NIST CSF 2.0
Govern is the new sixth function.

The NIST Cybersecurity Framework is a voluntary, flexible framework for managing cybersecurity risk, first published in 2014 and updated to version 1.1 in 2018. Version 2.0 was released February 26, 2024. The biggest change: adding Govern as the new sixth core function (previous versions had five: Identify, Protect, Detect, Respond, Recover). CSF 2.0 also expanded explicit guidance for small and medium businesses, added cybersecurity supply chain risk management as a discrete area, and updated tier descriptions. The framework continues to be designed as a flexible reference, not a checklist.

Govern is the new sixth function added in CSF 2.0. It covers the organizational context, governance, and risk management foundation that underlies the other five functions. Six categories: Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles, Responsibilities, and Authorities (GV.RR), Policy (GV.PO), Oversight (GV.OV), and Cybersecurity Supply Chain Risk Management (GV.SC). Most CSF 1.1 implementations had governance elements scattered across the Identify function or missing entirely. CSF 2.0 explicitly recognizes that organizational risk culture, policy, and accountability are the foundation everything else depends on.

The four implementation tiers describe how an organization approaches cybersecurity risk. Tier 1 (Partial): risk management is ad-hoc and reactive. Tier 2 (Risk Informed): risk management approved by management but not organization-wide. Tier 3 (Repeatable): risk management practices are formally approved and expressed as policy, and updated based on changes. Tier 4 (Adaptive): organization adapts its cybersecurity practices based on lessons learned and predictive indicators. Tiers are characteristics, not grades — the appropriate tier depends on business context, regulatory environment, and risk tolerance.

CSF is a framework. The others are specific control standards or compliance frameworks. CSF 2.0 includes informative references mapping CSF subcategories to NIST SP 800-53, NIST SP 800-171, ISO/IEC 27001, COBIT, and others. In practice: an organization with a NIST 800-171 implementation already has substantial CSF Protect, Detect, and Respond coverage — the CSF assessment crosswalks that work. CMMC 2.0 Level 2 maps closely to 800-171. ISO 27001 controls map to CSF subcategories. WCC's assessments produce the crosswalk so existing compliance work compounds.

CSF is voluntary at the federal level — NIST does not enforce it. However, multiple regulatory and industry contexts have effectively made CSF de facto required: federal contracts increasingly require CSF alignment as part of broader cybersecurity requirements, cyber insurance underwriters request CSF posture as part of renewal assessments, state laws (notably Ohio Senate Bill 220) provide affirmative defenses for organizations following CSF, and audit firms reference CSF as part of SOC 2 and similar attestations. For most mid-market organizations, "voluntary" is technically true but practically misleading.

Pricing depends on organization size, environment complexity, and scope. A standalone CSF 2.0 assessment for a small business (under 50 users) typically runs $8,000-$18,000 as a fixed-fee engagement covering all six functions, tier-target setting, gap analysis, and a written assessment report. Mid-market assessments (50-300 users) typically run $18,000-$45,000. Enterprise assessments scope per engagement. Ongoing CSF program management (quarterly tier-tracking, gap remediation, board reporting) runs as a managed service on top of the initial assessment or via vCISO services.