The National Institute for Standards and Technology (NIST) has released an updated version of its Cybersecurity Framework, expanding its reach to organizations of all sizes. The original framework, introduced almost a decade ago, provided guidance for critical infrastructure sectors such as energy, banking, and hospitals. The new version, known as Cybersecurity Framework 2.0, adds a sixth function called “govern” to the existing five functions of identify, protect, detect, respond, and recover.
NIST’s draft guidelines emphasize that cybersecurity is a significant enterprise risk, on par with legal, financial, and other risks that senior leadership should consider. The updated framework aims to support organizations of all sizes and reflects current and future usage trends.
Bud Broomhead, CEO at Viakoo, highlighted the expanded scope of the NIST framework, stating that it acknowledges the need for all organizations to have a plan in place for managing cyber hygiene and incident response. This update not only helps organizations reduce their threat landscape but also positions them better for compliance, audit, and insurance requirements.
Joseph Carson, chief security scientist and advisory CISO with Delinea, praised the update as an “excellent refresh.” He commended the framework for extending its focus beyond critical infrastructure organizations and adapting to cybersecurity threats across all sectors. Carson also noted the significance of the new “Govern” pillar in supporting organizations’ overall cybersecurity strategy.
NIST is currently seeking comments on the draft Cybersecurity Framework 2.0 until November 4th.