C0.4 Govern first

NIST CSF 2.0, Govern function, GV.RM-02 and GV.RM-07 [23]

The component requires that governance be treated as a function with outcomes of its own, each with a current and a target state, covering at least the organization's context, its risk strategy, roles and responsibilities, policy, oversight and the governance of its supply chain; that the appetite and tolerance statements be among those outcomes; and that positive risks be characterized and decided in the same forum as threats (C0.4) [23]. Governance here produces things that can be assessed: a statement of appetite exists or does not, roles are assigned or are not, oversight is exercised on a cycle or is not, and each can be scored today and set as a target.

It comes from the cybersecurity framework's 2024 revision, which added a sixth function, Govern, and placed it first, with its own categories and outcomes identified by code. The Part II reading noted two of those outcomes in particular: the one asking for appetite and tolerance statements, in the register series' sense of the two words, and the one asking that strategic opportunities, which the framework calls positive risks, be brought into the same discussion as threats; the second is there because the authors knew from the register series that a register without an upside column is half a register. What the component changes is where governance is looked for. In the standard, leadership and commitment sit in the framework around the process; in the enterprise framework they are a component the authors refuse to call a step; here they are outcomes with states, so the maturity mechanism of L6 (C6.5) [23] applies to governance itself and a board can be shown the gap between the governance it has and the governance it has set as its target. The component also settles that opportunity is a governance matter: the forum that decides what risks to avoid decides what risks to pursue.