Key Points

References

Key Concepts

NIST cybersecurity framework

https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf

NIST.Cybersecurity-framework-2-SWP.29.pdf.     GD

NIST.Cybersecurity-framework-2-SWP.29.pdf.  file

NIST now provides Implementation Examples and Informative References

• CSF Core, the nucleus of the CSF, which is a taxonomy of high-level cybersecurity outcomes that can help any organization manage its cybersecurity risks. The CSF Core components are a hierarchy of Functions, Categories, and Subcategories that detail each outcome. The outcomes are sector-, country-, and technology-neutral, they provide an organization with the flexibility needed to address its unique risks, technologies, and mission considerations.

• CSF Organizational Profiles, which are a mechanism for describing an organization’s current and/or target cybersecurity posture in terms of the CSF Core’s outcomes.

• CSF Tiers, which can be applied to CSF Organizational Profiles to characterize the rigor of an organization’s cybersecurity risk governance and management practices. Tiers can also provide context for how an organization views cybersecurity risks and the processes in place to manage those risks

NIST resources that describe the mutual relationship between cybersecurity risk management and ERM include: • NIST Cybersecurity Framework 2.0 – Enterprise Risk Management Quick-Start Guide • NIST Interagency Report (IR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) • IR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management • IR 8286B, Prioritizing Cybersecurity Risk for Enterprise Risk Management • IR 8286C, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight • IR 8286D, Using Business Impact Analysis to Inform Risk Prioritization and Response • SP 800-221, Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio • SP 800-221A, Information and Communications Technology (ICT) Risk Outcomes: Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Supply chain risks: An organization can use the CSF to foster cybersecurity risk oversight and communications with stakeholders across supply chains. All types of technology rely on a complex, globally distributed, extensive, and interconnected supply chain ecosystem with geographically diverse routes and multiple levels of outsourcing. This ecosystem is composed of public- and private-sector entities (e.g., acquirers, suppliers, developers, system integrators, external system service providers, and other technology-related service providers) that interact to research, develop, design, manufacture, acquire, deliver, integrate, operate, maintain, dispose of, and otherwise utilize or manage technology products and services. These interactions are shaped and influenced by technologies, laws, policies, procedures, and practices.

NIST 2.0 CSF review 

NIST CSF 2.0 Updates Summary
Introduction to NIST CSF 2.0 (00:00 - 00:35)

The NIST Cybersecurity Framework (CSF) is a voluntary security guide developed by NIST in collaboration with public and private sectors.
It was originally designed for critical infrastructure but has now been expanded for all organizations.
Major Name and Scope Change (00:35 - 01:56)

CSF 2.0 removes the emphasis on "critical infrastructure" to make it applicable across all industries.
New additions include community profiles, organizational profile templates, and Quick Start guides to streamline implementation.
New Sixth Function: "Govern" (02:14 - 02:41)

CSF functions expanded from five to six, adding "Govern" to improve cybersecurity strategy and policy oversight.
The functions now include: Govern, Identify, Protect, Detect, Respond, and Recover.
Updated Implementation Approach (03:08 - 04:47)

The framework is not prescriptive, but defines desirable security outcomes across 21 categories and 112 subcategories.
New implementation examples provide clearer guidance on achieving security objectives, making it easier to follow.
Enhanced Clarity and Usability (06:05 - 06:54)

The language in CSF 2.0 is simplified to improve communication across technical and non-technical stakeholders.
Some outdated terms and categories have been restructured and consolidated for better alignment.
Major Overhaul of Respond and Recover Functions (08:52 - 09:49)

These functions now better align with industry-accepted incident response and recovery processes.
The updates provide more structure for security operations, making them actionable rather than abstract.
Community and Organizational Profiles (10:17 - 10:43)

Community profiles offer ready-made cybersecurity blueprints tailored to specific sectors or threats (e.g., ransomware).
Organizational profiles help define current vs. target security states, streamlining the transition to CSF 2.0.
No Official 1.1 to 2.0 Mapping (11:27 - 11:44)

Due to significant changes in structure and terminology, there’s no direct mapping from CSF 1.1 to 2.0.
Organizations are encouraged to start fresh with CSF 2.0 rather than attempting a direct migration.
Recommended Implementation Approach (12:03 - 12:33)

Organizations should create a new CSF 2.0 profile and use their existing CSF 1.1 data only as a baseline reference.
A migration plan should be at least a 3-month project, depending on the organization's size and complexity.
Final Thoughts and Community Support (12:33 - 13:01)

CSF 2.0 is more comprehensive, easier to implement, and better for communication across an organization.
The cybersecurity community (e.g., Simply Cyber's Discord) can be a valuable resource for practitioners adopting CSF 2.0.
Key Takeaway:
NIST CSF 2.0 is a major upgrade with a new Govern function, improved clarity, better incident response, and implementation examples, making it easier to adopt and apply across all organizations.

800-37  Risk Management Framework for Information Systems

800-30.  Guide for Conducting Risk Assessments

800-53.  Security and Privacy Controlsfor Information Systems 

AI Risk Management Framework

NIST AI 600-1.  Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence 

NIST-CSF-GUIDE_v2-implementation.pdf.     GD

NIST-CSF-GUIDE_v2-implementation.pdf.  file

Potential Value Opportunities

Potential Challenges

Candidate Solutions

Step-by-step guide for Example

sample code block

Recommended Next Steps

Related articles