NIST CSF 2.0 organises cybersecurity outcomes into six functions, including Govern, to support risk decisions across organisations.
What it is
The NIST Cybersecurity Framework (CSF) 2.0 is voluntary guidance for communicating and managing cybersecurity risk. Version 2.0 broadens its applicability beyond critical infrastructure and gives governance more explicit prominence.
What it covers
Its six functions are Govern, Identify, Protect, Detect, Respond and Recover. The framework offers outcomes and supporting resources rather than prescribing a single mandatory implementation method.
Why it matters for digital autonomy
A common vocabulary for security priorities makes it easier to understand exposure, compare options and coordinate work across leadership, operational teams and suppliers.
Dates and status
NIST published CSF 2.0 on 26 February 2024. It is guidance, not a generally binding EU regulation.
Practical questions for organisations
- Set an organisational current profile and target outcomes.
- Use the Govern function to clarify accountability and risk appetite.
- Select controls and measurement approaches suited to the organisation, without treating adoption as certification.
Official reference
Read the source document on the issuing organisation’s website.
This is an educational reference, not legal advice, certification or a determination of applicability. Check the authoritative text and relevant national rules before making decisions.