NIST Cybersecurity Framework 2.0 is the first major update to the US government's free guide for managing cyber risk, and it adds a sixth function called Govern. The agency behind it is NIST, short for the National Institute of Standards and Technology, and it released this version on February 26, 2024. It replaces version 1.1, which came out in April 2018.
For buyers, the change matters because the framework now covers any organization, and it speaks directly about suppliers. This guide explains what is new and shows how to turn the six functions into plain questions for vendors.
What changed in version 2.0
Version 1.1 was written with critical infrastructure in mind. The earlier title was "Framework for Improving Critical Infrastructure Cybersecurity." NIST dropped that title for 2.0. The framework now says it is for any organization, whatever its size, sector or skill level.
Four changes stand out:
- A new Govern function. It joins the five functions from earlier versions.
- A wider audience. NIST names executives, boards, lawyers, risk managers and buyers of technology as readers, not only security staff.
- More on supply chains. Supplier risk now has its own category inside Govern.
- More help to get started. NIST added quick start guides, including ones for small businesses and for supply chain risk, plus a catalog that links the framework to more than 50 other cybersecurity documents.
Sources: NIST, "The NIST Cybersecurity Framework (CSF) 2.0," NIST CSWP 29, February 26, 2024; NIST news release, "NIST Releases Version 2.0 of Landmark Cybersecurity Framework," February 26, 2024; NIST news release, "NIST Releases Version 1.1 of its Popular Cybersecurity Framework," April 16, 2018
The six functions in plain words
The framework sorts its goals into six functions. The order does not mean one comes first. NIST says the outcomes are not a checklist.
| Function | What it means |
|---|---|
| Govern | The organization sets its cyber risk strategy, rules and roles, and checks that they are followed. |
| Identify | The organization knows its assets, suppliers and current risks. |
| Protect | It uses safeguards such as access control, training and data security. |
| Detect | It finds and studies possible attacks. |
| Respond | It acts when an incident happens. |
| Recover | It restores normal work after an incident. |
Sources: NIST CSWP 29, section 2, "Introduction to the CSF Core"
Why Govern matters to buyers
Govern is about decisions made at the top. NIST says it covers the organization's context, its strategy, roles and authority, policy, and oversight. It also ties cyber risk to the wider risk program, next to money and reputation.
That gives a buyer a simple test. A vendor with good tools but no clear owner for security, no written policy and no board attention has a gap in Govern. Strong tools alone will not close it.
Supplier risk sits inside Govern too. The framework lists outcomes such as knowing which suppliers are critical, putting security requirements into contracts, doing due diligence before a deal starts, and watching supplier risk for as long as the relationship lasts. As a buyer, you are the supplier's customer, and these lines describe what a careful customer does.
Sources: NIST CSWP 29, section 2 and Appendix A, categories GV.OC, GV.RM, GV.RR, GV.PO, GV.OV and GV.SC
Six questions to ask vendors
NIST does not publish a vendor questionnaire, and the framework is not a certification. A vendor cannot be "CSF certified." You can still use the six functions to shape your questions:
- Govern: Who is accountable for cybersecurity, and how often does leadership review it?
- Identify: Which of your assets and suppliers would affect our data, and how do you rank their risk?
- Protect: How do you control access to our data, and how do you train staff?
- Detect: How would you spot a problem with our account, and how fast?
- Respond: What is your plan for an incident, and when would you tell us?
- Recover: How long to restore service, and how do you test that?
Ask for documents, not only answers. An independent report, such as a SOC 2 report, can back up some of what a vendor says about its controls. Keep the answers in your scoring sheet so vendors can be compared on the same terms.
Sources: NIST CSWP 29, sections 1 and 2. The questions are the editors' own wording, not NIST text.
Profiles and tiers: a shared language
Two tools in the framework help buyers and vendors talk about the same thing. A Current Profile lists the outcomes an organization meets today. A Target Profile lists the outcomes it wants to reach. NIST notes that a Current Profile can be shared with business partners or prospective customers. A Target Profile can set out what you expect from suppliers and partners.
Tiers describe how mature an organization's risk practices are. They run from Partial (Tier 1) through Risk Informed (Tier 2) and Repeatable (Tier 3) to Adaptive (Tier 4). NIST does not say every organization needs Tier 4. The right tier depends on its risks and goals.
Community Profiles are shared baselines built for a group with common goals. A buyer in a specific field can start from one rather than a blank page.
Sources: NIST CSWP 29, sections 3.1 and 3.2
How a buyer can start this month
- Read the short NIST overview and the quick start guide that fits your size.
- Pick the vendors that hold your most sensitive data and ask them the six questions first.
- Add security duties to contracts, as the supply chain outcomes suggest.
- Write a Target Profile for what you expect, and compare each vendor's answers to it.
Version 2.0 is still new, so many vendors will not yet map their programs to it. A vendor that built on version 1.1 is not behind. The five older functions still sit inside the new framework. Ask how the vendor handles Govern, since that is the part version 2.0 added.
Sources: NIST news release, February 26, 2024; NIST CSWP 29
Sources
- National Institute of Standards and Technology, "The NIST Cybersecurity Framework (CSF) 2.0," NIST CSWP 29, February 26, 2024. doi.org/10.6028/NIST.CSWP.29
- NIST, "NIST Releases Version 2.0 of Landmark Cybersecurity Framework," February 26, 2024. nist.gov
- NIST, "NIST Releases Version 1.1 of its Popular Cybersecurity Framework," April 16, 2018. nist.gov