Access Alert: NIST publishes Cybersecurity Framework 2.0

Access Alert: NIST publishes Cybersecurity Framework 2.0

The US National Institute of Standards and Technology (NIST) published the final version of its Cybersecurity Framework 2.0 (CSF 2.0) on 26 February 2024. The CSF 2.0 is the culmination of a yearslong undertaking that included multiple public consultations and workshops with key public stakeholders to update the agency’s original cybersecurity framework, which was first published in 2014.

In addition to reflecting changes in the cybersecurity landscape that have taken place over the last decade, the CSF 2.0 features an expanded scope beyond critical infrastructure and complements the US National Cybersecurity Strategy released in March 2023. Whereas the original CSF was built around five key functions for entities to achieve a high level of cyber resilience (identify, protect, detect, respond, and recover), the CSF 2.0 adds a sixth “govern” function. The new function emphasises the importance of developing and maintaining a clear risk management strategy with well-defined roles, responsibilities, policies, procedures, and oversight, along with highlighting the potential legal, financial, and reputational consequences of not having one in place.

The CSF 2.0 provides foundational guidance for audiences and organisations of all sizes. It also offers technological sophistication to help manage and reduce their exposure to cybersecurity risks. To accomplish this level of accessibility, the CSF 2.0 includes case studies for others to emulate along with quick-start guides for a variety of organisation types.

Organisations can also use the CSF 2.0’s searchable catalogue of informative references to map their existing practices onto the CSF itself. Lastly, the CSF 2.0 is included among other NIST guidance documents organisations can refer to and contextualise through the Cybersecurity and Privacy Reference Tool (CPRT), which can be used to communicate best practices to different teams at varying levels of technical specificity.

If you’re seeking clarity on how the NIST Cybersecurity Framework 2.0’s latest updates and expanded scope might impact your organisation’s cybersecurity policies and practices, please contact Jacob Hafey at [email protected].

Related Articles

Access Alert: Brazilian authorities ask for contributions on AI and connectivity

Access Alert: Brazilian authorities ask for contributions on AI and connectivity

On 9 April, Brazil’s National Telecommunications Authority (Anatel) released a public consultation to gather contributions and insights about the role...

11 Apr 2024 Latest AI Thought Leadership
Access Alert: Orbiting innovation – key satellite industry trends unveiled at SATELLITE 2024

Access Alert: Orbiting innovation – key satellite industry trends unveiled at SATELLITE 2024

The SATELLITE 2024 conference in Washington, DC, took place between 18-21 March 2024. The event brought together close to 15,000...

28 Mar 2024 Opinion
Access Alert: Saudi Arabia launches consultation on spectrum management

Access Alert: Saudi Arabia launches consultation on spectrum management

Continuing the efforts carried out by the Communications and Information Technology Commission (CST) to improve Saudi Arabia’s regulatory framework and...

26 Mar 2024 Opinion
Access Alert: APEC Peru 2024

Access Alert: APEC Peru 2024

From February through March 2024, delegations from the 21 Asia-Pacific Economic Cooperation (APEC) economies gathered at the Lima Convention Center...

22 Mar 2024 Opinion