The National Institute of Standards and Technology (NIST) has always been at the forefront of cybersecurity guidance. With the Cybersecurity Framework (CSF) 2.0 release, NIST has addressed the evolving challenges of modern cybersecurity.

This article discusses some of the bigger changes in the recently released CSF 2.0, spotlighting governance and supply chain security while emphasizing continuous improvement.

What Is the Cybersecurity Framework (CSF)?

The Cybersecurity Framework is a set of guidelines for mitigating organizational cybersecurity risks. It was published by NIST and is based on existing standards, guidelines, and practices. Here are some key aspects of the NIST Cybersecurity Framework:

• Purpose: The framework provides a high-level taxonomy of cybersecurity outcomes and a methodology to assess and manage those outcomes. It also offers guidance on protecting privacy and civil liberties in cybersecurity.
• Structure: The framework is divided into three parts: “Core,” “Profile,” and “Tiers.” The “Framework Core” contains activities, outcomes, and references related to various aspects of cybersecurity. The “Framework Implementation Tiers” help organizations understand their view of cybersecurity risk and their management approach. A “Framework Profile” is a list of outcomes an organization chooses based on its needs and risk assessments.
• Functions and Categories: The NIST Cybersecurity Framework organizes its “core” material into five functions subdivided into 23 “categories.” Each category has subcategories of cybersecurity outcomes and security controls, totaling 108 subcategories. “Informative Resources” are provided for each subcategory, referencing specific sections of various information security standards.

The latest official version of the CSF (version 1.1) is quickly becoming obsolete. To help deal with modern challenges, NIST began developing CSF 2.0 over the past three or four years. The official draft version of this document was released this past August (2023) for feedback from stakeholders. While there are several changes, some of the most important cover a new emphasis on governance, expanded applicability to non-essential organizations, refocusing security emphasis on digital supply chains, and promoting continuous and ongoing security improvement. 

Changes in CSF v. 2.0

While many of the changes to the Cybersecurity Framework are adjustments to specific elements, there are a few big refactors that align the document with new and emerging security concerns:

Moving Towards Comprehensive Cybersecurity Governance

In the ever-evolving cybersecurity landscape, governance is a cornerstone for organizations aiming to manage risks effectively. The CSF 2.0, with its forward-thinking approach, has recognized the pivotal role of governance in shaping cybersecurity strategies and has thus introduced a holistic approach to it.

• Addition of “Govern” Function: One of the most significant additions to CSF 2.0 is introducing the “Govern” function. This new function delves deep into the organizational context, covering everything from formulating a risk management strategy to its oversight. Moreover, the “Govern” function underscores the need for robust policies, processes, and procedures, laying the groundwork for a systematic approach to cybersecurity.
• Broadening the Scope: The transition from CSF 1.1 to 2.0 is marked by significantly broadening its scope. Originally designed to secure U.S. critical infrastructure, the updated Framework casts a broader net. The expanded scope of CSF 2.0 reflects its applicability to organizations worldwide, regardless of their geographical location or sector.
• Integration with Other Frameworks: Recognizing the multifaceted nature of cybersecurity, NIST has ensured that the Framework integrates seamlessly with other established guidelines and standards. This is evident in its references to other NIST publications, such as the NIST Privacy Framework and enterprise risk management discussed in NIST IR 8286 showcases the Framework’s comprehensive approach. By aligning with these other resources, CSF 2.0 provides organizations a cohesive and well-rounded strategy to tackle cybersecurity challenges.
• Emphasis on Organizational Context: Every organization is unique, with its challenges, objectives, and operational nuances. CSF 2.0, emphasizing governance, pushes organizations to consider their specific context. This means understanding the intricacies of their operations, the nature of the threats they face, and the vulnerabilities inherent in their systems. 

Re-Focusing on Supply Chain Security

Supply chains are the most essential part of cybersecurity. Software, cloud tools, and other solutions are the foundation for modern government.  A single vulnerability in any part of the supply chain can compromise the entire system, leading to potential data breaches, financial losses, and reputational damage. Recognizing the criticality of this aspect, CSF 2.0 has taken significant strides to bolster supply chain security, ensuring that organizations are equipped to address the multifaceted challenges that arise from complex supply chain networks.

• Updated Practices: CSF 2.0 acknowledges the dynamic nature of supply chain governance and has updated its content to reflect the latest best practices in security. This includes guidance on secure software development, ensuring that applications and systems are designed with security in mind from the ground up. Additionally, the Framework provides insights into supply chain risk management, offering strategies to vet suppliers, monitor third-party activities, and ensure that every link in the supply chain adheres to the highest security standards.
• Holistic Security: CSF 2.0 encourages organizations to adopt a holistic view of their supply chain. This means going beyond the immediate suppliers and considering secondary and tertiary suppliers, contractors, and other entities with access to critical systems and data. Organizations can identify potential weak points by mapping the supply chain and implementing layered security measures to ensure robust protection.
• Collaboration: Supply chain security is a collaborative endeavor. It requires collaboration between all stakeholders, from suppliers and service providers to customers and regulatory bodies. CSF 2.0 emphasizes the importance of open communication, information sharing, and joint risk assessments. By fostering a collaborative environment, organizations can pool resources, share threat intelligence, and collectively enhance the security of the entire supply chain.

Promoting Continuous Improvement

Organizations must adopt a continuous improvement mindset to stay ahead of these challenges, ensuring their cybersecurity strategies are reactive and proactive. CSF 2.0, with its forward-thinking approach, places a significant emphasis on continuous improvement, guiding organizations toward a resilient and adaptive cybersecurity posture.

• Adaptive Cybersecurity Practices: The essence of continuous improvement lies in learning and adapting. CSF 2.0 champions this by encouraging organizations to refine their cybersecurity practices based on retrospective and current insights. This encompasses lessons learned from past incidents, predictive indicators derived from data analytics, and stakeholder feedback. Organizations can remain agile by continuously iterating on their practices, responding effectively to emerging threats, and minimizing potential vulnerabilities.
• Monitoring and Evaluation: Organizations can gain a granular understanding of their cybersecurity posture by incorporating key performance indicators (KPIs) and key risk indicators (KRIs). This data-driven approach allows them to assess their measures’ effectiveness, identify improvement areas, and make informed decisions to bolster their defenses.
• Iterative Action: An effective cybersecurity strategy is not static; it evolves with the organization’s objectives, the threat landscape, and technological advancements. CSF 2.0 underscores the importance of revisiting and updating action plans regularly. By doing so, organizations can ensure that their strategies remain relevant, addressing current challenges and anticipating future ones. This iterative approach, coupled with feedback mechanisms, fosters a culture of continuous improvement, where cybersecurity is seen as a dynamic journey rather than a fixed destination.

Prepare Your Organization for CSF 2.0 with Continuum GRC

Continuum GRC is a cloud platform that can take something as routine and necessary as regular vulnerability scanning and reporting under FedRAMP and make it an easy and timely part of business in the public sector. We provide risk management and compliance support for every major regulation and compliance framework on the market, including:

• FedRAMP
• StateRAMP
• GDPR
• NIST 800-53
• FARS NIST 800-171
• CMMC
• SOC 1, SOC 2
• HIPAA
• PCI DSS 4.0
• IRS 1075
• COSO SOX
• ISO 27000 Series
• ISO 9000 Series
  
• ISO Assessment and Audit Standards

And more. We are the only FedRAMP and StateRAMP-authorized compliance and risk management solution worldwide.

Continuum GRC is a proactive cyber security® and the only FedRAMP and StateRAMP-authorized cybersecurity audit platform worldwide. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.