[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What's New in NIST CSF 2.0: The Top 4 Changes](/blog/key-changes-nist-csf-version-2) Publish date January 6, 2025 {x} minute read # What's New in NIST CSF 2.0: The Top 4 Changes [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) In celebration of its 10th anniversary, the National Institute of Standards and Technology (NIST) has finally updated its cybersecurity framework, now known as the NIST Cybersecurity Framework 2.0. This isn’t a minor facelift. It's a substantial revamp further improving what's already regarded as the gold standard of cyber risk management frameworks. To learn about the key changes in NIST CSF 2.0, and how they could impact your cybersecurity posture improvement efforts, read on. ## Top 4 NIST CSF 2.0 Changes The top four most notable changes in NIST 2.0 are outlines below. You can use this free[ NIST CSF risk assessment template](https://www.upguard.com/templates/nist-csf-risk-assessment) to monitor how your vendors align with the updated NIST CSF framework. ## 1. Revamped respond and recover functions Arguably, the most impactful change in NIST CSF 2.0 is its increased attention across Respond and Recover functions - functions receiving disproportionately less attention in version 1.1 of NIST CSF. The Respond function now maps to cyber incident response outcomes that are actually impactful and not just addressed at a high level. To illustrate the more targeted nature of the response function of the new framework, here’s a comparison between the category lists of version 1.1 and version 2. ## 2. Introduction of a new(ish) function: Govern The most prominent change in version two of the CSF is the addition of a Govern function, bringing the total number of core functions to six. Though an added partner to the original core, the Govern function isn’t actually entirely new. Much of its details are a consolidation of category information in version 1.1, making version 2.0 much neater and simpler to understand - an attribute that's now a defining aspect of the new and improved NIST CSF. For example. In version 1.1 of NIST CSF, outcomes for Roles and Responsibilities were spread across PR.IP and ID.BE categories. Now, they’re conveniently consolidated in the Govern function. The other benefit of integrating GRC outcomes into NIST CSF is that it allows non-technical stakeholders to understand how their governance duties intersect with cybersecurity risk management tasks, resulting in board members getting a seat in strategic cybersecurity decisions - an arrangement that's [becoming an increasingly critical requirement](https://hbr.org/2022/11/is-your-board-prepared-for-new-cybersecurity-regulations). [Learn how to create a cybersecurity report board members will actually appreciate >](https://www.upguard.com/blog/how-to-create-a-cybersecurity-board-report) > The sixth function (Govern) in NIST CSF 2.0 ensures stakeholders remain informed about cybersecurity practices and action plans. ## 3. Increased focus on supply chain risk management With plenty of supply chain attacks** occurring** since NIST CSF was initially launched in 2014, NIST has expectantly increased its focus on Cybersecurity Supply Chain Risk Management (SCR.) in its new framework. Most of these outcomes are nested in the Govern function, giving stakeholders and C-suite staff more oversight into an attack vector, costing businesses an average of[ 4.76 USD million when exploited](https://www.upguard.com/blog/cost-of-data-breach). > By 2025, 45% of organizations worldwide will have been impacted by a software supply chain attack, a three-fold increase since 2021.\ > \ > \- Source: [Gartner](https://www.gartner.com/en/newsroom/press-releases/2022-03-07-gartner-identifies-top-security-and-risk-management-trends-for-2022) ## 4. Expanded industry scope (and much clearer guidelines) Though originally designed to help critical infrastructures bolster their cyber threat resilience in response to the 2013[ Executive Order 13636](https://obamawhitehouse.archives.gov/issues/foreign-policy/cybersecurity/eo-13636), NIST CSF has been widely adopted by almost every industry for one simple reason - it just works, really, really well. NIST CSF 2.0 is NIST’s attempt to rebrand its cyber framework from one that’s critical infrastructure-centric to one that’s more industry-agnostic. This shift isn’t just reflected in the framework’s new name (the official name of the first edition was *Framework for Improving Critical Infrastructure Cybersecurity*, now it’s known as *The NIST Cybersecurity Framework (CSF) 2.0*) but also it's much clearer communication. For example, in NIST CSF Version 1.1, subcategory 1 of the Information Protection category was as follows: * **PR.IP-1:** A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality) Pretty confusing, right? Now, compare this language to how the Platform Security subcategories are written in version 2.0: * **PR.PS-01:** Configuration management practices are established and applied * **PR.PS-02:** Software is maintained, replaced, and removed commensurate with risk * **PR.PS-03:** Hardware is maintained, replaced, and removed commensurate with risk * **PR.PS-04:** Log records are generated and made available for continuous monitoring * **PR.PS-05:** Installation and execution of unauthorized software are prevented o[ PR.PS](http://pr.ps/)-06: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle. > By expanding from the more technical critical infrastructure sector, NIST CSF 2.0 is now a helpful cybersecurity guide that can be easily understood by organizations of all sizes.  Clearer communication means that cybersecurity initiatives are now much simpler to communicate with stakeholders and board members who tend not to be comfortable with technical cybersecurity jargon. > Learn how UpGuard further closes the technical deficit between cybersecurity teams and stakeholders with its cybersecurity reporting features.[\ > \ > Find out more >](https://www.upguard.com/product/reporting) This expanded scope of focus also brings about other much-needed changes. (a). We (finally) have implementation examples Previously, users had to essentially offer their best guess to decipher the technical desired outcomes in NIST CSF. Now, in version 2.0, this veil of obscurity is completely removed with the addition of implementation examples - yes,  NIST CSF 2.0 finally has tangible examples of how to achieve its desired outcomes!  For example, subcategory three of Organizational Context under the Govern function is as follows: > **GV.OC-03:** Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed There's a lot to unpack here, which increases the risk of being led down multiple needlessly convoluted implementation pathways.  But now, with the support of implementation examples,  the guesswork is completely eradicated: #### Implementation Examples: GV.OC-03 ***Ex1:**** Determine a process to track and manage legal and regulatory requirements* *regarding protection of individuals’ information (e.g., Health Insurance Portability* *and Accountability Act, California Consumer Privacy Act, General Data Protection* *Regulation)* ***Ex2:**** Determine a process to track and manage contractual requirements for* *cybersecurity management of supplier, customer, and partner information* ***Ex3:**** Align the organization’s cybersecurity strategy with legal, regulatory, and* *contractual requirements* ‍ The public draft of NIST CSF 2.0 implementation examples can be accessed[ *here*](https://www.nist.gov/system/files/documents/2024/02/21/CSF%202.0%20Implementation%20Examples.pdf)*.* By providing implementation examples in addition to a much clearer communication style, NIST CSF version 2.0 now makes the attainment of a resilient security posture a possibility for more businesses than ever before. > Implementation examples clarify the specific cybersecurity challenges being addressed, and shed a bright light on how to actually overcome them. ### (b). Updated information references and quick start guides To streamline implementation, NIST has overhauiled its information reference and quick start guides. Collectively, the quick start guide library addresses just about all dimensions of NIST CSF implementation, including how to use Community Profiles, and a guide on C-SCRM - a great resource for stakeholders and board members feeling a little apprehensive about their increased supply chain governance duties. > The revamped NIST CSF quick start guides allow security teams and stakeholders to jump straight into risk management strategy planning with minimal implementation friction. The refreshed quick start guides allows everyone, regardless of their cyber experience, to benefit from the cyber risk mitigation advantages of NIST CSF, from small businesses to enterprise risk managers and CISOs. [Access the NIST CSF quick start library here.](https://www.nist.gov/quick-start-guides) [Access the NIST CSF 2.0 reference tool here.](https://csrc.nist.gov/Projects/Cybersecurity-Framework/Filters#/csf/filters) ### (c). Addition of community profile templates NIST organizational profiles simplify the process of tailoring NIST CSF to an organization’s unique security objectives and intended outcomes - they help you bridge the gap between your current[ cybersecurity posture](https://www.upguard.com/blog/security-posture) and your target cybersecurity posture. [Access the CSF 2.0 Organizational Profile template here.](https://www.nist.gov/profiles-0) For guidance with specific implementation use cases, the Cyber Risk Institute offers a profile template (in .xls format) mapping NIST CSF 2.0 to specific standards, such as FFIEC (CAT) and NYDFS. This template even includes a plan for utilizing NIST CSF 2.0 to achieve greater resilience against today’s most dangerous cybersecurity threat - ransomware. [Learn how to defend against ransomware with this ultimate guide >](https://www.upguard.com/blog/protecting-employee-credentials-from-ransomware-compromise) ‍\ [Access the CRI Profile v2.0 template here.](https://cyberriskinstitute.org/the-profile/) eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) September 21, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)