GOVERNANCE (GV): In charge of setting up and overseeing the organization’s approach to managing risks, expectations, and policies.

• Organizational Context (GV.OC): Understanding the organization’s risk context, including mission, priorities, stakeholders, objectives, and direction.
• Risk Management Strategy (GV.RM): Establishing priorities, constraints, risk tolerance, and using them to support operational risk decisions.
• Roles and Responsibilities (GV.RR): Coordinating cybersecurity roles and responsibilities with all stakeholders for accountability, performance evaluation, and continuous improvement.
• Policies and Procedures (GV.PO): Creating and communicating organizational cybersecurity policies, processes, and procedures.

IDENTIFY (ID): Determining the current cybersecurity risk to the organization.

• Asset Management (ID.AM): Identifying and managing assets crucial for organizational objectives based on their importance and risk strategy.
• Risk Assessment (ID.RA): Understanding cybersecurity risk to organizational operations, assets, and individuals.
• Supply Chain Risk Management (ID.SC): Identifying, assessing, and managing supply chain risks in line with priorities, constraints, risk tolerances, and assumptions.
• Improvement (ID.IM): Identifying improvements to organizational cybersecurity risk management processes.

PROTECT (PR): Using protective measures to mitigate and reduce cybersecurity risks.

• Identity Management, Authentication, and Access Control (PR.AA): Limiting access to authorized users, processes, and devices based on the assessed risk of unauthorized access.
• Awareness and Training (PR.AT): Providing cybersecurity awareness and training to personnel and third parties in accordance with policies and procedures.
• Data Security (PR.DS): Managing information and records in line with the organization’s risk policy to protect confidentiality, integrity, and availability.
• Platform Security (PR.PS): Managing hardware and software of physical and virtual platforms to protect confidentiality, integrity, availability, and aligning with the organization’s risk policy.
• Technology Infrastructure Resilience (PR.IR): Managing security architectures to protect assets’ confidentiality, integrity, availability, and the organization’s resilience.

 DETECT (DE): Finding and analyzing potential cybersecurity attacks and compromises.

• Adverse Event Analysis (DE.AE): Analyzing adverse cybersecurity events to identify and characterize possible attacks, compromises, unauthorized activities, and protection gaps.
• Continuous Monitoring (DE.CM): Monitoring assets for potential adverse cybersecurity events, including indicators of attacks, compromises, and other activities with a potentially negative impact on cybersecurity.

RESPOND (RS): Taking action on a detected cybersecurity incident.

• Incident Management (RS.MA): Managing responses to detected cybersecurity incidents.
• Incident Analysis (RS.AN): Conducting investigations to ensure an effective response and support recovery activities.
• Incident Response Reporting and Communication (RS.CO): Coordinating remediation activities with internal and external parties for effective incident response and recovery.

Implementation Support and Resources

One distinguishing feature of CSF 2.0 is its commitment to providing practical assistance to organizations. Users are not left to navigate the framework alone; instead, they are equipped with implementation examples and quick-start guides tailored to their specific needs. The framework also offers a searchable catalog of references, allowing organizations to align their guidance with over 50 relevant cybersecurity documents. With availability in over a dozen languages, CSF 2.0 is set to become a global standard, thanks to volunteers translating it worldwide.