When NIST released version 2.0 of its Cybersecurity Framework, the headline change was the new Govern function. The less discussed consequence is what the framework implies for boards: cyber risk is a life cycle, and a board that only reviews prevention metrics is looking at part of it. This briefing focuses on the back half of that life cycle, responding to and recovering from an incident, and the questions that show whether the organisation is ready.
What NIST Actually Says
NIST’s news release of 26 February 2024 states that the CSF 2.0 core has six functions: Govern, Identify, Protect, Detect, Respond and Recover. It says the six, considered together, “provide a comprehensive view of the life cycle for managing cybersecurity risk.” The same release describes Govern as covering how organisations make and carry out informed cybersecurity strategy decisions, and calls cybersecurity “a major source of enterprise risk that senior leaders should consider” alongside factors such as finance and reputation.
NIST’s publication record for the framework (CSWP 29, 26 February 2024) describes it as a taxonomy of high-level cybersecurity outcomes usable by organisations of any size, sector or maturity. It adds that the framework does not prescribe how to achieve those outcomes. NIST’s CSF landing page, which carried a 24 February 2026 note marking two years of CSF 2.0, links to the full document.
That last point matters for boards. The framework tells you what outcomes to look for. It does not tell you what good looks like in your business. Setting that bar is a management and board judgement.
Why the Back Half Gets Less Attention
Our assessment: prevention is easier to report. Patch rates, training completion and tool coverage produce tidy numbers. Response and recovery are harder to quantify, so they tend to appear in board packs as a policy reference or an annual test result. Yet when an incident occurs, the costs that reach the income statement, such as downtime, notification, legal exposure and customer loss, are largely determined by how quickly and cleanly the organisation responds and recovers.
This is also where regulatory pressure concentrates. Reporting clocks under rules such as the SEC disclosure regime, NIS2 and DORA all depend on the organisation making fast, well-governed decisions during an incident. Our earlier board cyber risk reporting framework covers how to bring these measures into regular reporting.
Five Questions to Put to Management
1. Who decides, and by when? Name the individuals with authority to declare a major incident, engage outside counsel, notify regulators and approve a ransom decision. Ask when each last exercised that authority in a rehearsal, not just where it is written down.
2. Have we practised with the board in the room? A technical test shows that tools work. A scenario that includes directors, communications and legal shows whether decisions can be made under pressure with incomplete facts.
3. What are our recovery targets, and who agreed them? Ask for the maximum tolerable outage of the five most important business services, set by business owners and not by IT alone. Then ask for evidence of the most recent test against those targets.
4. Can we recover without trusting the compromised environment? Ask whether backups are isolated, whether restoration has been tested end to end, and whether critical identity systems have a documented rebuild path.
5. What do we learn afterwards? Ask how lessons from incidents and exercises are tracked to closure, and how often the board sees the open items. An unresolved finding that reappears in the next exercise is a governance signal.
What to Ask For in the Board Pack
Our assessment: three simple measures give a board a useful view without drowning it in detail.
- Time to decision: the time from first detection to a formal incident declaration in recent exercises.
- Recovery test coverage: the share of critical services whose recovery has been tested against the agreed target in the past twelve months.
- Remediation closure: the share of response and recovery findings closed by their due date.
Targets for each should be set by the board with management, based on your own risk appetite and regulatory obligations. We do not offer an industry benchmark, because we have not found a primary source for one.
Where This Fits
Govern, the function that NIST added, is the place where these questions belong: it is where strategy, accountability and oversight sit. Our assessment is that a board which can answer the five questions above is exercising the Govern function in practice, rather than receiving it as a diagram.
Sources Reviewed
- NIST, “NIST Releases Version 2.0 of Landmark Cybersecurity Framework” (26 February 2024)
- NIST CSRC, “The NIST Cybersecurity Framework (CSF) 2.0”, CSWP 29 publication record (26 February 2024)
- NIST Cybersecurity Framework landing page (accessed 3 November 2026)