What it asks for. The Govern function, new in CSF 2.0, asks organisations to establish, communicate and monitor their cybersecurity risk management strategy, expectations and policy. It provides the context and direction for the other five functions and connects cybersecurity to enterprise risk management.
In practice. Doing this well means understanding the organisational context and legal obligations, setting risk appetite and tolerance, assigning roles and authorities, approving policy, overseeing results and managing supply chain risk. Cybersecurity risk is reported to leadership in business terms, and strategy is reviewed and adjusted based on performance and changes in the threat landscape. Evidence includes an approved strategy, a risk register with owners, risk appetite statements, policy documents, supplier risk processes and leadership meeting records.
Common gaps. Common gaps are governance that exists on paper only, risk appetite that is never defined, and supply chain risk handled separately from the main programme. Leadership often receives technical metrics rather than risk information they can act on.