Prompt: I need a one-page synopsis of the differences between the NIST Cybersecurity
Framework 1.1 and 2.0

The NIST Cybersecurity Framework (CSF) provides a voluntary, risk-based approach to
managing cybersecurity risk. Version 1.1, released in 2018, refined the original 2014 framework.
In 2024, Version 2.0 introduced significant updates while preserving the framework’s core
structure. The primary differences between Versions 1.1 and 2.0 include expanded applicability,
the addition of a governance function, updated risk priorities, and improved implementation
guidance.
One major change is scope. Version 1.1 was initially developed to support critical infrastructure
organizations, though it was widely adopted across industries. Version 2.0 broadens its intended
audience and is explicitly designed for organizations of all sizes and sectors. This shift reflects
the understanding that cybersecurity risk affects every organization, regardless of industry.
The most significant structural update in Version 2.0 is the addition of a sixth core function:
Govern. Version 1.1 consisted of five functions—Identify, Protect, Detect, Respond, and
Recover—representing the lifecycle of cybersecurity risk management. While governance
concepts were present, they were embedded within other functions. Version 2.0 elevates
governance to a standalone function, emphasizing leadership oversight, risk management
strategy, defined roles and responsibilities, and accountability. This change reinforces
cybersecurity as an enterprise-wide business risk rather than solely an IT responsibility.
Version 2.0 also updates categories and subcategories to reflect modern threats. It places stronger
emphasis on supply chain cybersecurity risk management, highlighting third-party and vendor
risks that have become increasingly significant. These refinements improve clarity and alignment
with current cybersecurity challenges.
Additionally, Version 2.0 enhances implementation support. While Version 1.1 introduced
Organizational Profiles and Implementation Tiers, Version 2.0 provides clearer guidance and
practical examples to help organizations assess and improve their cybersecurity posture.
Overall, CSF 2.0 builds upon Version 1.1 by expanding applicability, strengthening governance,
modernizing risk focus, and improving usability. The update reflects the evolving cybersecurity
landscape and the need for stronger strategic alignment between cybersecurity and enterprise risk
management.