Updated NIST CSF Version 2.0 – What You Need to Know
NIST CSF Updates - What You Need to Know
As companies across the globe continue to transfer resources to in-house or cloud computer information systems, cybersecurity risks have also grown. In response to these concerns, the National Institute of Standards and Technology (NIST) recently released an updated cybersecurity framework for its growing global audience. This article will address some of the latest changes to the NIST CSF and introduce added resources made specifically for small businesses.
What is the NIST CSF?
In February 2013, an Executive Order by the President of the United States tasked NIST with creating a Cybersecurity Framework (CSF) for improving critical infrastructure cybersecurity measures, which was released the following year. Since then, this guidance document has been adopted beyond the critical infrastructure community, being used by many organizations across all industries to reduce cybersecurity risks around the globe.
The CSF Version 1.0 had 5 core “Functions” for managing cybersecurity risk: “Identify”, “Protect”, “Detect”, “Respond”, and “Recover.” Within each of these areas were categories of cybersecurity controls, such as “Access Management.” These categories were then split into subcategories with individual outcomes, such as “External information systems are catalogued.” Each outcome includes references to controls included references to other frameworks and standards, such as NIST 800-30, or ISO/IEC 27001 to look at credible examples of fulfilling this control requirement.
The CSF focuses on desired outcomes that are intended to be understood by a broad audience, including executives, managers, and practitioners, regardless of their cybersecurity expertise. The CSF outlines “Implementation Tiers” which characterize the rigor of an organization’s cybersecurity risk governance and management practices, and they provide context for how an organization views cybersecurity risks and the processes in place to manage those risks. The Tiers outline a way to “rate” an organization’s practices for managing cybersecurity risk as either Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4). Selecting a target Tier helps set the overall tone for how an organization will manage its cybersecurity risks.
What Changes are in Version 2.0?
On February 26, 2024, NIST announced the publication of CSF version 2.0. Version 2.0 of the framework is now written more generically to allow application for all audiences, regardless of size, industry sector, or organization type. Below are some of the most significant changes.
- The “Govern” function has been added as the 6th core function. This new function consists of elements that have been moved from other functions and represents an increased emphasis on the importance of governance and enterprise risk management to the cyber risk strategy.
- Outcome statements have been updated to better fit a range of international cybersecurity requirements across various industries. The CSF does not prescribe how outcomes should be achieved. Rather, it links to online resources that provide additional guidance on practices and controls that could be used to achieve those outcomes.
- Outcome language has been simplified so it can be easily understood, regardless of the reader’s technical background.
- Examples of implementation have been added to provide extra clarity, in addition to the references to other frameworks and standards.
Enhanced focus on supply chain risks—an organization can use the CSF to foster cybersecurity risk oversight and communications with stakeholders across supply chains. Given the complex and interconnected relationships in today’s technology ecosystem, supply chain risk management is critical for organizations. The NIST CSF supply chain risk content helps organizations manage exposure to cyber risk by developing appropriate response strategies, policies, processes, and procedures.
Want to Implement NIST CSF 2.0?
If you or someone you know is looking for help in beginning the journey to managing cybersecurity risk using the NIST CSF 2.0 Framework, AARC-360 can help jump-start the process. We can help you move into implementing the entire NIST CSF 2.0, that is compatible with international cybersecurity standards. As your organization grows, the CSF can be valuable preparation for cybersecurity standards you may be required to meet in the future. Please do not hesitate to reach out to us at www.aarc-360.com.
Jessica Kinghorn (Staff Audit Consultant, AARC-360)
Bernie Wedge (Advisory Board Member, AARC-360)
