NIST CSF 2.0 Govern function: what board oversight looks like

What is the Govern function in NIST CSF 2.0?

Govern is the sixth function NIST added when it published CSF 2.0 on February 26, 2024, and it covers how leadership sets, communicates and monitors cybersecurity strategy. NIST describes it as the function under which "risk management strategy, expectations, and policy are established, communicated, and monitored."

The earlier version of the framework had five functions: Identify, Protect, Detect, Respond and Recover. Those remain, and they describe what a security program does. Govern describes who decides, how much risk the firm will accept, and how leadership knows the program is working. NIST draws the framework as a wheel and puts Govern in the middle, explaining that "GOVERN is in the center of the wheel because it informs how an organization will implement the other five Functions."

Why does the Govern function matter to a firm's leadership?

Because it gives leadership a specific, public answer to the question regulators, insurers and clients ask after an incident: who at the top owns cybersecurity? For an RIA, broker-dealer or family office, the hard questions after an exam finding or a breach are whether leadership knew the risks, made decisions about them, and can show it.

The framework says this directly. Subcategory GV.RR-01 states that "Organizational leadership is responsible and accountable for cybersecurity risk" and fosters a culture that is risk-aware, ethical and continually improving. For a managing partner or COO, that means owning the decisions: what the firm protects, how much it spends, who is accountable, and what happens when results fall short.

CSF 2.0 is voluntary. No regulator requires a professional firm to adopt it by name. Its value is as a common language: a firm that organizes its program around the six functions can map that work to whichever rules it answers to.

What are the six Govern categories?

Govern contains six categories, each with its own outcomes. In plain terms:

• Organizational Context (GV.OC): leadership understands the firm's mission, client and stakeholder expectations, dependencies, and the legal, regulatory and contractual requirements that shape cybersecurity decisions.
• Risk Management Strategy (GV.RM): priorities, constraints, risk appetite and risk tolerance are set, communicated and used in operational decisions.
• Roles, Responsibilities, and Authorities (GV.RR): cybersecurity roles are defined and assigned so there is accountability, performance review and improvement.
• Policy (GV.PO): a cybersecurity policy is established, communicated and enforced.
• Oversight (GV.OV): results of the firm's risk management activities are reviewed and used to adjust strategy.
• Cybersecurity Supply Chain Risk Management (GV.SC): risks from vendors and service providers are identified, managed and monitored.

What does Govern ask leadership to decide?

Mostly three things: how much risk the firm will accept, who owns what, and whether the money matches the plan. Under Risk Management Strategy, GV.RM-01 calls for risk objectives that are "established and agreed to by organizational stakeholders," and GV.RM-02 calls for "Risk appetite and risk tolerance statements" that are "established, communicated, and maintained." GV.RM-03 asks that cybersecurity be included in the firm's broader enterprise risk management.

Under Roles and Responsibilities, GV.RR-03 asks that "Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies," and GV.RR-04 asks that cybersecurity be included in human resources practices, such as onboarding, offboarding and background checks. For a small firm, a one-page risk tolerance statement and a short list of named owners usually covers the substance.

How does Govern line up with board reporting rules?

Closely, for firms already subject to written reporting duties. The FTC Safeguards Rule at 16 CFR 314.4 requires covered financial institutions (including advisers not registered with the SEC, tax preparers and mortgage brokers) to designate a Qualified Individual and to have that person report in writing, regularly and at least annually, to the board or equivalent governing body, or to a senior officer where there is no board. That report is a Govern activity in everything but name. We cover what the Qualified Individual's board report must include in a separate piece.

The Oversight category describes what a useful report contains. GV.OV-01 asks that strategy outcomes be "reviewed to inform and adjust strategy and direction," and GV.OV-03 asks that the firm's cybersecurity risk management performance be "evaluated and reviewed for adjustments needed." A useful report compares results to the firm's stated risk tolerance and records the decisions leadership made in response.

For SEC-registered advisers and broker-dealers, Regulation S-P requires written safeguards policies and an incident response program, and the amended rule adds oversight of service providers. That maps to Policy (GV.PO) and Supply Chain Risk Management (GV.SC). The rule does not name an owner or signatory, which is exactly the gap Govern helps a firm fill on its own terms. See who should own and sign a Reg S-P program for a closer look.

How can a small firm put Govern into practice this quarter?

Treat it as an annual cycle with a few documented decisions. A practical starting point:

• Write a one-page context statement: the client data you hold, the regulators you answer to, and the vendors you depend on most.
• Draft a short risk tolerance statement, for example how long the firm can operate without email or its CRM, and what data loss is unacceptable.
• Name an accountable owner for the security program, an incident handler, and a vendor oversight owner, with backups.
• Confirm your written security policy has been reviewed and approved within the past year.
• List your critical service providers and the evidence you hold for each, such as SOC 2 reports and contract notice terms.
• Put a written cybersecurity report on the leadership or board agenda at least once a year, and record the decisions made.

NIST's Small Business Quick-Start Guide offers a plain-language walkthrough of the same functions for firms without a dedicated security team.

How does s90 help?

s90 helps leadership at professional firms in Los Angeles and Orange County turn Govern into a routine: a documented risk tolerance, clear owners, a vendor register, and a written annual report built from the monitoring and evidence we already produce as your managed IT provider. If you would like help preparing your next leadership cybersecurity review, we are glad to talk it through.