The National Institute for Standards and Technology (NIST) has released an updated version of its Cybersecurity Framework, expanding its reach to organizations of all sizes. The original framework, introduced nearly a decade ago, provided guidance for critical infrastructure sectors such as energy, banking, and hospitals. The new version, known as Cybersecurity Framework 2.0, adds a sixth function called “govern” to the existing five functions of identify, protect, detect, respond, and recover.
According to NIST’s draft guidelines, the updated framework emphasizes that cybersecurity is a significant enterprise risk, on par with legal and financial risks. The aim is to highlight the importance of cybersecurity considerations for senior leadership. Additionally, the new framework aims to support organizations of all sizes.
Cherilyn Pascoe, NIST’s lead developer of the framework, explained that the update reflects current usage of the Cybersecurity Framework and anticipates future usage. While initially developed for critical infrastructure industries, such as banking and energy, the framework has proven useful across various sectors, including schools, small businesses, and governments.
The updated framework offers several business benefits. Bud Broomhead, CEO at Viakoo, stated that it expands beyond basic cybersecurity functions to encompass other areas of the enterprise. This acknowledges that every organization faces cyber threats and needs a plan for managing cyber hygiene and incident response. Broomhead believes the update will help organizations reduce their threat landscape and better meet compliance, audit, and insurance requirements.
Joseph Carson, chief security scientist and advisory CISO with Delinea, praised the update as an “excellent refresh.” He commended the framework for moving beyond a focus on critical infrastructure organizations and adapting to cybersecurity threats across all sectors. Carson particularly highlighted the new “Govern” pillar, which acknowledges changes in organizations’ response to threats and supports their overall cybersecurity strategy.
NIST is currently seeking comments on the draft Cybersecurity Framework 2.0 until November 4th.