What it asks for. In CSF 1.1 this Identify category covered the policies, procedures and processes for managing cybersecurity risk and regulatory requirements, including coordinating security roles and responsibilities with internal and external stakeholders. CSF 2.0 expanded it into a separate Govern function, with roles now under GV.RR and policy under GV.PO.
In practice. An approved security policy exists, security roles are defined and coordinated with HR, legal, IT, business owners and external partners, and legal and regulatory requirements are understood and managed. Governance and risk management processes address cybersecurity. Evidence includes policy documents, a RACI or similar responsibility matrix, committee minutes and a compliance obligations register.
Common gaps. Roles are often defined within the security team but not agreed with business units or suppliers. Policies may exist without a process to review them or to check compliance.