NIST CSF 2.0: The draft update that put governance at the center of cybersecurity

For nearly a decade, the NIST Cybersecurity Framework was the most widely referenced guide to managing cyber risk in the United States and beyond. Built around five functions, Identify, Protect, Detect, Respond, and Recover, it gave organizations of every size a common structure for thinking about security. In August 2023, NIST released the first full draft of version 2.0, and the changes were significant. The most notable was the addition of a sixth function, Govern, which elevated governance from an afterthought to the foundation of the entire framework. Here is what the draft changed and why it mattered.

The new Govern function

The addition of Govern was the headline change, and it carried real meaning. NIST placed the new function at the center of the framework, positioning it as the hub around which the other five functions orbit. Govern covers the organizational context of cybersecurity: establishing risk management strategy, defining roles and responsibilities, setting policy, and overseeing the program at the executive and board level. The message was clear that cybersecurity is not just a technical discipline but a matter of organizational governance, and that leadership accountability is where a durable security program begins. It formalized what had been implicit for years.

Broadening beyond critical infrastructure

A second major change was scope. The original framework was developed for critical infrastructure, but it had long outgrown that origin, adopted voluntarily by organizations across every sector and size. Version 2.0 acknowledged this reality explicitly, reframing the framework as a resource for all organizations, not just those in designated critical sectors. This was partly recognition and partly invitation: NIST wanted the framework to be accessible to the small and mid-sized organizations that make up most of the economy, and the draft reflected that with clearer, more broadly applicable language and a renewed emphasis on practical, actionable guidance.

Where training and awareness sit

Training and awareness have always been part of the framework, sitting within the Protect function as a core control. The 2.0 draft kept that emphasis and strengthened its connection to the new Govern function. The logic is straightforward: governance is only effective if the people carrying out the program understand it, and that understanding comes from training and communication. The draft reinforced that a security-aware workforce is not a peripheral nice-to-have but a foundational control, and that the responsibility for ensuring it lies with leadership, not just the security team. Training became, in the framework's terms, both a protective control and an expression of governance.

The supply chain came into sharper focus

The draft also deepened the framework's treatment of supply chain risk. This was a direct response to the lessons of recent years, from SolarWinds to Log4Shell, which had shown that an organization's security depends on the vendors, services, and open source components it relies on. Version 2.0 wove supply chain considerations through the functions rather than treating them as a separate, optional add-on. The message was that supply chain security is not a niche concern but a standing part of the risk management program, and that organizations need to understand and manage the risk that enters through their dependencies.

Why the draft mattered even before finalization

The 2.0 draft was, by definition, not final, and NIST explicitly invited public comment before publishing the finished version in early 2024. But the direction was clear enough to matter immediately. Organizations began preparing for the Govern function, reviewing their board-level oversight, and formalizing roles and responsibilities that had been informal. The draft also signaled that the framework would remain the common language of cybersecurity, and that organizations aligned with it would be positioned for the regulatory and insurance expectations that increasingly reference NIST. In that sense, the draft was not a preview but a roadmap.

The direction of travel

What the 2.0 draft made unmistakable was a broader shift in how the industry thinks about cybersecurity. The elevation of governance, the broadening of scope, and the deepening of supply chain focus all pointed in the same direction: security is becoming a matter of organizational accountability and continuous management, not a technical project with a finish line. For organizations of every size, the practical takeaway was to treat the framework as a living structure to align with, to document the governance and training that the new function emphasized, and to recognize that the direction NIST set in 2023 would shape expectations for years to come.