NIST CSF 2.0 was published in February 2024 as the first major revision of the Cybersecurity Framework since 1.1 appeared in 2018. The revision introduced the Govern function as a new top-level function alongside Identify, Protect, Detect, Respond, and Recover; broadened the framework's explicit audience from critical infrastructure to all organisations; refreshed the subcategory content substantially; and expanded the supplementary resource material around tiers, profiles, and implementation guides. Organisations that have been operating on 1.1 face a transition that is more substantive than the version number suggests.
Govern as a Standalone Function
The most visible 2.0 change is the elevation of governance content from scattered subcategories across multiple functions into a dedicated Govern function. The function covers organisational context, risk management strategy, roles and responsibilities, policies and procedures, oversight, and cybersecurity supply chain risk management. Organisations that previously operated with strong governance saw their existing practices map cleanly onto the new function; organisations that had implicit governance saw the gap surface clearly. The structural change makes governance harder to neglect by design.
Supply Chain Treated More Rigorously
Cybersecurity supply chain risk management appears prominently in the new Govern function with its own category and substantial subcategory coverage. The framework's 1.1 treatment of supply chain was meaningful but lighter, and the 2.0 expansion reflects the regulatory and threat environment that emerged after 1.1 — SolarWinds and similar supply chain incidents, executive orders requiring supply chain risk practices, and the maturation of vendor risk management as a discipline. Organisations transitioning their programmes need to elevate supply chain risk to match the new prominence; doing so substantively rather than cosmetically distinguishes the better transitions.
The Audience Broadening
CSF 1.1 was explicitly written for critical infrastructure and adopted broadly beyond that audience through informal generalisation. CSF 2.0 makes the broad audience official — the framework is now positioned for use by organisations of any size, sector, and maturity. The practical consequence is more accessible implementation guidance, more sector-specific profiles published alongside the core framework, and resources targeted at smaller organisations that previously had to translate critical infrastructure guidance to their context. Organisations that delayed CSF adoption because the framework felt scoped to larger entities have less reason to delay now.
A pattern in CSF transition work: the organisation maps its existing 1.1 implementation to the 2.0 categories and subcategories, scores itself on maturity, and identifies gaps. The mapping exercise produces structural alignment. The transitions that produce material improvement go further and use the Govern function as an opportunity to address the governance gaps that 1.1 made it easier to defer — formal risk management strategy, executive oversight cadence, supply chain risk programme, role accountability. The transitions that stop at the mapping produce a renumbered programme; the transitions that use Govern substantively produce a better programme.
Profiles and Tiers Refreshed
CSF profiles — the target-state articulation of cybersecurity outcomes for a particular organisation, sector, or scenario — received substantial attention in 2.0 with templates, sector-specific examples, and clearer guidance on how to construct and use them. Implementation tiers (partial, risk-informed, repeatable, adaptive) describe the organisation's cybersecurity risk governance and management practices. Both are mechanisms that 1.1 supported and that 2.0 makes more accessible. Organisations that operated on the framework core without using profiles or tiers can use the transition as an opportunity to adopt these mechanisms — they sharpen target-state articulation and progress measurement substantially.
The Integration With Other NIST Resources
CSF 2.0 was designed for tighter integration with NIST's other cybersecurity resources — SP 800-53, SP 800-171, the Privacy Framework, the AI Risk Management Framework, and the broader NIST cybersecurity catalogue. Informative references in the framework now point more systematically to specific guidance in these other resources. Organisations that operate multiple NIST resources benefit from the tighter integration; the framework increasingly functions as the connective tissue across NIST cybersecurity guidance rather than as a standalone document.
A Transition Programme That Adds Value
- Map the existing 1.1 implementation to 2.0 categories and subcategories
- Treat the Govern function as a genuine opportunity to address governance gaps, not just relabel existing content
- Elevate cybersecurity supply chain risk management to match its new prominence
- Develop or refresh a target-state profile that articulates desired outcomes for the organisation
- Use implementation tiers to characterise current governance and management maturity
- Leverage the tighter integration with SP 800-53, 800-171, Privacy Framework, and AI RMF as applicable
- Refresh executive communications about cybersecurity strategy in 2.0 terms — particularly Govern
- Build the transition into the broader programme improvement cycle rather than as a standalone project
Why the Voluntary Framework Continues to Justify the Effort
CSF remains voluntary, and the question of whether to transition from 1.1 to 2.0 is technically a choice. In practice, the framework's adoption across sectors, regulatory references, and procurement expectations means that operating on the prior version is steadily losing relevance. The transition effort is bounded — particularly for organisations with mature 1.1 implementations — and the resulting programme captures governance and supply chain content more rigorously than 1.1 made easy. Transitioning thoughtfully now is better than transitioning under regulatory or procurement pressure later.