YTYK You think you know

Card 5 of 15 GOVERN, the Function that was added ●●○ Working knowledge

What GOVERN actually contains

GOVERN holds the Categories you would expect a board to own: organizational context, risk management strategy, roles, responsibilities and authorities, policy, oversight, and — moved here in 2.0 — cybersecurity supply chain risk management (GV.SC).

Why it is like this

Supply chain risk had sat under IDENTIFY, where it read as an inventory problem. Moving it into GOVERN reframes it as something decided and overseen rather than catalogued, which is where the actual failures happen.

Not to be confused with

Policy documents. Oversight is its own Category: the outcomes cover reviewing results, adjusting the strategy and confirming the risk management performance is understood by the people accountable for it.

In practice

If you are mapping the CSF against NIS2 or DORA, GOVERN is where most of the management-body obligations land — and GV.SC is where the third-party chapters land.

Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §2.1, GOVERN. Read on .

Connects to

  • NIS2 — NIS2 Article 21's supply-chain measure and management-body approval map almost cleanly onto GV.SC and GV.OV
Predict Check yourself

In CSF 1.1, supply chain risk management sat under IDENTIFY. Where is it in 2.0, and what does the move signal?

  1. Under GOVERN as GV.SC — supply chain risk is a governance decision and oversight problem, not an inventory exercise.
  2. Still under IDENTIFY, renamed ID.SC.
  3. Under PROTECT, alongside access control.
  4. It was removed and delegated entirely to SP 800-161.
Show the answer

Under GOVERN as GV.SC — supply chain risk is a governance decision and oversight problem, not an inventory exercise.

GV.SC is one of the most-quoted parts of 2.0, precisely because the move changed who in the organisation is expected to own it.