The National Institute of Standards and Technology released the Cybersecurity Framework 2.0 on 26 February 2024. The document, issued as NIST CSWP 29, replaces version 1.1 as the current Framework text.
The original Framework, first issued in 2014, was written with operators of critical infrastructure in mind. Version 2.0 states that the same structure can be used by organisations of any size or sector. It remains non-binding. Adoption depends on the organisation, on contracts, or on separate legal requirements that may point to it; the Framework itself does not impose those requirements.
The most visible structural change is a sixth function, Govern, added to Identify, Protect, Detect, Respond, and Recover. Govern covers how an organisation sets and oversees its cybersecurity risk strategy, including roles, policies, and supply-chain risk. The other functions are carried forward and revised. NIST also published complementary quick-start material and a mapping of changes from version 1.1.
Readers should use the PDF and the DOI record as the primary text. Commentary that describes the Framework as a mandate, or that treats a particular control list as if it were the Framework, is secondary and should be checked against CSWP 29.