By Framework · NIST CSF

The common language for cyber risk, now with governance built in

The NIST Cybersecurity Framework is the most widely adopted way to describe a security program, and version 2.0 added a sixth function, Govern, that puts cyber risk on the board's agenda. It applies to any organization, not just critical infrastructure, and it quietly underpins how many other frameworks are written.

Start a free trial Schedule a demo

The landscape

Six functions, one shared vocabulary

CSF 2.0, published in 2024, organizes security into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern is the new one, and it sits deliberately at the center, tying cybersecurity to enterprise risk, policy, and executive accountability. Because the framework is a common language rather than a rigid checklist, it is increasingly how boards, auditors, and regulators expect a program to be described and measured.

NIST CSF 2.0 Govern Identify Protect Detect Respond Recover
6
functions in CSF 2.0, with Govern the newly added one that raises cybersecurity from an IT task to a board-level responsibility. Roughly seven in ten security leaders treat the framework as best practice.

The catch is that the CSF describes outcomes, not the specific controls that achieve them. Mapping those outcomes to the controls you actually run, and to every other framework you answer to, is where a program either comes together or drifts into a binder no one trusts.

Why it is hard

A map is not the territory

CSF 2.0 spans six functions, 22 categories, and more than a hundred outcomes, and each one is realized by controls that also answer to ISO 27001, SOC 2, PCI, and whatever regulators apply to you. The framework tells you what good looks like; it does not keep your evidence current or show you where a single control is doing three jobs at once.

Managed in spreadsheets, that becomes a maturity assessment that is out of date the week after it is finished, and a Govern function that exists on paper but never reaches the board.

How SimpleRisk fits

One control library, every obligation

SimpleRisk treats the CSF the way it is meant to be used: as the connective tissue between your risks, your controls, and every other framework, mapped once and kept alive.

  • Map once, satisfy many. Through the Secure Controls Framework, one control maps across NIST CSF, ISO 27001, SOC 2, PCI DSS, and 250-plus frameworks, so you implement once and satisfy many at the same time.
  • Make Govern real. Tie cyber risk to owners, treatments, and reporting, so the new Govern function is something the board actually sees, not a policy in a drawer.
  • Measure maturity continuously. Track where you stand against each function and category as a living picture, not a once-a-year snapshot.
  • Prove it on demand. Define tests, run audits, and produce the evidence behind every outcome you claim to have met.
Compliance in SimpleRisk → Risk Management → Secure Controls Framework →

Turn the framework into a program you can prove

Start a free trial or book a demo, and see how SimpleRisk turns the NIST CSF from a vocabulary into controls, evidence, and board-ready reporting.

Start a free trial