NIST CSF 2.0: What Actually Changed From Version 1.1
The first major revision since 2014 adds a sixth function — Govern — and explicitly extends the framework beyond critical infrastructure to organizations of any size or sector.
September 16, 2026
v1
2 min
NIST CSF 2.0: What Actually Changed From Version 1.1
NIST Cybersecurity Framework 2.0, published in February 2024, is the first major revision since the original 2014 version. Two changes matter most: a new sixth function, Govern, sitting alongside the original five (Identify, Protect, Detect, Respond, Recover); and an explicit statement that the framework applies to organizations of any size, sector, or maturity — not just the critical-infrastructure audience the original framing targeted.
Why "Govern" matters
The original five functions describe what an organization does operationally. Govern describes how an organization decides what to do — risk-management strategy, roles and responsibilities, policy, and oversight of supply-chain risk. Its addition reflects something CSF 1.1 implicitly assumed but never made a first-class function: cybersecurity risk management is a governance activity, not purely a technical one.
Related Executive Guides
A short research note on why control reuse across frameworks remains rare in practice, even though the underlying control overlap is substantial.
Both frameworks assess similar underlying security practices, but their structures, audiences, and outputs are different enough that neither is a drop-in substitute for the other.
The CIS Controls' Implementation Group tiers exist specifically so a five-person security team isn't held to the same bar as a Fortune 500 SOC — worth understanding before dismissing the framework as too basic.
The Australian Cyber Security Centre's eight mitigation strategies, assessed across four maturity levels, are mandatory for Australian government agencies and increasingly referenced well beyond government.