Journey to the NIST 

Cybersecurity Framework 2.0: 

Workshop #2

Cherilyn Pascoe 

Senior Tech Policy Advisor & Lead, NIST CSF Program

February 15, 2023
a

To promote U.S. innovation and industrial competitiveness by advancing 

measurement science, standards, and technology in ways 

that enhance economic security and improve our quality of life

NIST's Mission
Celebrating 50 Years

3

The year 2022 marked 50 years of NIST’s 

cybersecurity research and the development of 

cybersecurity and privacy guidance.

Our work has helped better secure the state of 

technology that exists today—while providing the 

platform for the secure technology development of 

tomorrow.

Celebrating 50 years of Cybersecurity at NIST 3
CSF Attributes

The NIST Cybersecurity Framework (CSF) helps organizations reduce 

their cybersecurity risks and is widely recognized as foundational to 

securing organizations & technology.

• Common and accessible language

• Adaptable to many technologies, lifecycle phases, sectors and 

uses

• Risk-based

• Based on international standards

• Guided by many perspectives – private sector, academia, 

public sector

• Align legal/regulatory requirements and organizational and 

risk management priorities
CSF Indicators

• ~2 million total downloads

• 18,500+ attendees at workshops & webinars

• 800+ responses/comments from the public

• 14 sample CSF Profiles and dozens of 

resources, success stories 

• 9 translations (Spanish, Japanese, Portuguese, 

Arabic, Bulgarian, Polish, Indonesian, French, 

Ukrainian)

Helping organizations to better understand and improve their management of 

cybersecurity risk since 2013.
Innovative Uses of the CSF

Photo credit: @jamietomasello via Twitter

Photo credit: Cheri Pascoe 

at ChiBrrCon

Photo credit: @_davewm_ via Twitter
A Look Back at CSF History

• February 2013 | Executive Order 13636: Improving Critical 

Infrastructure Cybersecurity

• February 2014 | CSF 1.0 

• December 2014 | Cybersecurity Enhancement Act of 2014 (P.L. 

113-274)

• May 2017 | Executive Order 13800: Strengthening the 

Cybersecurity of Federal Networks and Critical Infrastructure 

(CSF required for federal agencies) 

• April 2018 | CSF. 1.1 

• April 2022 | NIST RFI on CSF Update Closed 

• Future | CSF 2.0 
CSF Update | Journey to CSF 2.0 

Ways to engage: www.nist.gov/cyberframework

• NIST has begun the process of updating the CSF. The update will address the evolving 

cybersecurity risk and standards landscape and make it easier for organizations to address 

risks. NIST is actively relying on and seeking diverse stakeholder feedback in the update 

process.
CSF 2.0 Concept Paper: Changes

1. CSF 2.0 will explicitly recognize the CSF’s broad use to clarify its potential applications

2. CSF 2.0 will remain a framework, providing context and connections to existing 

standards and resources

3. CSF 2.0 (and companion resources) will include updated and expanded guidance on 

Framework implementation

4. CSF 2.0 will emphasize the importance of cybersecurity governance 

5. CSF 2.0 will emphasize the importance of cybersecurity supply chain risk management (CSCRM)

6. CSF 2.0 will advance understanding of cybersecurity measurement and assessment 

Potential Significant Changes in CSF 2.0

NIST seeks feedback on each of the approaches described below. 

Please submit feedback by 3/3 to cyberframework@nist.gov. 

The Concept Paper will be discussed at Workshop #2 (2/15) and the in-person Working Sessions (2/22 & 2/23).
Concept Paper: Themes

1. CSF 2.0 will explicitly recognize the CSF’s broad use to clarify its 

potential applications

1.1. Change the CSF’s title and text to reflect its 

intended use by all organizations

1.2. Scope the CSF to ensure it benefits 

organizations regardless of sector, type, or 

size

1.3. Increase international collaboration and 

engagement
Update on CSF International

• Downloaded to over 185 countries.

• 9 Translations: Spanish, Japanese, Portuguese, 

Arabic, Bulgarian, Polish, Indonesian, French, 

Ukrainian.

• Adapted into national cybersecurity policies, 

strategies, and requirements. 

• Use cases identified in all regions. 
Concept Paper: Themes

2. CSF 2.0 will remain a framework, providing context and 

connections to existing standards and resources

2.1. Retain CSF’s current level of detail

2.2. Relate the CSF clearly to other NIST 

frameworks

2.3. Leverage Cybersecurity and Privacy 

Reference Tool for online CSF 2.0 Core

2.4. Use updatable, online Informative References

2.5. Use Informative References to provide more 

guidance to implement the CSF

2.6. Remain technology- and vendor-neutral, but 

reflect changes in cybersecurity practices
CSF Mappings (OLIR & CPRT)

National Online Informative References Program (OLIR): https://csrc.nist.gov/projects/olir

Cybersecurity & Privacy Reference Tool (CPRT): https://csrc.nist.gov/projects/cprt
Concept Paper: Themes

3. CSF 2.0 (and companion resources) will include updated and 

expanded guidance on Framework implementation

3.1. Add implementation examples for CSF 

Subcategories

3.2. Develop a CSF Profile template

3.3. Improve the CSF website to highlight 

implementation resources
CSF Guidance

All resources on NIST CSF website: 

www.nist.gov/cyberframework

CSF Quick Start Guide (NIST SP 1271): 

www.nist.gov/cyberframework/getting-started
Concept Paper: Themes

4. CSF 2.0 will emphasize the importance of cybersecurity 

governance 

4.1. Add a new Govern Function

4.2. Improve discussion of relationship to 

risk management
Concept Paper: Themes

5. CSF 2.0 will emphasize the importance of cybersecurity supply 

chain risk management (C-SCRM)

5.1. Expand coverage of supply chain
Concept Paper: Themes

6. CSF 2.0 will advance understanding of cybersecurity 

measurement and assessment 

6.1. Clarify how leveraging the CSF can support the 

measurement and assessment of cybersecurity 

programs

6.2. Provide examples of measurement and 

assessment using the CSF

6.3. Update the NIST Performance Measurement 

Guide for Information Security

6.4. Provide additional guidance on Framework 

Implementation Tiers
Concept Paper: Calls to Action

❑ Share International Resources

❑ Provide Mappings

❑ Share Example Profiles

❑ Submit CSF Resources

❑ Share Success Stories

❑ Share Use of the CSF in Measuring and Assessing Cybersecurity

❑ Comment on Performance Measurement Guide for Information 

Security

Ways in which the community can contribute to improvements to CSF 2.0 

and associated resources.
CSF 2.0 Next Steps 

NIST will rely on significant feedback to inform the update 

• Public workshops and events –

• Journey to CSF 2.0 Workshop #2 (virtual) today

• Journey to CSF 2.0 Working Sessions (in-person) February 22-23, 2023, at 

NCCOE in Rockville, MD

• Stay tuned for a workshop this Fall! 

• Comment on drafts –

• Comment on CSF 2.0 Concept Paper by 3/3/2023 via 

cyberframework@nist.gov

• Stay tuned for CSF 2.0 draft this summer 

• Continuing to seek and develop CSF resources, success stories, 

mappings to other frameworks and standards

Contact information: cyberframework@nist.gov | Ways to engage: www.nist.gov/cyberframework
In-Person Working Sessions

• Half day breakout sessions to discuss potential 

updates to the CSF at the NIST NCCoE in 

Rockville, MD 

• Builds on today’s virtual CSF 2.0 Workshop #2, 

the 2022 NIST Request for Information 

(RFI) and the first CSF 2.0 workshop.

Registration closes tonight: 

www.nist.gov/newsevents/events/2023/02/journey-nistcybersecurity-framework-csf-20-personworking-sessions

Attendees should be familiar with the NIST Cybersecurity Framework (with hands-on implementation 

experience). Attendance at the preceding virtual workshop today is required to participate.
STAY IN TOUCH

CONTACT US

NIST.gov @NISTcyber