Skip to content
AUSEC
Esc
  • Home/
  • Services/services/
  • Penetration testing/services/penetration-testing/
  • Vulnerability assessment/services/vulnerability-assessment/
  • Security audit/services/security-audit/
  • Compliance consulting/services/compliance-consulting/
  • Incident response and digital forensics/services/digital-forensics/
  • Corporate training and workshops/services/corporate-training/
  • Audit methodology/methodology/
  • Security posture quiz/#quiz
  • Threat Lab: attack simulator/threat-lab/#simulator
  • Threat Lab: cyber kill chain/threat-lab/#kill-chain
  • Threat Lab: defence in depth/threat-lab/#defence
  • Threat Lab: spot the phish/threat-lab/#phish
  • Threat Lab: terminal/threat-lab/#terminal
  • Frameworks hub/frameworks/
  • Framework cross-mapping/frameworks/#crossmap
  • PCI DSS v4.0.1/frameworks/pci-dss/
  • ISO/IEC 27001:2022/frameworks/iso-27001/
  • ISO/IEC 27002:2022/frameworks/iso-27002/
  • NIST Cybersecurity Framework 2.0/frameworks/nist-csf/
  • CERT-In Audit Guidelines (India)/frameworks/cert-in/
  • Training and internships/training/
  • Resources: articles and checklists/resources/
  • PCI DSS v4.0.1: what changed, and what it means now/resources/pci-dss-4-0-1-changes/
  • ISO/IEC 27001:2022 Annex A for beginners/resources/iso-27001-annex-a-beginners/
  • NIST CSF 2.0: the Govern function explained/resources/nist-csf-govern-function/
  • How to prepare for a CERT-In audit/resources/prepare-cert-in-audit/
  • Glossary/resources/#glossary
  • Team and certifications/team/
  • About Ausec/about/
  • Contact and book an assessment/contact/
  • Privacy policy/privacy/
  • Terms of use/terms/
  • Responsible disclosure/responsible-disclosure/
  • Design system/styleguide/

NIST CSF 2.0: the Govern function explained

Govern is the biggest change in NIST CSF 2.0. It puts cybersecurity strategy, roles, policy, oversight and supply chain risk at the centre of the framework.

· 5 min read

NIST published the Cybersecurity Framework 2.0 in February 2024. Alongside a broader scope that covers organisations of every size and sector, it added a sixth function, Govern, to the existing five: Identify, Protect, Detect, Respond and Recover.

Govern sits at the centre of the framework's wheel because it informs how the other five are prioritised and carried out.

The six Govern categories

  • GV.OC Organizational Context: the mission, stakeholder expectations and legal and regulatory requirements that shape cybersecurity decisions.
  • GV.RM Risk Management Strategy: priorities, risk appetite and tolerance, agreed and communicated.
  • GV.RR Roles, Responsibilities, and Authorities: who is accountable, with adequate resources.
  • GV.PO Policy: cybersecurity policy established, communicated and enforced.
  • GV.OV Oversight: results of the strategy reviewed and used to adjust it.
  • GV.SC Cybersecurity Supply Chain Risk Management: supplier risks identified, assessed and managed.

Why it was added

In version 1.1 many governance outcomes were spread across Identify. Pulling them into their own function makes clear that cybersecurity is an enterprise risk owned by leadership, not only a technical programme. Supply chain risk in particular gained much more weight.

Getting started with Govern

  • Write down your risk appetite for cybersecurity in a form the board can approve.
  • Map accountability: who owns each major risk and control area.
  • Review your supplier list and rank suppliers by the access and data they hold.
  • Set a regular review where results are reported and the strategy is adjusted.

If you already run an ISO/IEC 27001 ISMS, much of Govern maps to clauses 4 to 6 and the supplier controls 5.19 to 5.22, so the two frameworks reinforce each other.