Meeting the NIST CSF 2.0 Govern Function With Cyber Risk Data

Govern arrived as the sixth function when NIST published in February 2024 the Cybersecurity Framework 2.0, promoting governance out of its old position inside Identify. The function carries six categories, and it differs from the other five in a way that changes what evidence looks like.

‍

Protect, Detect, Respond and Recover describe what systems do, so their outcomes can be shown by pointing at a configuration. Govern describes what an organization decides and communicates. Four of its six categories contain outcomes that cannot be met without a quantity, and two do not.

‍

What Are the Six Categories?

‍

Organizational Context, Risk Management Strategy, Roles, Responsibilities and Authorities, Policy, Oversight, and Cybersecurity Supply Chain Risk Management, carrying the identifiers GV.OC, GV.RM, GV.RR, GV.PO, GV.OV and GV.SC.

‍

Where They Came From

‍

Version 1.1 handled governance implicitly inside Identify, under ID.GV, and supply chain risk sat there too as ID.SC. Both moved into the new function, which is why an organization migrating from the older version finds its existing governance evidence already maps across.

‍

What the Function Is For

‍

Establishing, communicating and monitoring the organization's cybersecurity risk management strategy, expectations and policy. The framework states outcomes without prescribing how to reach them, and a companion resource and overview guide supplies quick start material rather than required methods.

‍

Which Outcome Needs a Number Most?

‍

GV.RM-02, which requires that risk appetite and risk tolerance statements are established, communicated and maintained. An appetite statement that cannot be breached is a sentiment, and the distinction is testable.

‍

The Test

‍

Could somebody determine, on any given day, whether the organization currently sits inside its stated appetite or outside it. Answering requires a current exposure figure and a threshold expressed in the same unit, and a statement describing appetite as low or moderate supports no such determination.

‍

What Established and Maintained Imply

‍

Maintenance is the word that does the work. A threshold reviewed and reaffirmed against a figure that moved is maintained, while one restated unchanged for three years is archived, and an appetite statement that can be breached sets out what the difference looks like in practice.

‍

Which Other Outcomes Need Quantities?

‍

Three more categories contain outcomes that a qualitative program cannot evidence, for different reasons.

‍

Risk Management Objectives Under GV.RM-01

‍

Objectives have to be established and agreed to by organizational stakeholders. Agreement requires something specific enough to disagree with, and stakeholders asked to approve a direction rather than a target are being asked to approve nothing.

‍

Dependencies Under GV.OC-05

‍

The outcomes, capabilities and services the organization depends on must be understood and communicated. Understanding a dependency without knowing what its loss would cost is partial, and the cost is what makes one dependency more consequential than another.

‍

Oversight Under GV.OV

‍

Reviewing and adjusting the strategy based on results requires results in a comparable unit before and after. A program without quantification can demonstrate activity and cannot demonstrate adjustment, which makes this the category most often documented and least often met.

‍

Which Outcomes Stay Qualitative?

‍

Two categories, and saying so protects the credibility of the argument about the other four.

‍

Roles and Authorities Under GV.RR

‍

Who is accountable at each level, from the board through to individual contributors, is a structural question answered by naming people and documenting delegations. No figure improves it.

‍

Policy Under GV.PO

‍

Whether policy is established, communicated and enforced is evidenced by the policy, its distribution record and its enforcement record. Quantification has nothing to add, and claiming otherwise invites a reader to discount the rest.

‍

Which Leaves a Clean Split

‍

Four categories where a quantity is load-bearing and two where it is irrelevant. An organization approaching Govern with a numbers-first instinct will overreach on GV.RR and GV.PO, and one approaching it qualitatively will fail GV.RM and GV.OV without noticing.

‍

What About Supply Chain Under GV.SC?

‍

A partial case, since the category mixes process outcomes with ones that need comparability across suppliers.

‍

The Process Half

‍

Establishing a supply chain risk management program, defining requirements for suppliers and integrating those requirements into contracts are documentary outcomes. They are evidenced the same way policy is.

‍

The Comparative Half

‍

Prioritizing suppliers by criticality requires a basis for ranking, and a tiering scheme built on spend or on relationship length ranks the wrong thing. Ranking suppliers by what their failure would cost is the version that answers the outcome as written.

‍

How Does This Differ From Maturity Scoring?

‍

Tiers describe how an organization manages risk and categories describe what outcomes it achieves. The two are measured differently and frequently conflated.

‍

What a Tier Says

‍

Tiers characterize the rigor of risk governance practices, running from partial through to adaptive. A tier is a statement about process maturity rather than about any particular outcome, and expressing maturity levels in financial terms covers how that scale converts.

‍

What a Category Says

‍

A category outcome is either achieved or not, evidenced by something specific. An organization can hold a respectable tier while failing GV.RM-02, because the tier describes how deliberately it manages risk and the subcategory describes whether a particular artifact exists in usable form.

‍

What Produces the Numbers?

‍

An exposure model expressing cyber risk in currency, which is what allows a threshold, a dependency and a before-and-after comparison to share a unit.

‍

What It Supplies to Each Category

‍

A current figure against which an appetite threshold can be tested, a per-dependency cost that orders GV.OC-05, a comparable basis for supplier ranking under GV.SC, and a measurable before and after for GV.OV. Cyber risk quantification is the mechanism, and the method behind it is documented rather than assumed.

‍

Where to Start

‍

With the appetite statement, since it is the outcome most programs believe they have met and the one a test disproves fastest. The Govern function as a whole becomes easier to evidence once a single figure exists to anchor it.

‍

Four Categories Need a Unit, Two Do Not

‍

Govern joined the framework as a sixth function in February 2024, carrying six categories that differ from the rest in kind, since they describe what an organization decides rather than what a system does. Risk appetite and tolerance under GV.RM-02 is the sharpest case, because a statement nobody can be shown to have breached is a sentiment, and testing it requires a current figure and a threshold in one unit. Objectives under GV.RM-01, dependencies under GV.OC-05 and oversight under GV.OV each need a quantity for the same structural reason, while roles under GV.RR and policy under GV.PO are documentary throughout and gain nothing from one. Supply chain splits across both. Kovrr's cyber risk quantification supplies the unit the four load-bearing categories share.

‍

To see an appetite threshold tested against a current exposure figure, book a demo with our risk experts.