On February 26, 2024, the National Institute of Standards and Technology (NIST) published an update to their Cybersecurity Framework (CSF). A decade since the framework made its first appearance, the NIST CSF 2.0 includes several significant changes. In this article, we'll cover six of those key updates and talk about what it means for you.
In February 2013, Executive Order 13636 appointed NIST to develop a "framework to reduce cyber risks to critical infrastructure." As a result, this is pretty much what NIST called the first version of the document: "Framework for Improving Critical Infrastructure Cybersecurity."
Even though the name rolls right off the tongue, nobody called it that. Both NIST and the industry regularly referred to it as the "Cybersecurity Framework."
So, with this update, NIST made it official. Version 2.0 is now called "The NIST Cybersecurity Framework (CSF) 2.0."
The title isn't the only place NIST got rid of the "critical infrastructure" concept. The previous version of the framework referred to critical infrastructure more than 40 times.
Excluding the one instance where NIST told people about the name change, the CSF 2.0 doesn't talk about critical infrastructure at all.
In their press release, NIST said the reason for this change is the CSF "now explicitly aims to help all organizations – not just those in critical infrastructure, its original target audience – to manage and reduce risks."
So, if you haven't completed the CSF because it was for "critical infrastructure," now you can!
The prior version of the CSF had five functions: Identify, Protect, Detect, Respond, and Recover. While several of the functions touched on concepts related to cybersecurity governance, NIST looked at the framework and said, "Ehhh, it's not enough."
As a result, a new function was added to the framework called "Govern." In the CSF 2.0 infographic, the new function connects to and sits smack dab in the middle of the five other functions, showcasing the idea that effective governance carries the team harder than LeBron James has carried every team he's ever played with.
In the press release, NIST defines governance as "how organizations make and carry out informed decisions on cybersecurity strategy." What this means is that it is important for leaders in organizations to take an active role in helping identify and mitigate cyber risk.
While some of the categories and subcategories in the Govern function are entirely new, several come nearly verbatim from the previous version.
|
|
Version 1.1 |
Version 2.0 |
|
Category Example |
Risk Management Strategy (ID.RM) The organization's priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.
|
Risk Management Strategy (GV.RM) The organization's priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions. |
|
Subcategory Example |
ID.AM-6 |
GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally |
In short, cybersecurity risk is an enterprise risk, so organization leadership needs to take center stage in managing it.
As third-party risk continues to increase, it makes sense NIST would want to level up the CSF in this area. Some of the fresh faces you can expect to see in the CSF 2.0 include:
If these things sound like core components of a vendor management program, that's because they are. Vendor management is not just something to do for compliance purposes. When done correctly, it can be a true value-add for your cybersecurity risk management program.
Just like the CSF, cybersecurity is not a "once and done" kind of thing. It grows. It changes. It improves. (Or at least it should.) Because of this, the CSF 2.0 places a lot of new emphasis on continuous improvement. For example:
In other words, continually work to level up your plan. You'll thank yourself later.
NIST went above and beyond with the CSF 2.0. In addition to the framework itself, NIST also published several resources, designed to make using the tool easier, including:
If you are looking for your next steps for the NIST CSF 2.0, here's what we'd like to recommend:
To wrap it up, the CSF 2.0 is a significant improvement on the former versions of the NIST Cybersecurity Framework. When implemented, it can give you the tools and terminology you need to stay strong and continue improving the cybersecurity of your organization.