NIST CSF 2.0, Govern function on day one.
CSF 2.0 added the Govern function in February 2024, and most teams still describe their program in 5 functions to the board. All 6 functions, 22 categories, 106 subcategories, with the Govern deep-dive, 1.1 → 2.0 transition mapper, Tier 1-4 maturity ladder, and the board-translation outputs that make Govern coherent to non-technical leadership.
- Govern function (NEW v2.0), all 6 categories with board-translated outputs
- 1.1 → 2.0 transition mapper, carry forward existing scoring
- Tier 1-4 maturity per function (Partial → Adaptive)
- 106 subcategories with NIST Implementation Examples
What is NIST CSF compliance software?
Govern isn’t an add-on, it’s the load-bearing wall. RiskWatch ships GV.OC, GV.RM, GV.RR, GV.PO, GV.OV, GV.SC as first-class categories with board-translation examples per section, maps the CSF 1.1 → 2.0 carry-forward per function, and shows where your maturity actually is vs where the board thinks it is on the four-tier ladder. Aligned to the NIST Cybersecurity Framework 2.0 , all 6 functions, 22 categories, 106 subcategories.
Govern is the new function. Most CISOs are still explaining 5 to the board.
The CSF 2.0 transition isn't a tooling problem, it's an organizational-translation problem. Govern is cross-functional by design (legal + compliance + ops + IT). The pain isn't implementing the controls; it's explaining them to leadership in ways that make sense.
Govern is new. Your CISO already explains 5 functions to the board.
CSF 2.0 placed Govern at the top of the model deliberately, risk strategy, expectations, oversight, supply-chain risk all sit there. Yet C-suite executives have limited knowledge of the framework's impact. Board-translation views per Govern category, risk strategy in business terms, oversight metrics with trend lines, supply-chain risk in dollar exposure. The CISO presentation writes itself.
CSF 1.1 maps you got. CSF 2.0 maps need work.
Transitioning from 1.1 to 2.0 means re-mapping existing practices to new outcomes, and translating progress in ways non-security stakeholders understand. Per-function transition mapper: every subcategory you've already scored carries through. Where 2.0 added new outcomes (especially in Govern), you see the deltas with no re-baselining.
Cross-functional collaboration is the hidden CSF 2.0 requirement.
Govern needs legal (regulatory). Identify needs ops (asset inventory). Detect needs the SOC. Respond needs IR. The framework assumes cross-functional input that most orgs don't have governance for. Per-function ownership matrix with role-based assignments to legal, compliance, ops, IT, security, the org chart that the CSF 2.0 implementation actually requires.
The function that finally makes the board care.
Most CSF 1.1 implementations stalled at Tier 2 because Govern wasn't structured. CSF 2.0 places Govern at the top of the model deliberately, it's where risk strategy, organizational context, oversight, and supply-chain risk live. RiskWatch ships with all 6 Govern categories pre-loaded plus the board-translation views that turn cybersecurity outcomes into business language.
When the board asks “what's our cybersecurity strategy?” you have an answer in business terms, not a control list. When the audit committee asks “how do you oversee third-party risk?” GV.SC outputs answer it. The Govern function exists to bridge cyber and the rest of the org; the platform makes that bridge usable.
See the Govern function in actionMission, stakeholders, legal/regulatory requirements, threats and opportunities.
Risk objectives, appetite, tolerance, integrated with enterprise risk.
Cybersecurity roles, authorities, accountabilities, defined and communicated.
Cybersecurity policy established, communicated, enforced.
Cybersecurity strategy outcomes reviewed by leadership; metrics translated to business terms.
Supplier inventory, prioritization, contract clauses, monitoring.
Carry forward what works. Score only the 47 net-new subcategories.
CSF 2.0 didn't throw out 1.1, it expanded it. Identify, Protect, Detect, Respond, and Recover all carry forward most of their subcategories. Govern is entirely new (31 net-new subcategories). The transition mapper visualizes which existing scoring carries through and which subcategories are net-new work, so you don't re-baseline, you only score the additions.
- Govern, 31 net-new subcategories, entirely new function in 2.0
- Identify + Protect, carry forward most existing scoring; modest expansions in IR.IM and PR.IR
- Detect + Respond + Recover, minor refinements, most 1.1 subcategories transfer 1:1
Tiers aren't maturity levels. They're integration depth.
The most common misunderstanding about CSF Tiers is that they map to CMMI maturity. They don't. Tiers describe how deeply integrated cybersecurity practices are with overall enterprise risk management. Tier 3 (Repeatable) is where most enterprises target; Tier 4 (Adaptive) is the aspiration. RiskWatch tracks tier per function, so Identify can be Tier 3 while Govern is still Tier 2 (typical state during 2.0 transition).
Per-function tier scoring matters because the Govern function's tier translates to how seriously the org takes cyber risk strategy. That's a number boards understand: Tier 2 means cyber is approved at management level; Tier 3 means it's embedded in org policy. The translation becomes a board metric, not a controls metric.
- ·Risk management informal, ad hoc
- ·Limited awareness of cyber risk at org level
- ·External info-sharing not consistent
- ·Risk management approved by management
- ·Org-wide cyber priorities defined
- ·Info-sharing happens but not formalized
- ·Risk management formal + part of org policy
- ·Updated based on changes in risk landscape
- ·Active info-sharing with peers + suppliers
- ·Cybersecurity adapts based on lessons learned
- ·Predictive indicators inform decisions
- ·Continuous improvement embedded in culture
The Govern function gave us the language to brief the board. For the first time, cybersecurity strategy made sense to people who don't do cybersecurity.
NIST CSF 2.0 Maturity Pack
Thirty-eight pages walking all 6 functions, 22 categories, 106 subcategories. Includes Implementation Examples, Tier 1-4 maturity scoring worksheets, the 1.1 → 2.0 transition delta summary, and the Govern function board-translation framework.
- All 6 functions including Govern
- Tier 1-4 maturity scoring per function
- 1.1 → 2.0 transition delta map
- Board-translation framework for GV.OV
Looking for CSF ↔ ISO 27001 ↔ SOC 2 ↔ NIST 800-53 crosswalk? Find it on the compliance frameworks hub.
Common questions, answered up front.
About NIST CSF 2.0, the new Govern function, the 1.1 → 2.0 transition, Tier maturity, and how RiskWatch covers all of them.
What is NIST CSF compliance software?
What's new in CSF 2.0?
What is the Govern function and why does it matter?
How does the CSF 1.1 → 2.0 transition work?
How do CSF Tiers (1-4) work?
Does the platform support cross-framework mapping?
Is there a free trial?
Run your first CSF 2.0 assessment this week.
Start a 30-day free trial, every function including the new Govern, all 106 subcategories, Implementation Examples, Tier maturity tracking, and the 1.1 → 2.0 transition mapper. No credit card required.
No credit card required · 30-day free trial · Cancel anytime