4 

revoked, and audited for 

authorized devices, users, 

and processes. [p. 29] 

PR.PT-1: Audit/log 

records are determined, 

documented, implemented, 

and reviewed in 

accordance with policy. [p. 

36] 

Participants at the CSF 2.0 workshop on February 15, 2023, suggested that CISA’s CPGs 

could “complement” the CSF.7 The Chamber strongly believes that the CPGs—which seem to 

have a regulatory bent according to the National Cybersecurity Strategy—should be limited to 

complementing the CSF and avoid competing with it.

8 

Perhaps in contrast to the CPGs, Framework users consistently highlight numerous ways 

in which the CSF has been effective in helping organizations understand and manage their 

cybersecurity risks. Key desired attributes of the CSF include its flexible, simple, and voluntary 

nature—which have been beneficial for implementation by organizations of varying sizes and 

sectors.9 The Chamber does not anticipate that NIST plans to incorporate the CPGs in the CSF 

Core because stakeholders have not asked for it.

10 Still, we urge NIST to resist any new requests 

to do so. 

3.0 CSF Guidance and Profiles 

The Concept Paper indicates that CSF 2.0 will include updated and expanded guidance 

on Framework implementation. NIST notes that it intends to include notional implementation 

examples of concise, action-oriented processes and activities to help organizations achieve the 

outcomes of the CSF Subcategories and the guidance provided in the Informative References. 

• The Chamber agrees with NIST’s view that the CSF Core should remain high level and 

concise, and only a small number of notional examples should be included. 

7 https://www.nist.gov/news-events/events/2023/02/journey-nist-cybersecurity-framework-csf-20-workshop-2 

8 https://www.cisa.gov/cross-sector-cybersecurity-performance-goals 

https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf 

9 NIST, Initial Summary Analysis of Responses to the Request for Information (RFI)—Evaluating and Improving 

Cybersecurity Resources: The Cybersecurity Framework and Cybersecurity Supply Chain Risk Management, June 3, 

2022. 

https://www.nist.gov/system/files/documents/2022/06/03/NIST-Cybersecurity-RFI-Summary-Analysis-Final.pdf 

10 Ibid. 

 

6 

flexibility in an organization’s use of the CSF.12 Nonetheless, a cautionary message is still 

needed for stakeholders, including some policymakers. 

A number of stakeholders may not fully appreciate that a Profile represents the alignment 

of the Functions, the Categories, and the Subcategories with an organization’s business

requirements, risk tolerance, and resources. All these factors can vary greatly, not only among 

private organizations but within the divisions of a single firm. In other words, Framework Profiles 

do not lend themselves to one-size-fits-all cyber risk management goals, solutions, and 

outcomes. 

4. Cybersecurity Governance 

On February 22, 2023, the Chamber attended the NIST working session on cybersecurity 

governance. The two main takeaways appeared to be the following: 

• NIST representatives said that they plan to create a new Govern Function in CSF 2.0. 

However, the Chamber asked whether there is a consensus to move forward on a new 

Govern Function, owing to the fact that business opinion on this subject is unsettled. It 

seems that the operational, policy, and security pros/cons related to a Govern Function 

still need to be fully addressed. 

• Attendees at the working session on cybersecurity governance, including those who 

advocated for a Govern Function in their responses to the 2022 RFI, were uncertain about 

what content should populate a Govern Function. Some association representatives 

stressed that the Govern Function should not “get too big” or that NIST should not “add

more” to it, but there was seemingly no agreement on what content should populate a 

Govern Function. 

In the Chamber’s discussions with business groups, a number of them expressed 

disagreement that a new Govern Function should be included inside an updated CSF. On the one 

hand, some firms and associations believe that a Govern Function would complement their 

current activities and add value to the CSF. 

On the other, one company told the Chamber that adding a new Govern Function “would

completely change” the face of the CSF. “Governance is already threaded throughout the 

Framework.” More specifically, a Govern Function “can mean a lot of different things to different

audiences. It is an invitation to regulation,” the company cautioned. A sector association noted 

that it is reluctant to add a Govern Function because it “will open a can of worms—that is, 

establishing a new Function would create more problems [e.g., in the area of regulation] than it 

would correct.”

Business groups thoughtfully discussed the pros and cons of a new Govern Function, 

seemingly the one proposal of the Concept Paper that generated the most debate. A selection of 

the points raised are provided in the following table. 

12 https://www.nist.gov/cyberframework/examples-framework-profiles 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

7 

Select Pros and Cons of a New Govern Function 

Pros 

• The management of risk is foundational to all cybersecurity programs. Providing an 

expanded emphasis on risk management within a new Govern Function, which NIST 

proposes, could benefit Framework users. 

o For sizable or mature organizations, the addition of a new Govern Function could 

validate or enhance their existing cyber risk governance activities. 

• Greater emphasis should be placed on governance in laying the foundation of a strong and 

resilient cyber ecosystem. There can be a tendency among some organizations to gloss over 

the key governance activities under the Identify Function. 

• Cybersecurity governance—which generally refers to the development and implementation 

of an organization’s program(s) and activities to enable an ongoing understanding and 

management of its cybersecurity risk—must be inwardly focused and not driven by 

regulation. 

o A Govern Function should emphasize to policymakers that use of the CSF—or any 

comparable cybersecurity frameworks, standards, and industry-led best practices—

for regulatory purposes must come with strong liability protections for CSF users.13 

• Additional arguments favoring the creation of a new Govern Function are articulated in 

section 4 of the CSF 2.0 Concept Paper.

14 

Cons for a Govern Function 

• The current five-Function model of the CSF is widely embraced because of its 

straightforwardness and applicability to all types and sizes of organizations. 

• The term “governance” can be applied to all the controls of a cybersecurity program. 

Creating an explicit Govern Function focused on specific areas could diminish that broader 

meaning. As an example, the following graphic is used by some organizations to illustrate 

Governance as a core concept for the entirety of the CSF in connection with Continuous 

Improvement. 

13 The Chamber believes that policymakers should stand behind the perceived correctness of their regulations. 

Anything short of clear liability protections for private entities would call into question the assumption that the 

cybersecurity requirements are appropriately risk based, technically sound, and workable. 

14 https://www.nist.gov/system/files/documents/2023/01/19/CSF_2.0_Concept_Paper_01-18-23.pdf 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8 

• Creating a Govern Function, as articulated in the NIST Concept Paper, would add 

unnecessary complexity to the CSF and could deter further use of the Framework. This could 

be the case especially for organizations that have less mature and minimally funded 

cybersecurity programs. 

• Regardless of their size or security sophistication, many organizations base their 

cybersecurity programs on the CSF, which may include some form of reporting (e.g., on 

measurements and status updates) to business executives and boards of directors. 

Changing the foundation of the CSF by adding a sixth Function as an overlay would 

complicate such activities. 

• The elevation and expansion of governance-oriented Subcategories, which currently reside 

in the Identify Function, could result in an overemphasis on those topic areas. 

o Some of the arguments favoring a new Govern Function focus on shifting existing 

CSF provisions within the Identify Function to the Govern Function and then 

expanding them. Others argue in favor of adding relevant topics from other NIST 

publications. Such moves could unintentionally enlarge the CSF, diminishing its 

historically broad appeal. 

• Increased coverage of governance should be done within the current Function areas of 

Identify and Protect rather than establishing a new Function. 

• Governance should arguably include managing the supply chain security of business 

partners, but such thinking is not expected to be reflected in a new Govern Function, which 

lessens arguments favoring a Governance Function. Indeed, the expansion of supply chain 

security activities can—and should—be managed within the existing Functions, which is the 

more appropriate way to update the CSF. 

• There is notable concern among many businesses that an elevated Govern Function could 

make the Framework a regulatory tool in the hands of government authorities.15 Such 

concerns are legitimate. Both federal and state agencies have taken advantage of 

cybersecurity governance to help frame and issue new and prescriptive regulations. Here are 

two examples: 

15 The term “governance” is adapted from a related NIST definition.

https://csrc.nist.gov/glossary/term/govern_pf 

 

10 

5. Cybersecurity Supply Chain Risk Management (C-SCRM) 

According to the Concept Paper, NIST believes that CSF 2.0 should include additional CSCRM-specific outcomes to help organizations address these distinct cyber risks. The Chamber 

recommends NIST revise the five ID.SC outcomes or narratives, which were last written in 2018. 

For example, NIST could help users of the CSF prioritize or narrow the suppliers and third-party 

partners that need to be engaged in a C-SCRM process. 

• NIST should refrain from further integrating C-SCRM outcomes throughout the CSF 

Core across Functions. 

• NIST should avoid creating a new Function focused on outcomes related to oversight 

and management of C-SCRM. 

6. Assessment and Measurement 

NIST says that the assessment and measurement of cybersecurity risk management 

programs and strategies continue to be an important area of the CSF. The Chamber agrees with 

RFI respondents who seek additional CSF guidance to support assessing and measuring an 

organization’s use of the CSF. We appreciate NIST’s intention to explain how organizations can 

use the Implementation Tiers and how they relate to measurement. 

The Chamber urges NIST to consider including a new Tier, such as Managed, that could 

be incorporated between Tier 3 Repeatable and Tier 4 Adaptive. The movement between these 

two Tiers is quite significant in comparison with the lowest ones, which can lead some 

organizations to inflate their risk management postures when determining their standing against 

the Tiers. 

CSF 1.1 

(See pp. 8–11) 

Tier 1 Tier 2 Tier 3 Tier 4 

Partial Risk Informed Repeatable Adaptive 

CSF 2.0 

(Notional) 

Tier 1 Tier 2 Tier 3 Tier 4 Tier 5 

Partial Risk Informed Repeatable Managed Adaptive 

*** 

Thank you for the opportunity to provide NIST with comments on the Concept Paper. If 

you have any questions or need more information, please do not hesitate to contact Matthew 

Eggers . 
11 

Sincerely, 

Matthew J. Eggers 

Vice President 

Cyber, Space, and National Security Policy Division 

U.S. Chamber of Commerce