Is the NIST Cybersecurity Framework mandatory?

Not in the United States at the federal level, but it has been adopted as a de facto standard across sectors and is referenced in regulation, contract requirements, and federal agency security directives. Many regulated industries treat compliance as a practical requirement.

What is the Govern function added in CSF 2.0?

Govern (GV) establishes cybersecurity risk management as an organisational priority with an explicit owner. It covers policies, roles, supply-chain risk, and oversight — the governance layer that connects security practice to business accountability. It was absent from CSF 1.1 and is the most significant structural change in version 2.0.

What is the difference between CSF 2.0 and the NIST AI Risk Management Framework?

CSF 2.0 covers cybersecurity risk across all systems. The AI RMF (AI 100-1), published in January 2023, is specific to AI systems and covers trustworthiness, bias, and explainability risks alongside security. They share vocabulary but serve different assessment scopes.

NIST Cybersecurity Framework 2.0: The Govern Function and What Changed

CSF 2.0 added a sixth function, Govern, and made the framework explicitly for every organisation, not just critical infrastructure. What the change asks of you.

Dwayne ThompsonEngineering, standards & trade editor · Kingston

April 14, 2024 · 7 min read

An architecture diagram on a screen, illustrating the NIST Cybersecurity Framework 2.0. · Image: Girder Group

For a decade the NIST Cybersecurity Framework had five functions. On 26 February 2024 it gained a sixth function, Govern, and shed the language that made it read as a critical-infrastructure document (NIST, 2024). The addition is not cosmetic. It says, in a standard the whole world benchmarks against, that cybersecurity is a governance responsibility with an owner and a record, not a technical function left to the security team.

Key takeaways

CSF 2.0 adds Govern to the existing Identify, Protect, Detect, Respond, and Recover functions.
The framework is now explicitly for organisations of every size and sector, not only critical infrastructure.
Govern formalises accountability, policy, and, notably, supply-chain and third-party risk.
Voluntary in name, CSF is a de facto benchmark that contracts, insurers, and regulators increasingly assume.

What changed in 2.0

The headline change is the new Govern function, which sits across the other five and covers organisational context, risk-management strategy, roles and responsibilities, policy, and oversight (NIST Cybersecurity Framework). It moves cybersecurity decisions up to where accountability lives, and it expects those decisions to be documented rather than assumed.

CSF 2.0 also broadened its audience. The 2018 version was framed around critical infrastructure; 2.0 is written for “organizations of all sizes and sectors,” with explicit help for smaller organisations getting started (NIST, 2024). A manufacturer, a logistics firm, a fintech, and a hospital can now use the same reference without translation.

Govern elevates supply-chain and third-party risk in particular. Most organisations are exposed through vendors they do not control, and 2.0 treats managing that exposure as a governance obligation, which, in practice, means a record of who your critical suppliers are, what access they hold, and how you oversee them.

“Govern says, in a standard the whole world benchmarks against, that cybersecurity is a governance responsibility with an owner and a record.”

What this means operationally

Give cybersecurity a named governance owner and a policy trail. Govern is unmet if security decisions have no accountable owner and no documented basis.

Build and maintain a supplier inventory with access and oversight. The framework now expects third-party risk to be managed, not assumed.

Map your existing controls to the six functions, so gaps are visible and defensible.

Treat CSF as a benchmark others will apply to you, in contracts, insurance, and diligence, even though it is voluntary.

How AI could address the gap

The Govern function turns cybersecurity into an evidence exercise: an owner, a policy, a supplier map, an oversight trail. Keeping that evidence current across a changing organisation is exactly the standing work that defeats manual governance.

AI-assisted systems can maintain the mapping of controls to the six functions, keep the third-party inventory reconciled as vendors change, and surface where the documented policy and the real configuration have drifted apart. The accountable owner still governs; the machine keeps the framework honest between reviews. It is the same standing-reconciliation idea we apply to ISO management systems.

Building the platforms, portals, and systems that make these obligations provable is what Girder Group does.

Sources

1.NIST Releases Version 2.0 of Landmark Cybersecurity Framework, 26 February 2024.National Institute of Standards and Technology
2.The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29.National Institute of Standards and Technology

Common questions

Is the NIST Cybersecurity Framework mandatory?: Not in the United States at the federal level, but it has been adopted as a de facto standard across sectors and is referenced in regulation, contract requirements, and federal agency security directives. Many regulated industries treat compliance as a practical requirement.
What is the Govern function added in CSF 2.0?: Govern (GV) establishes cybersecurity risk management as an organisational priority with an explicit owner. It covers policies, roles, supply-chain risk, and oversight — the governance layer that connects security practice to business accountability. It was absent from CSF 1.1 and is the most significant structural change in version 2.0.
What is the difference between CSF 2.0 and the NIST AI Risk Management Framework?: CSF 2.0 covers cybersecurity risk across all systems. The AI RMF (AI 100-1), published in January 2023, is specific to AI systems and covers trustworthiness, bias, and explainability risks alongside security. They share vocabulary but serve different assessment scopes.

Dwayne Thompson

Engineering, standards & trade editor · Girder Group · Kingston

Dwayne Thompson writes on compliance engineering, standards (NIST), and trade and logistics regulation (CBP, DOT, FMC), from Girder Group's Kingston desk.

Meet the desk