CSF 2.0 GV.PO-01
Cybersecurity risk management policy
Policy for managing cybersecurity risk is set from organizational context, strategy and priorities, then communicated and enforced.
- Approver, date and scope
- Who it was communicated to
NIST CSF 2.0: cybersecurity policy established, communicated and kept current
For security and risk leads who use CSF 2.0 Profiles to brief leadership, answer customer questionnaires or set expectations for suppliers.
30-day trialUnlimited free viewersNo credit card required
NIST CSF 2.0 at a glance
Checked against primary sources on 18 October 2026.
Who it applies to
Voluntary: organizations of any size, sector or maturity adopt it to manage cybersecurity risk, describe their posture to customers and partners, and express requirements to suppliers.
Who checks
No NIST assessment program; boards, internal audit, customers, partners and third-party assessors the organization engages review Profiles and the evidence behind them.
How often
No set cycle; CSF 2.0 describes repeating the Profile and gap analysis steps as often as needed, with policy reviewed as requirements, threats and technology change
Current edition
CSF 2.0 (NIST CSWP 29), 2024-02-26. Free to read.
What NIST CSF 2.0 asks you to write down
Each one needs an owner, an approval, and proof it reached the people it covers.
CSF 2.0 GV.PO-02
Policy review and update
The policy is reviewed, updated, communicated and enforced as requirements, threats, technology and organizational mission change.
- Review dates and change triggers
- Version history with communicated changes
CSF 2.0 GV.RR-02 and GV.RR-04
Roles, responsibilities and authorities
Cybersecurity roles, responsibilities and authorities are established, communicated, understood and enforced, and cybersecurity is built into human resources practices.
- Named roles and assigned duties
- Evidence people received their role duties
CSF 2.0 GV.SC-01
Supply chain risk management program
A cybersecurity supply chain risk management program, with strategy, objectives, policies and processes, is established and agreed by organizational stakeholders.
- Supplier security requirements in policy
- Stakeholder agreement and date
CSF 2.0 ID.IM-04
Incident response and other cybersecurity plans
Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained and improved.
- Plan owner and current version
- Distribution to the people who respond
CSF 2.0 PR.AT-01
Awareness and training
Personnel receive awareness and training so they can perform general tasks with cybersecurity risk in mind.
- Completion by person and date
- Content version and topics covered
Citations are to the standard or regulation; wording is ours.
What gets asked for on the day
What reviewers sample about these documents and the people they cover.
Current and Target Profiles
Assessors and customers ask for the Organizational Profile showing which CSF outcomes are achieved today, which are targeted, and the action plan for the gaps.
Policy evidence for GV.PO
They request the approved cybersecurity policy, its last review date and how updates were communicated to the people it covers.
Roles and training
Expect requests for role assignments under GV.RR and awareness and training completion records under PR.AT.
Supplier expectations
Customers working from a Target Profile may ask how supplier security requirements are written and agreed under GV.SC.
The policy and acknowledgment layer for NIST CSF 2.0.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
- Approved before it goes outUp to four steps, with any or all approvers.
- Acknowledged by nameName, email, date, time and version on every record.
- Asked again on every changeEach new version goes out again to everyone it applies to.
- The record on requestA PDF or CSV export, or Viewer access to the documents their tags allow.
Need help with the rest of NIST CSF 2.0? Find a consultant for your standard (opens in a new tab).
Bring your own rules
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
- Laws of every country and state you work in
- Standards and certifications
- Customer and contract requirements
- Your own policies and procedures
Questions
Is CSF 2.0 mandatory?
CSF 2.0 is voluntary guidance from NIST. It becomes an obligation only where a contract, customer requirement or other rule an organization is bound by calls for it.
What changed from CSF 1.1 for policy?
CSF 2.0 added the Govern function, which brings together organizational context, risk strategy, roles, policy, oversight and supply chain risk. Policy outcomes now sit in GV.PO-01 and GV.PO-02.
Is there a CSF certificate?
NIST does not operate a certification or accreditation program for the CSF. CSF 2.0 describes Current and Target Profiles as the way to document posture and communicate requirements.
How does CSF show up in customer and supplier relationships?
CSF 2.0 notes that a Current Profile can communicate capabilities to business partners or prospective customers, and a Target Profile can express requirements to suppliers. NIST's Informative References map CSF outcomes to other frameworks.
Is a revision planned?
As of October 2026 NIST's CSF page lists no revision; recent output covers quick-start guides, informative references and Community Profiles. CSF 2.0 marked two years in February 2026.
Where this shows up
Industries that hear about NIST CSF 2.0 most.
Try 
free for 30 days
- No credit card needed
- 30-day money-back guarantee
- Free migration on yearly plans