The National Institute of Standards and Technology (NIST) is underway with its update on the Cyber Security Framework (CSF), set to release version 2.0 in final form sometime in 2024. Prior to this, the working draft of the CSF Core published on August 08, 2024, sheds light on its final shape. This article aims to enlighten legal professionals on the upcoming changes and what implications they may carry.
Established in 2014, the NIST CSF has served as a foundational roadmap guiding private sector corporations and government entities alike in managing and reducing cybersecurity risk. Since then, it has been updated once, generating its 1.1 version. These tireless updates by the NIST remain critical amidst escalating digital threats, assiduous to ensure its framework abides by the technological innovation and the evolving cybersecurity landscape.
The most current update, CSF 2.0, is proposed to maintain familiarity with its previous versions, intending not to overhaul completely but to refine and optimize. The revisions appear to be committed to enhancing its applicability, usability, and clarity for users.
It includes several noteworthy amendments. A new function named “Govern” has been introduced. This adds to the established five functions, namely, “Identify,” “Protect,” “Detect,” “Respond,” and “Recover.” The inclusion of this new function aims to elaborate more on the strategic components and processes enhancing an organization’s cybersecurity posture.
Additionally, the NIST CSF 2.0 applies significant modifications to some categories and subcategories, such as those within the “Recover” function, to boost its resilience in the event of cybersecurity incidences.
While the final version shall emerge in 2024, the draft gives a fairly clear indication of the CSF evolution. Whether you are a seasoned cybersecurity professional or a legal expert in a corporation or law firm, the shift to NIST CSF 2.0 implores you to stay vigilant and adaptive.
For specific details on the changes underway in the NIST CSF 2.0, I urge you to peruse the full post on JD Supra. Remember, staying informed is integral to shoring up your organization’s cybersecurity defenses.