other five functions beyond the security team and into the broader structure of an organization.

"The govern function provides outcomes to inform what an organization may do to achieve and prioritize the outcomes of the other five functions in the context of its mission and stakeholder expectations," NIST's CSF 2.0 document states. "Governance activities are critical for incorporating cybersecurity into an organization's broader enterprise risk management strategy."

That doesn't mean governance comes before the rest of the functions – NIST makes clear that all six "should be addressed concurrently."

"Actions that support govern, identify, protect, and detect should all happen continuously, and actions that support respond and recover should be ready at all times and happen when cybersecurity incidents occur," NIST said.

NIST said it views CSF 2.0 as a living document, and it plans to continue upping available resources to make the framework more useful. That said, NIST won't be able to do that without feedback from the security community, and is inviting people to contact them in the name of better cybersecurity.

"As users customize the CSF, we hope they will share their examples and successes, because that will allow us to amplify their experiences and help others," Stine said. "That will help organizations, sectors and even entire nations better understand and manage their cybersecurity risk." ®