Six Functions, not five
The Core has six Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER. GOVERN was added in 2.0 and covers how the organisation's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored.
Why it is like this
Ten years of CSF assessments kept producing the same finding: the technical outcomes were achievable and the governance around them was not described anywhere in the framework. Making it a Function puts it where it cannot be skipped.
Not to be confused with
A sixth step at the start of a sequence. GOVERN informs how the other five will be implemented — NIST draws it around them rather than before them. And the five everyone memorised are now incomplete, which is the single most common out-of-date CSF fact.
In practice
Anyone citing "the five Functions of the NIST framework" is quoting version 1.1, which was superseded in February 2024.
Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §2.1. Read on .
Odd one out Check yourself
Three of these are CSF 2.0 Functions. Which one is not?
Show the answer
PREVENT
The six are GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER. PREVENT has never been one — prevention lives inside PROTECT.