Release 1.0 

The SABSA InstituteTM 

SENC Project Team TSI 

Glen Bruce – Project Lead 

Maurice Smit – deputy Chief Architect TSI 

March 2023 
 

 

 

Trademarks 

SABSA® is a registered trademark of The SABSA Institute. Other trademarks owned by The SABSA 

Institute are labelled with a TM mark on their first occurrence in the text. 

All other brand, company, and product names are used for identification purposes only and may be 

trademarks that are the sole property of their respective owners. 

Copyright © The SABSA Institute. All rights reserved. Release 1.0, March 2023. i 
 

 

 

 

 

 

 

 

 

 

 

 

The SABSA Institute Recommendations for the NIST Cyber Security Framework version 2.0 

TABLE OF CONTENTS 

1 The SABSA Institute Recommendations for the NIST CSF Framework 2.0 ....................1 

1.1 The New Govern Function .................................................................................................. 1 

1.1.1 Modify the existing Governance Category .........................................................................................2 

1.1.2 Recommended Governance Model Categories..................................................................................2 

1.1.3 Recommended Cybersecurity Program Governance and Application Security Governance 

Categories......................................................................................................................................................3 

1.2 Recommended Measurement and Assessment Categories ................................................. 4 

1.2.1 Measurement and Metrics Category..................................................................................................5 

1.2.2 Assessment and Reporting Category..................................................................................................5 

1.3 Cybersecurity Supply Chain Risk Management (C-SCRM) Category Recommendations........ 6 

1.3.1 Specific Recommendations for Cybersecurity and Supply Chain Risk Management (C-SCRM)..........6 

2 Appendix: NIST CSF 2.0 Category and Sub-category Recommendations Summary ......8 

Copyright © The SABSA Institute. All rights reserved. Release 1.0, March 2023. ii 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1 The SABSA Institute Recommendations for the NIST CSF Framework 2.0 

The SABSA Institute (TSI) is a not-for-profit organisation that governs the integrity and future development of 

SABSA intellectual property and provides member services to the international SABSA community. TSI is 

incorporated as a Community Interest Company in the UK, subject to the governance rules for C.I.C.s, but it's 

sphere of activity is global, with more than 7,000 certified SABSA security architects in more than 50 countries. 

SABSA® is a methodology for developing business-driven, risk and opportunity-focused enterprise information 

security and information assurance architectures and for delivering security infrastructure solutions that support 

critical business initiatives. It is an open standard, comprising several frameworks, models, methods and 

processes, free for use by all, with no licensing required for end-user organisations who make use of the 

standard in developing and implementing architectures and solutions. 

The SABSA Institute (TSI) would like to take advantage of the opportunity to provide input into the next version 

of the NIST Cybersecurity Framework (CSF). Many organizations that have or are developing SABSA-based 

security architectures also use the NIST CSF. The NIST CSF has become one of the more popular security 

frameworks, embraced by many industries, regulatory bodies and even countries as the leading method for 

applying processes and controls to deal with ever-evolving cyber threats. 

The SABSA Institute (TSI) is recommending additions to the NIST CSF v2 related to three (3) specific themes 

(Themes #4, #5 and #6) outlined in the NIST CSF V2 Concept Paper. 

1.1 The New Govern Function 

Effective governance breaks down barriers across the organization and collectively manages organizational and 

business risk to drive efficient delivery of business value. The initial planning for the NIST CSF included a 

management function in addition to the other five functions (Identify, Protect, Detect, Respond and Recover). 

The management function was intended to apply across the other five functions but was dropped before the 

NIST CSF was first published. The addition of a Govern Function will rectify this important omission. An initial 

consideration is how to illustrate the Govern Function in relation to the other five. One of the more obvious 

solutions would be to place the Govern Function in the middle of the diagram to illustrate how it spans across all 

the other five functions. 

We recommend the Governance Function include the categories as illustrated in Figure 1. This figure provides a 

high-level illustration of the recommended categories for the new Govern Function. The light green shaded 

boxes illustrate new recommended categories. 

Copyright © The SABSA Institute. All rights reserved. Release 1.0, March 2023. 1 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Cybersecurity Governance must be subject to an ongoing management process to ensure the governance 

components are known, relevant and providing the intended guidance directing the organization’s 

responsibility for various aspects of the Information Security Governance Process is allocated to several 

bodies within the organization. 

The identification of the organization’s decisions on management of risk in relation to the business and 

the specification of the roles, responsibilities and processes required to carry out those risk decisions are 

defined, implemented and managed on a continual basis (GV.GM. 

2. Include the following new sub-categories under the Governance Model (GV.GM) category: 

a) The authority for cybersecurity is identified, assigned, and integrated into overall corporate 

governance (GV.GM-1). 

b) The responsibility for integration/alignment with enterprise risk management is assigned and 

implemented (GV.GM-2). 

c) The defined governance model includes continuous assurance of the effectiveness of the information 

security program as well as the design and operational effectiveness of the supporting processes and 

practices (GV.GM-3). 

d) The governance model is defined and implemented through a detailed and documented operating 

model (GV.GM-4). 

e) There are defined requirements for the levels of governance including continuous monitoring and 

oversight of operational function, evaluation of the results against business requirements, and 

directing remediation and process improvements where required (GV.GM-5). 

3. Add a new category called the Governance Operating Model (GV.OP) to include the sub-categories 

required to operate cybersecurity governance on an ongoing basis. 

The specification and implementation of required operating components for implementing, maintaining, 

and managing the governance model are implemented to provide effective oversight and management 

of cybersecurity risks (GV.OP). 

4. Add new sub-categories to the Governance Operating Model category (GV.OP) to include the subcategories that manage governance processes. 

a) A defined cybersecurity policy framework including the hierarchy of security decisions is reflected in 

the principles, policies, directives, procedures, and standards that have been defined and 

implemented to support the policy/standards lifecycle (GV.OP-1). 

b) Active enforcement of compliance to the cybersecurity policies and standards is conducted on a 

regular basis (GV.OP-2). 

c) There are traceable links from the organization's business objectives to cybersecurity decisions and 

implemented solutions (GV-OP-3). 

d) There is defined and effective communication across all levels of the organization concerning the 

effective operation and status of cybersecurity to continuously assure and elevate the organization's 

culture for effective information protection and security (GV-OP-4). 

1.1.3 Recommended Cybersecurity Program Governance and Application Security Governance 

Categories 

We recommend two additional categories for the Govern Function (GV), Cybersecurity Program Governance 

(GV.CP) and Application Security Governance (GV.AS). 

Copyright © The SABSA Institute. All rights reserved. Release 1.0, March 2023. 3 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1. Create a new Cybersecurity Program category (GV.CP) to provide direction on the establishment, 

operation, and ongoing management of all the high-level requirements for operating the organization’s 

cybersecurity program. 

The overarching collection of the cybersecurity responsibilities, decisions, strategies, architectures, 

reference documents, principles, policies, processes, and procedures have been defined, implemented, 

and operated as the cybersecurity program (GV.CP). 

2. Add new Cybersecurity Program sub-categories related to the development, operation, and management 

under the Cybersecurity Program (GV.CP) category. 

a) The accountable sponsor for the Enterprise Cybersecurity Program is identified and is provisioned 

with the appropriate authority and resources (GV.CP-1). 

b) The strategy, goals, objectives and key outcomes for the cybersecurity program are defined, 

documented and used to anchor the program (GV.CP-2). 

c) The cybersecurity program is subject to periodic plan updates and independent assurance reviews 

(GV.CP-3). 

d) An enduring cyber security requirements management capability has been used to define, measure 

and track security requirements throughout the entire life of projects (GV.CP-4). 

e) Enterprise-wide knowledge management capabilities for cybersecurity are known and available. 

(GV.CP-5). 

3. Include an Application Security Governance category (GV.AS) to include specification for governance of 

internally developed applications. 

Any applications that are developed in-house must be developed and delivered under strict control to 

minimize the introduction of vulnerabilities or potential threats to the environment. 

Applications that are developed and delivered in-house are based on defined security criteria and under 

strict development control to prevent vulnerabilities and reduce potential threats from being introduced 

into the environment (GV.AS). 

4. Add Application Governance sub-categories identifying specific criteria to be used to reduce the risk of 

threats or compromise when applications are designed, developed, and delivered. 

a) To address cybersecurity risks, a risk-based secure software development policy is used to guide the 

internal development of applications. (GV.AS-1). 

b) Threat modelling is completed and maintained for the whole life of all applications that are internally 

developed (GV.AS-2). 

c) Risk-based Secure software development standards and practices are applied, and formal testing is 

conducted for all applications that are internally developed (GV.AS-3). 

d) Software verification and validation activities are enforced to the organization’s specifications for 

applications that are internally developed. This includes adding cybersecurity testing activities to 

existing software testing activities (GV.AS-4). 

1.2 Recommended Measurement and Assessment Categories 

In support of theme #4—“CSF 2.0 will advance understanding of cybersecurity measurement and 

assessment”—the NIST CSF 2.0 would benefit from providing guidance for measurement, metrics, assessment 

and reporting through additional categories and sub-categories. Since measurement and assessment should 

span all functions, we recommend two additional categories for the new Govern function. 

Copyright © The SABSA Institute. All rights reserved. Release 1.0, March 2023. 4 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1.2.1 Measurement and Metrics Category 

It is important to understand the operation and effectiveness of the processes and controls that are used to 

deliver the various NIST CSF sub-categories. This requires the collection and analysis of measures and 

supporting metrics to derive information on the execution and effectiveness of the sub-categories. Thresholds 

can be applied to the measures and the metrics to provide relative indicators of operation. For selected 

measures and metrics, thresholds can be applied using risk levels to provide an indication of relative risk. The 

collection of measures and metrics may be further used to create key indicators (risk and/or performance) that 

provide further insight into the operation of the categories and can be summarized to indicate the relative 

success of the operation of the categories and functions. The operation and effectiveness of the sub-categories 

and categories provides insight into the relative management of risk beyond the simple presence or absence of 

controls and processes. In addition, including the metrics and requirements from a Business Impact Analysis as 

found in NIST 800-34 Rev, 1 provides context as to the business requirements and prioritization. 

1. Include a new Measurement and Metrics (GV.MM) category to specify the requirements for measuring 

and providing metrics for the operation and management of the cybersecurity program. 

The requirements for measuring and providing metrics for the operation and management of the 

cybersecurity program in relation to the organization’s business context and risk are defined and 

implemented to indicate the current effectiveness of the Cybersecurity Program (GV.MM) 

2. Define additional sub-categories to specify the requirements for measures, measurements, and metrics 

across all CSF functions. We recommend the following sub-categories under the GC-MM category: 

a) Reference to a common and consistent set of definitions and taxonomy is provided for measures, 

measurements, metrics, etc. and specified in the current version of NIST 800-55 Performance 

Measurement Guide for Information Security. Definitions are positioned in the context of 

cybersecurity (GV.MM-1). 

b) Measures are specified at each process and/or control level that supports individual sub-categories 

across the NIST CSF where available (GV.MM-2). 

c) Key reporting measures and metrics are defined for each sub-category where appropriate for the 

organization (GV.MM-3). 

d) The most appropriate measurement approach for the metrics program is determined (e.g., Risk Heat 

Map for less mature organisations up to quantitative risk measurement for higher maturity 

organisations) (GV.MM-4). 

e) Measures and metrics are defined at the process level as well as the control level for all categories 

(GV.MM-5). 

f) Methods are in place to measure the effectiveness of the operating processes and controls, not just 

the presence and depth of definition and implementation (GV.MM-6). 

1.2.2 Assessment and Reporting Category 

In many organizations, the NIST CSF is regularly used as the reference standard for assessing the relative 

maturity of a cybersecurity program, usually leveraging the CMMI maturity levels. This is an area that would 

benefit from additional guidance to provide a wider industry-related view for broader comparisons. We 

recommend using an approach to define relative maturity level criteria, using the six (levels 0-5) CMMI levels, 

similar to the approach used for the Cybersecurity Maturity Model Certification (CMMC) program. It would also 

be very beneficial to describe the differing maturity level criteria to the NIST CSF practices and processes in a 

Copyright © The SABSA Institute. All rights reserved. Release 1.0, March 2023. 5 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

similar manner as the CMMC maturity guidance. It is important to include considerations for assessing the 

effectiveness of the operation of the controls and processes to arrive at an accurate maturity level not just the 

specification and existence of the controls and processes. 

1. Create an Assessment and Reporting category (GV.AR) related to the NIST CSF assessment method, and 

reporting requirements on the design, operation and effectiveness of the cybersecurity program. 

Placement of this category under the Govern Function demonstrates the applicability of the subcategories is across all NISR CSF functions. 

The definition of requirements, specifications, operation, and management of NIST CSF assessment 

methods and reporting requirements on the design, operation, and effectiveness of the cybersecurity 

program are defined, implemented and operate on an ongoing basis to report on the effectiveness of the 

Cybersecurity Program (GV.AR). 

2. Include the following new sub-categories: 

a) A common and consistent method for assessing and assigning maturity levels to allow cross 

organization or industry comparisons is in place (GV.AR-1). 

b) A business impact analysis (BIA) identifying and prioritizing information systems and components and 

assessing criticality of assets and the risks to those business assets or systems in relation to identified 

key assets of the organization has been completed to guide the required protections (GV.AR-2). 

c) There is a defined relationship between the measures and metrics for implemented controls and 

processes, including risk thresholds that have been applied to the measures and metrics to aid 

assessing the effectiveness of the controls and processes (GV.AR-3). 

d) A method has been implemented to aggregate both assessed maturity levels and resulting risk levels 

to arrive at an overall maturity level reflecting the risk to the organization when formally assessed 

(GV.AR-4). 

e) Assigned management responsibilities to provide assurance for senior management include 

conducting periodic, independent reviews or assessments of the cybersecurity security program 

(GV.AR-5). 

1.3 Cybersecurity Supply Chain Risk Management (C-SCRM) Category Recommendations 

The increasing complexities that arise from delivering business through a mix of suppliers, service providers and 

business partners heighten cybersecurity risks. We recommend adding a few sub-categories to the existing 

Supply Chain Risk Management (ID.SC) category to address this reality. We also recommend that product 

suppliers, including product support, service providers and business partners, be classified as supply chain 

participants. It is important to consider all components of the business partners, supply chain and service 

providers, including those organizations that the partners, suppliers and providers rely on, and can impact their 

ability to deliver to your organization. 

1.3.1 Specific Recommendations for Cybersecurity and Supply Chain Risk Management (C-SCRM) 

1. Add the following sub-categories to the existing Supply Chain Risk Management category (ID.SC). 

enhancement to include C-SCRM requirements more fully in the NIST CSF: 

a) Supply chain dependencies and ongoing surveillance of these dependencies is understood and 

documented to manage potential risks (ID.SC-6). 

Copyright © The SABSA Institute. All rights reserved. Release 1.0, March 2023. 6 
 

 

 

 

 

 

 

b) Requirements are defined for important security-related vendor relationships, including vetting and 

ongoing management (ID.SC-7). 

c) Criteria are defined for assessment of business partner, service provider and supplier security 

requirements in relation to the levels required by the business, permitting extension of these business 

relationships into business partners’ operations in a trusted manner (ID.SC-8). 

d) Defined security criteria and service level agreements are in place and used to manage security 

requirements between the organization and business partners, suppliers and service providers ID-SC9). 

e) Third-party responsibilities in relation to business infrastructure are visible and managed (ID.SC-10). 

Copyright © The SABSA Institute. All rights reserved. Release 1.0, March 2023. 7