What is the NIST CSF 2.0?

The main functions of the NIST Cybersecurity Framework 2.0 are Govern, Identify, Protect, Detect, Respond and Recover. These six functions provide a structured approach to managing cybersecurity risk throughout an organisation's lifecycle.

Here's a more detailed look at each function:

• GOVERN (GV):
  The organisation's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. The GOVERN Function provides outcomes to inform what an organisation may do to achieve and prioritise the outcomes of the other five Functions in the context of its mission and stakeholder expectations. Governance activities are critical for incorporating cybersecurity into an organisation's broader enterprise risk management (ERM) strategy. GOVERN addresses an understanding of organisational context; the establishment of cybersecurity strategy and cybersecurity supply chain risk management; roles, responsibilities and authorities; policy; and the oversight of cybersecurity strategy.
• Identify (ID):
  The organisation's current cybersecurity risks are understood. Understanding the organisation's assets (e.g., data, hardware, software, systems, facilities, services, people), suppliers and related cybersecurity risks enables an organisation to prioritise its efforts consistent with its risk management strategy and the mission needs identified under GOVERN. This Function also includes the identification of improvement opportunities for the organisation's policies, plans, processes, procedures and practices that support cybersecurity risk management to inform efforts under all six Functions.
• Protect (PR):
  Safeguards to manage the organisation's cybersecurity risks are used. Once assets and risks are identified and prioritised, PROTECT supports the ability to secure those assets to prevent or lower the likelihood and impact of adverse cybersecurity events, as well as to increase the likelihood and impact of taking advantage of opportunities. Outcomes covered by this Function include identity management, authentication and access control; awareness and training; data security; platform security (i.e., securing the hardware, software and services of physical and virtual platforms); and the resilience of technology infrastructure.
• Detect (DE):
  Possible cybersecurity attacks and compromises are found and analysed. DETECT enables the timely discovery and analysis of anomalies, indicators of compromise and other potentially adverse events that may indicate that cybersecurity attacks and incidents are occurring. This Function supports successful incident response and recovery activities.
• Respond (RS):
  Actions regarding a detected cybersecurity incident are taken. RESPOND supports the ability to contain the effects of cybersecurity incidents. Outcomes within this Function cover incident management, analysis, mitigation, reporting and communication.
• Recover:
  Assets and operations affected by a cybersecurity incident are restored. RECOVER supports the timely restoration of normal operations to reduce the effects of cybersecurity incidents and enable appropriate communication during recovery efforts.