Governance and frameworks: NIST CSF 2.0 and the national controls
Lesson 3 of 6
3Governance and frameworks: NIST CSF 2.0 and the national controls
The big pictureA framework is like a pilot's pre-flight checklist: it does not fly the plane, but it makes sure nothing important is forgotten, and that every pilot works the same way. In Saudi Arabia, the national controls are not optional for government bodies and critical infrastructure; they are a requirement.
What the picture shows: The five functions circle Govern, added in version 2.0: top management sets direction and ownership, and the rest carry it out and measure.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
A company with no framework is like a house with no maintenance list: you fix the tap when it leaks, the power when it fails, and forget the water heater until it bursts. The framework says: know what is in your house first (identify), protect it (protect), install detectors (detect), know what to do when something happens (respond), and how to get back to normal (recover), all decided by the owner (govern).
NIST CSF 2.0 (February 2024): six functions, Govern (new, and wrapping the rest), Identify, Protect, Detect, Respond and Recover, with categories and outcomes, current and target profiles, implementation tiers, and a scope widened to every organisation. ISO/IEC 27001:2022 is a certifiable information security management system with the Annex A controls (93 of them). In Saudi Arabia: the National Cybersecurity Authority (NCA) and ECC-2:2024 with five main components: governance, defence, resilience, third-party and cloud computing, and industrial control systems. Risk treatment: mitigate, transfer (insurance), avoid, or accept in writing.
Before You Start
🛡️What is cybersecurity?
Risk and controls.
🚨Detection and incident response
Detection, response and recovery in detail.
The Core Idea
1NIST CSF 2.0: six functions
The best-known framework worldwide; its second edition came out in February 2024. The main change is Govern at the centre, and a scope widened to every organisation, not only critical infrastructure. Each function answers one question:
| Function | The question | Example |
|---|---|---|
| Govern | Who owns it? What risk is acceptable? | A security policy approved by top management |
| Identify | What do we have? How much does it matter? | Asset inventory and data classification |
| Protect | How do we prevent? | MFA, encryption, training |
| Detect | How do we know something happened? | SIEM and EDR |
| Respond | What do we do now? | The incident response plan |
| Recover | How do we get back to work? | Restoring backups, business continuity |
2ISO 27001 and the national ECC
ISO/IEC 27001 is an international standard for an information security management system; an organisation earns the certificate after an external audit, and large customers often ask for it. In Saudi Arabia the National Cybersecurity Authority issued the Essential Cybersecurity Controls, currently ECC-2:2024, with five main components: governance, defence, resilience, third-party and cloud computing, and industrial control systems.
3Risk management and the register
Risk management is three steps on repeat: identify the risks, assess them by likelihood and impact, and treat them in one of four ways: mitigate with a control, transfer with insurance, avoid by stopping the activity, or accept in writing, signed by someone with the authority. All of it goes into a risk register.
This is the phase-six task in miniature. Add a risk from a company you know and run.
register = [
# risk, likelihood 1-3, impact 1-3, owner, CSF function of the control
("No MFA on the VPN", 3, 3, "IT manager", "Protect"),
("Backups never test-restored", 2, 3, "Ops lead", "Recover"),
("No asset inventory", 2, 2, "CIO", "Identify"),
("Logs kept only 7 days", 2, 2, "SOC lead", "Detect"),
("Old printer on guest Wi-Fi", 1, 1, "Office admin", "Protect"),
]
def treatment(score):
return "mitigate now" if score >= 6 else "plan a fix" if score >= 3 else "accept, documented"
for risk, l, i, owner, fn in sorted(register, key=lambda r: r[1] * r[2], reverse=True):
print(f"{l * i} {risk:30} {owner:13} {fn:9} -> {treatment(l * i)}")Worked example
The task: a 20-person start-up asks you: "where do we start with security?". Answer in CSF terms, in five points.
The answer: Govern: name one person responsible for security and write a one-page policy. Identify: an inventory of devices, cloud accounts and sensitive data. Protect: MFA on email and cloud, a password manager, automatic updates. Detect: turn on suspicious sign-in alerts for email and cloud. Respond and recover: a one-page "what if" sheet and a tested backup. That covers the most common risks at little cost.
Myth vs Reality
| Myth | Reality |
|---|---|
| Governance is paperwork with nothing to do with real security. | Without governance nobody owns the decision or the budget, so known flaws stay unfixed. |
| Getting ISO certified means we are secure. | It proves a working management system, not the absence of flaws. Certified companies get breached too. |
Where you meet it at work
📋GRC analyst
Builds the risk register, prepares for audits and maps controls to frameworks.
🏛️Government body
Measures its compliance with the national controls and reports to the authority.
Test your understanding
Which function was added in NIST CSF 2.0?
Govern was added in 2.0 and wraps the other five.
Buying cyber insurance to cover breach losses is an example of:
The financial impact moves to the insurer while the risk itself stays, so transfer is paired with mitigating controls.
Which function did NIST CSF 2.0 add?
The six functions: Govern, Identify, Protect, Detect, Respond, Recover.
What does a risk register hold for each risk?
Without an owner nobody is responsible for the treatment.
A company buys cyber insurance against a risk. That treatment is:
The four treatments: avoid, mitigate, transfer, accept.
Quick review cards
Check Your Understanding
Why is Govern placed at the centre of CSF 2.0 rather than first in line?
Because it is not done once and finished; its decisions steer every other function all the time.
When is "accepting the risk" the right call?
When treating it costs more than the expected impact, and the decision is written down and signed by someone with the authority.
Why does a company need governance, not just tools?
Because governance decides who decides, what comes first and how much to spend; tools without it get bought, never tuned, and watched by nobody.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.