Govern is the function CSF 2.0 added to the original five. It covers organizational context, risk management strategy, roles and responsibilities, policy, oversight, and cybersecurity supply chain risk management. In practice it asks whether leaders decided how cyber risk is handled, and whether that decision is written down and checked.
Where it sits
CSF 2.0 now has six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST describes Govern as addressing an understanding of organizational context, the cybersecurity risk management strategy and expectations, roles, policy, and oversight. The category codes are GV.OC, GV.RM, GV.RR, GV.PO, GV.OV and GV.SC.
What to have ready, category by category
Organizational Context (GV.OC): NIST defines this as the circumstances around cybersecurity decisions, including mission and stakeholder expectations. Ready item: a one page note of what the business does, who relies on it and which legal or contract duties apply.
Risk Management Strategy (GV.RM): Ready item: a short statement of which risks you accept, reduce or transfer, and who decides.
Roles, Responsibilities and Authorities (GV.RR): Ready item: a named owner for security, with a deputy, and a list of who can approve exceptions.
Policy (GV.PO): Ready item: a small set of policies that match what you really do, with review dates.
Oversight (GV.OV): NIST describes this as reviewing results of organization wide risk management activities. Ready item: a recurring review, even quarterly, with notes of what leadership saw and decided.
Cybersecurity Supply Chain Risk Management (GV.SC): Ready item: a list of suppliers that touch your data or code, and a rule for how you assess them.
What small teams get wrong
They treat Govern as paperwork written once. An auditor or customer will ask for the last review and the last exception. Keep a dated trail instead of a polished document.
They also forget that Govern outcomes feed the others. If you cannot say who may accept a risk, your Respond and Protect decisions float.
How to start
Build a Current Profile for Govern alone. It is the smallest scope that still shows leadership something real. Our profile guide shows the steps. CIS also added the Govern function in its v8.1 update, see what changed.
Safeguard's policies, gates and compliance evidence automation can record who approved what and when, which supports the oversight trail.
Quick check
Is Govern a new function in CSF 2.0?
Yes. It was added alongside Identify, Protect, Detect, Respond and Recover.
Does Govern include supplier risk?
Yes, through the cybersecurity supply chain risk management category, GV.SC.
Sources
Last reviewed: 19 October 2026.
