Editorial preview · A general decision framework, not a report of a newly disclosed incident.
01

What happened

NIST published Cybersecurity Framework 2.0 in 2024. It added Govern alongside Identify, Protect, Detect, Respond and Recover. This is an evergreen explainer, not a new-release announcement.

02

Why it matters

Govern makes the relationship between cybersecurity decisions, organisational context and oversight more explicit. It gives teams a way to discuss accountability rather than focusing only on technical activity.

03

Who is affected

Security leaders, risk owners and teams responsible for oversight and programme planning.

04

What to do next

  1. Clarify ownership. Identify who approves risk decisions and who can authorise changes.
  2. Review oversight. Ask whether leadership reporting supports concrete decisions.
  3. Choose a starting point. Discuss one governance gap, agree an owner and review progress before expanding the exercise.
05

What to monitor next

Check NIST’s implementation resources as you develop your approach. Keep governance reviews connected to organisational change.

Primary sources

Start with the original guidance and check for updates before applying this runbook.