CSF 2.0’s biggest addition was the one a security team could not deliver
NIST’s new Govern function looked like a security framework update. Its six categories assign work to executives, HR, procurement and boards. Organizations that treated it as a mapping exercise for the CISO missed what had changed.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On February 26, 2024, the National Institute of Standards and Technology released version 2.0 of its Cybersecurity Framework, the first major revision since the framework was introduced in 2014. The new version broadened its stated audience from critical infrastructure to organizations of all sizes and sectors. It added a sixth core function, Govern, alongside Identify, Protect, Detect, Respond and Recover. Govern has six categories: organizational context, risk management strategy, roles and responsibilities, policy, oversight, and cybersecurity supply chain risk management. NIST also published implementation examples, quick-start guides and an online reference tool mapping the framework to other standards. The framework remained voluntary. The release came in the same week that the Change Healthcare outage was spreading through the health sector.
The Cybersecurity Framework is a shared vocabulary across regulated industries. Banks map to it alongside their examiners’ expectations. Health systems use it with HIPAA and the HHS cybersecurity performance goals. Many states reference it in policy. Version 2.0 kept the familiar functions, so most organizations responded the usual way: the security team updated its control mapping. That missed what Govern changed. Almost nothing in its six categories can be delivered by a security team alone. They sort into four groups of work, each owned somewhere else: direction, set by executives; people, shared with human resources; suppliers, shared with procurement and legal; and oversight, owned by the board. Together they cover every Govern category once.
Direction: context, strategy and policy
Three categories set direction. Organizational context asks what the mission is, which stakeholders and legal obligations matter, and which services others depend on. Risk management strategy asks for risk appetite and tolerance, stated and communicated. Policy asks for a cybersecurity policy that follows from both.
In many organizations the CISO set cyber risk tolerance by default, through what got funded and which exceptions were signed. Enterprise risk management set appetite for everything else, on a different scale. Govern asks for the two to meet. In a regional bank that means a cyber section in the board-approved risk appetite statement, with measurable tolerances such as maximum tolerable downtime for payments. In a health system it means an executive decision on acceptable clinical system downtime against the cost of resilience. In an agency it means tying cyber to the agency’s enterprise risk profile under existing federal risk guidance.
The practical test is simple. The organization should be able to name the executive who accepted its largest cyber risk, and the document where that acceptance is recorded. If the answer is the CISO and a ticket, direction has not been set.
There is a trade-off. Executives who formally accept cyber risk will ask harder questions about cost, and some will accept more risk than the CISO would like. That is the intended outcome. A tolerance the business has chosen, and can be held to, is more durable than a stricter one that only the security team believes in. It also gives the CISO a clear basis for escalation when actual exposure drifts past the agreed line.
People: roles, responsibilities and authorities
The roles category asks that cybersecurity roles be established, communicated, resourced and tied to human resources practice. That reaches well beyond the security organization. Application owners own access reviews for their systems. Business unit heads own acceptance of risk exceptions in their areas. Managers own timely notice when staff and contractors leave.
Most organizations had a responsibility chart for incident response and little else. A workable approach is a short register of cyber accountabilities by role, published by HR alongside job descriptions, with time allocated. Small banks, rural hospitals and local agencies, where one person may hold four roles, benefit most, because writing it down shows where coverage is thin.
Offboarding is the clearest example. Accounts left active after people leave remain a common finding in audits across all three sectors. Under Govern this becomes a joint HR and IT process with a defined handoff. It also gets a metric, such as the share of accounts disabled within a day of separation.
Suppliers: cybersecurity supply chain risk management
Supply chain risk management moved under Govern as its own category, with outcomes covering supplier criticality, contract requirements, due diligence, monitoring and offboarding. Each outcome has a natural owner outside security. Business owners decide which services are critical. Procurement selects and onboards suppliers. Legal writes the clauses on notification, audit and exit. Security assesses controls and monitors.
In most organizations these pieces existed without coordination. The questionnaire belonged to security, the contract to legal, and the criticality rating to no one. Govern gives a structure for assigning each piece and making the handoffs visible. A useful single metric is the share of critical suppliers with a current criticality rating, a contract meeting the organization’s standard clauses and a tested exit plan. Few organizations could report it in early 2024. The Change Healthcare outage, spreading through hospitals and pharmacies that same week, showed what an unrated, single-threaded supplier dependency costs.
Oversight: closing the loop with the board
The oversight category asks that results of cyber risk management be reviewed and used to adjust strategy. This is the loop through senior leadership and the board. It matched where regulation was already heading. The SEC’s disclosure rule required public companies to describe board oversight of cyber risk, and banking supervisors had long expected regular board reporting. CSF 2.0 gave health systems, agencies and private firms a reference for the same expectation.
Oversight fails when board reporting is a list of activities. It works when the board sees a few measures tied to the tolerances set under direction, each with a named owner. Examples include recovery times achieved in tests, critical supplier coverage and overdue risk acceptances. That ties the four groups together. Direction sets the tolerances, people and suppliers carry them out, and oversight checks the result.
With hindsight
CSF 2.0 quickly became the reference version. NIST continued to add quick-start guides and mappings through 2024 and 2025. In banking, the Federal Financial Institutions Examination Council announced in August 2024 that it would retire its Cybersecurity Assessment Tool on August 31, 2025. It pointed institutions to resources including NIST CSF 2.0 and CISA’s Cybersecurity Performance Goals. That made the framework, Govern included, a common starting point for bank self-assessments. Its use remained voluntary, and examiners continued to apply their own risk-based approach. The structure of Govern has held up as a planning tool. Its value lies in the question it forces: when a supervisor, auditor or director asks who owns a given cyber risk, the answer should be a named executive and a document. Later articles in this series look at what the tool’s retirement meant for banks.