Initializing secure session…Initializing secure session…The Cybersecurity Framework now begins with Govern — a recognition that most security failures are decisions nobody owned, not controls nobody installed.
When NIST released version 2.0 of its Cybersecurity Framework in early 2024, the most visible change was structural: a sixth function, Govern, placed at the centre of the familiar five — Identify, Protect, Detect, Respond and Recover. It was not a cosmetic addition. It reflected a decade of watching organisations implement controls without anyone owning the strategy, risk appetite or accountability behind them.
The new function covers the things that make the other five coherent: an understanding of the organisation's context and obligations, a defined risk-management strategy, clear roles and responsibilities, policies that are actually maintained, oversight of the program's performance and management of supply-chain risk. In short, it asks whether security is being led or merely performed.
CSF 2.0 is voluntary, but it is the reference framework behind an enormous range of regulatory expectations, insurance questionnaires and customer assessments. When the reference framework says governance comes first, every program measured against it will be asked the same question.
Version 1.0 was written for critical infrastructure. Version 2.0 is explicitly written for every organisation, of every size and sector. That matters for mid-sized companies, nonprofits, schools and municipalities who assumed the framework was built for someone else. It now provides them with a common language for describing their posture to boards, insurers and partners — and a structure for improving it.
Govern is the function that answers the question every board eventually asks: who decided this was enough?
Governance is often mistaken for paperwork — a policy binder that exists so an auditor can see it. Real governance is the set of decisions that shape every other control: how much risk the organisation will accept, who is accountable for it, how it is measured and reported, and what happens when the environment changes. Those decisions are what a CISO exists to make. In organisations without one, they are usually not made at all.
CSF 2.0 is the backbone of most of the security programs we build. The Govern function is also precisely what our vCISO service exists to provide: the owned, measured, reported leadership that turns a set of controls into a program. If your organisation has the five and not the sixth, that is where to begin.
This article is general information for business readers, not legal, regulatory, medical or professional advice. Regulations change; confirm requirements for your situation with qualified counsel or your regulator. Imagery is original AI-generated artwork created with Canva. Frameworks and standards named are trademarks of their respective owners.
Zero trust is sold as an architecture overhaul. For most mid-sized organisations it is better understood as a set of decisions about identity, access and assumptions — most of which cost less than the breach they prevent.
Read the article →
The difference between an AI program that scales and one that gets shut down after its first incident is rarely the model. It's whether anyone's name is on it.
Read the article →
Most organisations under a few hundred people do not need a full-time chief information security officer. Many of them badly need the function. Here is how to tell which you are.
Read the article →Start with a free security or AI readiness call — no obligation, and you leave with a clear next step.