NIST CSF 2.0, the organisational side
Jun 26th, 2024 by Jesper Kråkhede
The most important thing in NIST CSF 2.0 isn´t technical. It is the new function: Govern.
Govern is about how cybersecurity is directed and followed up in the organisation. Strategy, roles and responsibilities, policy, risk management and oversight of the supply chain. In short, it says what many of us have said for years: cybersecurity is a management responsibility.
What does that mean in practice? Management must set the direction. What is our risk appetite? Which risks do we accept, and who decides? Responsibility must be clear. Who owns cyber risk? Who reports to whom, and how often? Cybersecurity must be part of the overall risk management, not a separate island in the IT department. And the supply chain must be governed: requirements on suppliers, follow-up and plans for when they fail.
This lines up well with the NIS2 directive, which will soon require management in many organisations to approve and oversee cybersecurity measures, and can hold them personally accountable.
For many organisations, Govern will be the hardest function. Not because it is complex, but because it requires management´s time and attention, which is always in short supply.
Start small. Put cyber risk on the management team´s agenda once a quarter. Name an owner. Decide on a risk appetite.
Security that isn´t governed is just hope with a budget.