Comment Number Date Commenter Name

Comment Location of Change (Page 

number, Section, Header, 

Paragraph, Line #)

Critical, Substantive, or 

Administrative Comment Suggested Language, if Appropriate

1 3/17/2023 Nicole Rohloff Cite EO 14028 and the 2023 White House Cybersecurity Strategy in section and link to 

them in an addendum (see comment #2). 

Executive Summary Substantive N/A 

2 3/17/2023 Nicole Rohloff Add an addendum in 2.0 that includes links to pertinent EOs, regulations, working 

groups, etc., mentioned throughout the publication. 

N/A (add a new appendix) Substantive As it relates online informative references, suggest adding NERC CIP requirements to 

the list

3 3/17/2023 Nicole Rohloff To foster worldwide collaboration and engagement, include a list of known CSF-related 

working groups in this section (e.g., NICE, federal workgroups, private sector groups, 

etc.) with contact/membership information to encourage further information-sharing 

and collaboration. 

Page 5, Section 1.3: Increase 

international collaboration and 

engagement 

Substantive N/A 

4 3/17/2023 Nicole Rohloff Add a dedicated appendix that includes a complete list of relevant NIST companion 

guides (E.g., NIST 800-161, 8286, 8286 A-D); this will be helpful for people that aren't 

familiar with all of them. 

Page 6, Section 2.2: Relate the 

CSF clearly to other NIST 

frameworks 

Substantive N/A 

5 3/17/2023 Nicole Rohloff Recommend adding 800-161, 8286, 8286A-D to the CPRT tool. Given the addition of 

third-party/supply chain risk to 2.0, these resources will be helpful for cyber and/or risk 

professionals. 

Page 6, Section 2.3: Leverage 

Cybersecurity and Privacy 

Reference Tool for online CSF 2.0 

Core 

Substantive https://csrc.nist.gov/projects/cprt/catalog#/cprt/home

6 3/17/2023 Nicole Rohloff Add NERC CIP requirements to the list of online informative references. Page 6, Section 2.4: Use 

updatable, online Informative 

References

Substantive N/A 

7 3/17/2023 Nicole Rohloff As it relates to the new govern function, update the 2.0 draft glossary to include 

definitions of the following: issue, finding, remediation 

Page 10, Section 4: CSF 2.0 will 

emphasize the importance of 

cybersecurity governance 

Substantive N/A 

8 3/17/2023 Nicole Rohloff Cite a complete list of relevant risk management companion guides in this section (e.g., 

8286, 800-161, etc.) and link to them in a dedicated appendix; see comment #4. 

Page 11, Section 4.2: Improve 

discussion of relationship to risk management 

Substantive N/A 

9 3/17/2023 Nicole Rohloff Cite the 2023 White House Cybersecurity Strategy here as well, touches heavily on 3rd 

party/supply chain risk and applies to both public/private sectors. 

Page 11, Section 5.1:Expand 

coverage of supply chain 

Substantive N/A 

10 3/17/2023 Nicole Rohloff Collaborate with NIAC and/or cite their efforts in draft 2.0 as their efforts compliment 

aspects of NIST's. 

Executive Summary and other 

applicable sections 

Substantive For reference: https://cyberscoop.com/infrastructure-advisory-council-cyber/

11 3/17/2023 Nicole Rohloff Recommend a quality check on the following page: https://www.nist.

gov/cyberframework/newsroom/latest-updates

CSF 2.0 Home Page, bottom of 

page, latest updates 

Administrative Ensure dates have been updated (e.g., extensions accurately reflected and/or 

remove date if public comment period has passed