NIST CSF 2.0: What Changed and How to Implement It
Radius360 Team · 2026-04-01 · Compliance Frameworks
NIST CSF 2.0 introduced a sixth function — Govern — and restructured the entire framework. Here's what changed, why it matters, and a practical roadmap for implementing it in your organization.
NIST CSF 2.0 is the biggest update in a decade
When NIST released Cybersecurity Framework 2.0 in February 2024, it wasn't a minor revision. It was a fundamental restructuring of how organizations should think about cybersecurity. The original CSF — released in 2014 and lightly updated in 2018 — gave us five functions: Identify, Protect, Detect, Respond, and Recover. Version 2.0 adds a sixth: Govern.
That single addition changes everything. Governance is no longer implied — it's explicit, mandatory, and sits at the center of the framework.
What actually changed in CSF 2.0
1. The new Govern function
Govern (GV) is the most significant change. It addresses organizational context, risk management strategy, roles and responsibilities, policies, and oversight. In CSF 1.1, these concepts were scattered across the other five functions or mentioned in the implementation tiers. Now they have their own dedicated function with six categories:
- GV.OC — Organizational Context: understanding your business environment, stakeholders, and legal requirements
- GV.RM — Risk Management Strategy: defining your risk appetite and tolerance
- GV.RR — Roles, Responsibilities, and Authorities: who owns what
- GV.PO — Policy: formal documentation of your cybersecurity approach
- GV.OV — Oversight: board and executive involvement in cybersecurity decisions
- GV.SC — Cybersecurity Supply Chain Risk Management: third-party and supply chain risk
This means organizations can no longer treat governance as an afterthought. If your security program doesn't have clear ownership, documented policies, and executive oversight, you have a gap — and CSF 2.0 makes that gap visible.
2. Expanded scope beyond critical infrastructure
CSF 1.1 was written for critical infrastructure organizations. CSF 2.0 explicitly applies to all organizations — small businesses, enterprises, nonprofits, and government agencies. The language throughout the document reflects this broader audience.
This matters for consultants and vCISOs because clients can no longer say "NIST CSF doesn't apply to us." It applies to everyone.
3. Restructured categories and subcategories
Every function was reorganized. Many subcategories were consolidated, renamed, or moved. If you had a control mapping built against CSF 1.1, you'll need to remap it. The good news: the new structure is more logical and eliminates redundancies that frustrated practitioners working with the original framework.
4. Stronger emphasis on supply chain risk
Supply chain risk management was always part of NIST CSF, but it was buried. In 2.0, it's elevated to a category within Govern (GV.SC) and referenced across multiple other functions. Given the rise of supply chain attacks — SolarWinds, Log4j, MOVEit — this change reflects reality.
5. Implementation examples and quick-start guides
NIST added practical implementation examples for every subcategory, making the framework more actionable. They also published quick-start guides for small bu