Three key changes to highlight in the draft CSF are:
Title, scope, implementation examples and references
The title has changed to the commonly used name, “Cybersecurity Framework” from the original “Framework for Improving Critical Infrastructure Cybersecurity.” The scope of the framework has been updated to reflect its applicability to all organisations across the world. The previous framework emphasised securing United States’ critical infrastructure. Updates to the CSF include Implementation Examples at the Sub-category level, to help organisations achieve outcomes, as well as references to standards, guidelines, regulations, and other resources to help inform how an organisation achieves the Functions, Categories, and Sub-categories.
New governance function
In order to respond to challenges of enterprise, financial and legal risks, the CSF introduces a new "Govern" function in addition to the previous existing functions of “Identify”, “Protect”, “Detect”, “Respond”, and “Recover”.
The new “Govern” function highlights the role of the business and the importance of the alignment between security and the organisation's strategic objectives. "Govern" also provides additional guidance on Enterprise Risk Management.
Changes to Functions, Categories and Sub-categories
As mentioned, the substantial update has resulted in a change to the number of Functions, Categories and Sub-categories in the Framework.
CSF 1.1 | CSF 2.0 | |
---|---|---|
Functions | 5 | 6 |
Categories | 23 | 22 |
Sub-catgories | 108 | 106 |
Draft 2.0
Workshop #3
Comments due
Release date
NIST have stated that v 2.0 will be released in early 2024: any comments or feedback must be provided to NIST by November 2023.
CSF 2.0 is a voluntary framework. Organisations can determine their own timeline to update profiles or maturity assessments developed with reference to the previous iteration of the Framework.
For those organisations seeking to use CSF 2.0 for the first time, the draft CSF 2.0 can be reviewed now to consider its applicability and utility.
Have you considered what the publication of NIST CSF 2.0 may mean for your organisation?
Will you need to update existing profiles or maturity assessments developed with reference to NIST CSF version 1.1? Will changes to CSF Functions and Categories impact your current and target state? Will weighting changes within Functions have an impact?
Do your executives have strategic oversight of cybersecurity risk management and supply chain management?
The new Govern function sets out a framework for organisations to establish and monitor their cybersecurity risk management strategy and risk appetite, including supply chain risk management.
How does your existing management of cybersecurity risk intersect with other risk areas?
CSF 2.0 provides guidance on how the Framework overlaps with or intersects with other areas including privacy risks, operational and physical security risks.
How do you identify and evaluate improvements to cybersecurity risk management processes? Are lessons learned used to identify improvements?
The new Improvement category within the Identify Function emphasises the importance of continuous improvement.
1 National Institute of Standards and Technology, US Department of Commerce