NIST CSF 2.0: The 6 Core Functions – Govern, Identify, Protect, Detect, Respond, Recover

NIST CSF 2.0 defines six core functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS) and Recover (RC). The Govern function was introduced in version 2.0 (February 2024) as the sixth function and forms the strategic center of the framework. Together, the six functions encompass

22 categories and

106 subcategories covering a complete cycle for cybersecurity management.

The Govern function (GV) establishes cybersecurity governance at the executive level. It encompasses

6 categories: Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles and Responsibilities (GV.RR), Policy (GV.PO), Oversight (GV.OV) and Cybersecurity Supply Chain Risk Management (GV.SC). Govern sits at the center of the framework wheel because it informs how the organization implements all other five functions.

The key changes: CSF 2.0 adds Govern as the sixth core function, applies to all organizations (not just critical infrastructure), consolidates to

106 subcategories (from 108), explicitly integrates supply chain risk management, and improves mappings to international standards like ISO 27001. Organizations with existing CSF 1.1 implementations should conduct a gap assessment to plan their migration.

Identify covers Asset Management (ID.AM), Risk Assessment (ID.RA) and Improvement (ID.IM). Protect includes Identity Management and Access Control (PR.AA), Awareness and Training (PR.AT), Data Security (PR.DS), Platform Security (PR.PS) and Technology Infrastructure Resilience (PR.IR). Detect consists of Continuous Monitoring (DE.CM) and Adverse Event Analysis (DE.AE). Each category contains specific subcategories with measurable outcomes.

Respond (RS) includes Incident Management (RS.MA), Incident Analysis (RS.AN), Incident Response Reporting and Communication (RS.CO) and Incident Mitigation (RS.MI). Recover (RC) covers Recovery Plan Execution (RC.RP) and Incident Recovery Communication (RC.CO). Both functions activate during security incidents, with recovery insights feeding back into improving Protect and Detect capabilities.

NIST CSF 2.0 provides explicit mappings to international standards. Govern corresponds to DORA governance requirements (Art. 5‑6) and ISO 27001 leadership clauses (Ch. 5). Identify supports asset inventory requirements under NIS 2 Article 21. Detect and Respond cover DORA incident reporting obligations (Art. 17‑19). Recover addresses business continuity requirements across all three frameworks. An integrated compliance framework avoids duplicate assessments.

Implementation begins with a maturity assessment across all six functions, evaluating current state using the NIST Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive). A Current Profile is then created and compared against the Target Profile. The gap analysis prioritizes measures by risk and cost-benefit ratio. Implementation proceeds in phases, typically starting with Govern and Identify as the foundation for all other functions.