“GOVERN is in the center of the wheel because it informs how an organization will implement the other five Functions.”National Institute of Standards and Technology (NIST) · The NIST Cybersecurity Framework (CSF) 2.0 · 2024 · NIST CSWP 29, «The NIST Cybersecurity Framework (CSF) 2.0» (26 februarie 2024), secțiunea 1 «CSF Core», explicația figurii 2
Governance is not an extra heading but the function that decides how all the others are applied.
Until 2024 the NIST framework had five functions: identify, protect, detect, respond, recover. Version 2.0, published on 26 February 2024, added a sixth — GOVERN — and moved it to the centre of the wheel. It is not an extra heading but an admission: risk strategy, executive expectations, policy, roles and authorities, supply chain risk and oversight are not technical activities, yet they decide how well the technical ones get done. The consequence is unwelcome for teams that start with tools. If nobody has decided which objectives the organisation defends, who decides, and with what budget, then detection and response are optimised in a vacuum. The same idea underpins clause 5 of ISO/IEC 27001, leadership: top management does not support the system, it is accountable for it. An auditor hunting for governance evidence reads written management decisions with a date and an author, not monitoring screens.
The good news is that GOVERN does not require a security department. The 2024 framework speaks to any organization, not only large ones. Governance, at its core, means deliberate decisions: what is worth protecting, who is accountable, how much we spend. A bakery with five staff can have governance if the owner writes down, in one file, which customer data they keep, who can access the till, and what to do when the ordering system fails. A huge group does the same thing, just with more pages. The difference is not size, but whether the decisions exist on paper rather than only in someone's head. That opens a practical question: what does the first governance decision a small organization can make this week look like?
The first governance decision a small organization can make is simple: choose who answers for security. It does not mean hiring a specialist. It means a written name next to a responsibility. In a small clinic, the owner-doctor writes down, signed and dated, that she decides what happens when the scheduling system goes down. That is governance in its simplest form. The 2024 framework takes the idea one step further: the decision must be showable to someone else. An auditor is not convinced by a screen full of alerts. They look for the document showing who decided what, and when. Monitoring shows that something is happening. A written decision shows that someone answered for it. Without that name, the framework's other functions remain activities with no owner. And once the name exists, the next question appears: what exactly is that person allowed to decide, and where do they stop?
Why it matters At audit, governance evidence is a written management decision with a date and an author, not a technical dashboard.