NIST CSF 2.0's Govern function: which frameworks already cover it?
The biggest change in NIST CSF 2.0 was a new sixth function, Govern. If you already follow another framework, how much of it do you have? It depends heavily on which one.
This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.
When NIST published CSF 2.0 in February 2024, the headline change was a sixth function. Govern joined Identify, Protect, Detect, Respond and Recover, and NIST drew it at the centre of the others: organisational context, risk management strategy, roles and responsibilities, policy, oversight, and cybersecurity supply chain risk management. It moved governance from a category inside Identify to the thing that steers everything else.
If you already follow another framework, how much of Govern do you have?
Govern coverage by framework
ControlMapping has six topics anchored in the Govern function. Here is how many of them each framework maps:
| Framework | Govern topics mapped | No mapping for |
|---|---|---|
| ISO 27001 | 6 of 6 | — |
| SOC 2 | 6 of 6 | — |
| PCI DSS | 6 of 6 | — |
| 800-53 | 6 of 6 | — |
| GDPR | 6 of 6 | — |
| NIS2 | 6 of 6 | — |
| HIPAA | 5 of 6 | Supply Chain Risk |
| CIS v8.1 | 2 of 6 | Governance Policy, Risk Management, Roles & Responsibilities, Compliance |
| CMMC | 2 of 6 | Governance Policy, Supply Chain Risk, Roles & Responsibilities, Vendor Risk Mgmt |
| Essential Eight | 0 of 6 | Governance Policy, Risk Management, Supply Chain Risk, Roles & Responsibilities, Compliance, Vendor Risk Mgmt |
Topics: Governance Policy, Risk Management, Supply Chain Risk, Roles & Responsibilities, Compliance, Vendor Risk Mgmt.
The frameworks that cover it
Management-system and control-catalogue frameworks cover Govern well. ISO 27001's clauses 4 to 6 and 9 are governance: context, leadership, roles, risk assessment and treatment, performance evaluation, management review. SP 800-53 has a whole programme management (PM) family. SOC 2's control-environment criteria (CC1 to CC5) come from the COSO internal-control framework, which is governance by design. PCI DSS's Requirement 12 and NIS2's management-body duties fill the same space.
The frameworks that don't
Operational baselines cover little of it. The Essential Eight is eight technical mitigation strategies and has no governance content at all; that is a design choice, not an oversight. The CIS Controls v8.1 touch governance mainly through their service-provider management and data-management processes. CMMC Level 2 inherits SP 800-171's focus on protecting CUI in systems, which leaves out most of the risk-strategy and supply-chain programme outcomes.
Supply chain: the hardest part of Govern
Govern includes ten subcategories on cybersecurity supply chain risk management, from having a programme at all to managing suppliers through the relationship lifecycle. Many frameworks touch supplier security (ISO 27001's A.5.19 to A.5.23, SOC 2's CC9.2, PCI DSS 12.8) but few treat it as a programme with risk criteria, tiers and monitoring. If your framework coverage of Govern is high, check whether it's high on supply chain specifically.
Key takeaways
- Govern is CSF 2.0's new function for context, risk strategy, roles, policy, oversight and supply chain risk.
- Management-system and catalogue frameworks (ISO 27001, SP 800-53, SOC 2, PCI DSS, NIS2) cover it well.
- Operational baselines (Essential Eight, CIS, CMMC) cover little of it, by design.
- Supply chain risk is the part of Govern where depth varies most between frameworks.
What to do
- If you run an operational baseline (CIS, Essential Eight, CMMC), add governance on top: CSF's Govern function, or ISO 27001's management system, gives you the structure.
- If you run ISO 27001 or SOC 2, use Govern to sharpen board reporting: CSF's outcomes are written in language executives understand.
- Check the supply chain and vendor risk topics, where frameworks differ most in depth.
The CSF 2.0 framework page lists every Govern subcategory with its mappings, and the gap analysis shows CSF coverage from any framework you have.
Questions
What is the Govern function in NIST CSF 2.0?
Govern (GV), added in CSF 2.0 in 2024, covers organisational context, risk management strategy, roles and responsibilities, policy, oversight and cybersecurity supply chain risk management. NIST places it at the centre of the other five functions.
Does ISO 27001 cover CSF 2.0 Govern?
Largely, yes: ISO 27001's clauses 4 to 6 and 9 (context, leadership, risk, performance evaluation) and its supplier controls map to most Govern outcomes.
Is CSF 2.0 Govern only for large organisations?
No. Small organisations need the same basics in lighter form: who is accountable, what risks are acceptable, what the policies are and how suppliers are managed.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.