NIST CSF 2.0 in boardroom language

Updated: 2026-10-20

The NIST Cybersecurity Framework is one of the most widely used frameworks for managing cyber risk. Version 2.0, published in February 2024, broadened its audience to organizations of every size and added a sixth function focused on governance.

The six functions

1. Govern: strategy, roles and responsibilities, policy, supply chain risk. New in 2.0.
2. Identify: asset inventory, risk assessment, business dependencies.
3. Protect: identity and access management, awareness, data and platform security.
4. Detect: continuous monitoring and adverse event analysis.
5. Respond: incident management, communication, containment.
6. Recover: restoration, backup testing, lessons learned.

Why Govern matters to CISOs

Govern puts in writing what security leaders have said for years: cyber risk is business risk, and leadership owns it. It gives you a structured way to ask for budget, define risk appetite and bring stakeholders outside IT to the table.

Using CSF for board reporting

• Score each of the six functions (for example, 1–4) today and in twelve months.
• Show the gap as a single picture, not dozens of controls.
• Map every roadmap project to the function and gap it closes.
• Re-score quarterly to show progress.

Official source: NIST Cybersecurity Framework (opens in a new window)