Govern (GV) — NIST CSF 2.0 Function

What the Govern Function is for

NIST CSF 2.0 defines Govern as one of the six high-level Functions that organize cybersecurity risk outcomes. Its official outcome is: “The organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.”

In practical terms, this Function helps an organization establish decision rights, risk direction, accountability, policy, oversight, and supply chain governance so cybersecurity risk is managed as an enterprise concern. It is not a phase that is completed once. The Functions operate together, and decisions in one Function influence the others.

The Function should be used as a communication and prioritization lens. Leaders can connect mission and risk decisions to technical work without turning the CSF into a prescriptive control checklist.

Categories within Govern

The Govern Function contains 6 Categories. Each Category groups related cybersecurity outcomes and links to its own Bare Metal Cyber profile.

• GV.OC — Organizational Context: The circumstances — mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements — surrounding the organization’s cybersecurity risk management decisions are understood.
• GV.RM — Risk Management Strategy: The organization’s priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions.
• GV.RR — Roles, Responsibilities, and Authorities: Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated.
• GV.PO — Policy: Organizational cybersecurity policy is established, communicated, and enforced.
• GV.OV — Oversight: Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy.
• GV.SC — Cybersecurity Supply Chain Risk Management: Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders.

How to use this Function

Start by defining the organizational scope and the people responsible for the relevant outcomes. Then compare the current state with the target state, identify gaps, and prioritize work according to mission impact, risk appetite, obligations, and available resources.

Use evidence from operations, assessments, incidents, exercises, suppliers, and business owners. A Function-level view is useful for executive communication, but implementation decisions should trace down to Categories and Subcategories.

• Define the systems, services, business units, or mission outcomes in scope.
• Identify Current Profile outcomes that are already achieved and evidence that supports the assessment.
• Define Target Profile outcomes and the conditions that would demonstrate achievement.
• Prioritize gaps by risk, dependency, feasibility, and business value.
• Monitor progress and revisit the Function when context or risk changes.

Evidence and measurement

Function-level performance should be supported by evidence from the underlying Categories and Subcategories. Avoid reducing performance to a single maturity score that hides important differences in scope, risk, or implementation quality.

Useful measures show whether outcomes are achieved, whether controls and processes remain effective, and whether decisions occur within approved risk tolerances. Evidence should be understandable to both operational teams and decision makers.

• Outcome coverage by business service, asset group, supplier, or organizational unit
• Open gaps, accepted risks, owners, due dates, and reassessment triggers
• Control health, operational performance, and incident trend information
• Independent assessment, audit, exercise, and lessons-learned results
• Decisions showing how evidence changed priorities, resources, or strategy

Using this Function in Organizational Profiles

A Current Profile describes which outcomes the organization is presently achieving and to what degree. A Target Profile describes the outcomes selected and prioritized to achieve cybersecurity risk management objectives. The difference becomes an action-oriented gap analysis.

Profile statements should remain scoped and evidence-based. Different business units, systems, suppliers, and mission services may need different Current and Target Profiles even when they use the same CSF Function.

Common misreadings

The six Functions are not a fixed sequence, a maturity ladder, or departments. They should not be assigned one-to-one to organizational teams. They describe outcomes that often require shared ownership and continuous interaction.

• Treating the Function as a one-time project phase
• Assuming every outcome has equal priority in every scope
• Reporting activity without evidence that an outcome is achieved
• Using the CSF as a substitute for risk decisions and implementation design
• Assigning the Function to one team while excluding necessary stakeholders

Source, scope, and attribution

The identifier, Function name, and official outcome are from NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0. Bare Metal Cyber’s explanations, implementation guidance, evidence suggestions, and learning connections are original educational material.

NIST maintains Implementation Examples and Informative References online because those resources can change more frequently than the Core. Review the NIST CSF Resource Center and Reference Tool before using a profile as a current implementation source.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Authoritative sources

• NIST Cybersecurity Framework (CSF) 2.0 — NIST CSWP 29
• NIST Cybersecurity Framework Resource Center
• NIST CSF 2.0 Reference Tool
• NIST CSF 2.0 Organizational Profiles