Cybersecurity investments continue to expand, but leadership teams often still lack a clear answer to a business-critical question: Are those investments reducing the risks that matter most to the organization?
NIST CSF 2.0 gives organizations a practical structure for reassessing cybersecurity risk in business terms. Rather than treating cybersecurity like a list of tools or technical activities, the framework helps leadership evaluate accountability, oversight, third-party dependencies, incident preparedness, asset visibility, reporting, and more. The result is a defensible view of where cyber risk sits, as well as where progress and improvement can create the most value.
What Is NIST CSF 2.0?
The NIST Cybersecurity Framework (CSF) is a widely used, outcome-based framework developed by the National Institute of Standards and Technology (NIST). Instead of prescribing a rigid checklist, it provides a common language and structure for managing cybersecurity risk in terms leadership can understand and act on. Its current version, CSF 2.0, was released in 2024 and is designed for organizations of every size, sector, and maturity level.
CSF use is generally voluntary, although particular contractual or regulatory obligations may require or reference it.
The Framework Core organizes cybersecurity outcomes into six functions:
- Govern (Added in CSF 2.0): Organizational context, risk management strategy, roles and responsibilities, policies, oversight, and supplier risk
- Identify: Asset visibility, risk assessment, and continuous improvement
- Protect: Identity and access controls, awareness and training, data security, platform security, and resilience
- Detect: Continuous monitoring, detection processes, and adverse event analysis
- Respond: Incident management, analysis, communication, and mitigation
- Recover: Recovery planning, restoration, communication, and improvement
|
GOVERN |
IDENTIFY |
PROTECT |
|
|
|
|
DETECT |
RESPOND |
RECOVER |
|
|
|
What Is Different About NIST CSF 2.0?
The most important shift from CSF 1.1 to CSF 2.0 is that the framework connects cybersecurity more directly to governance and decision-making.
That shift is anchored by the new Govern function, which serves as a foundational function that supports and informs the other five functions and puts accountability, oversight, policies, roles, risk strategy, and supplier risk at the center of the conversation. Governance and supply-chain risk were already addressed in CSF 1.1; CSF 2.0 elevates governance into a dedicated function. Current and target Framework Profiles help organizations compare existing and desired outcomes and prioritize gaps in light of business needs and risk tolerance.
For many organizations, this is where a NIST CSF 2.0 gap assessment* or reassessment creates the most value by asking whether cyber risk is genuinely owned, governed, measured, and communicated. It tests whether investments like these are aligned to business risk, connecting technology, governance, process, people, and third-party oversight into one practical view of cybersecurity exposure.
*A CSF assessment does not, by itself, establish compliance.
Why Existing Security Investments Do Not Always Tell the Full Story
Many organizations have implemented multi-factor authentication, endpoint protection, vulnerability management, logging, cloud security platforms, and user awareness training. Those are important investments, but they do not automatically prove that cybersecurity risk is being managed effectively, only technically addressed.
The threat landscape makes that distinction consequential. Verizon’s 2026 Data Breach Investigations Report, based on 2025 data, reports vulnerability exploitation as the initial entry point in 31% of breaches and third-party involvement in 48%. These findings reinforce the need to examine remediation authority, provider access, and critical service dependencies. The percentages describe the report’s dataset, not an individual organization’s probability of compromise.
The assumption of strong security can quietly outpace the reality of the investment, as a tool can be deployed by an organization without anyone clearly monitoring or owning it. Subpar policies can exist for years — sitting on a shared drive, unapproved, or without adequate review. An outside provider or managed service provider (MSP) might manage the day-to-day environment while the split responsibilities between the provider and management teams remain contractually unclear. Meanwhile, a dashboard can show a variety of technical activity even as leadership lacks a risk-based view of what actually requires attention.
AI adoption provides another example of why tools alone do not establish effective risk management. As organizations use AI to access information or support business actions, leadership needs to understand the risks, assign accountability, and validate that safeguards work. This includes guardrails over data access and permitted actions, runtime protection while AI systems operate, and ongoing validation as uses and integrations change.
NIST CSF 2.0 helps place these questions within the broader cybersecurity program, connecting emerging technology risks to oversight, protection, monitoring, and response.
Real-World Scenario: A Growing Organization With Outsourced IT
Consider a growing organization that relies on an MSP for day-to-day information technology (IT) support. Leadership believes cybersecurity is covered because the organization has implemented common tools, completed basic training, and received periodic updates from the MSP. During a NIST CSF 2.0 reassessment, however, the organization learns that internal ownership of cyber risk is informal and improperly documented, vendor access is not reviewed on a consistent basis, asset inventories are outdated, and incident escalation has a single point of contact.
That does not mean the organization has failed. It means growth, outsourcing, new systems, and changing threats have outpaced the way cybersecurity responsibilities are governed and communicated. This indicates there is room for growth and maturity among the current cyber practices. Companies can pursue clearer accountability, stronger third-party oversight, a prioritized roadmap to achieve the targeted future state, and better reporting for leadership.
5 Business Questions a NIST CSF 2.0 Gap Assessment Can Answer
A reassessment moves the conversation from whether tools exist to whether the organization understands the risks those tools are meant to reduce. Five questions tend to sit at the center of that conversation:
- Who owns cybersecurity risk, and how is that accountability documented?
- How much exposure comes from third parties, and are those responsibilities clearly defined?
- If an incident happened tomorrow, are we prepared to detect, respond, and recover?
- Are our investments aligned to the risks that matter most, or simply to the tools we happen to have?
- Can we clearly explain our cyber risk posture to the board, customers, insurers, and regulators?
Answering these questions pays off well beyond cybersecurity maturity in several ways, by supporting or improving:
- Board reporting by creating a clear view of cybersecurity risk and prioritizations
- Cyber insurance readiness by helping identify areas that may affect underwriting
- Customer security questionnaires by clarifying policies, practices, evidence, and remediation priorities
- Merger and acquisition (M&A) due diligence by providing a structured view of cyber risk and concerns
- Regulatory and contractual requirements by helping leadership understand where obligations may create risk exposure
The end product is an executive summary, risk-ranked findings, prioritized recommendations, and a phased roadmap designed to drive decisions rather than simply document observations.
To make the roadmap actionable, assign owners, target dates, and validation criteria to priority findings. Evidence can include recovery exercises, meeting business objectives, and tested incident arrangements with critical providers. Distinguish documentation review from control testing and technical validation when describing assessment conclusions.
Where Organizations Commonly Find Gaps
Organizations often find gaps in areas including, but not limited to, governance, third-party risk, incident preparedness, asset visibility, and reporting.
- Governance: Unclear accountability, outdated policies, limited oversight, or cyber risk discussions that do not reach the right decision-makers
- Third-Party Risk: Limited vendor review, unclear provider responsibilities, inconsistent monitoring, or unmanaged external access
- Incident Preparedness: Undocumented response plans, untested procedures, unclear escalation paths, or limited coordination with providers
- Asset Visibility: Incomplete inventories, unknown systems, unclear ownership, or limited visibility into cloud and outsourced environments
- Reporting: Metrics focus on activity rather than risk, inconsistent board communication, or limited tracking of remediation progress
Organizing gaps by risk theme helps leadership understand patterns. A single missing procedure may matter, but recurring gaps in ownership, third-party oversight, or reporting usually point to broader governance risk. This is why the Govern function was such a relevant addition to CSF 2.0.
Why an Independent Assessment Provides Greater Value
Internal technology teams and outsourced providers have valuable knowledge of the environment. However, operating an environment and independently assessing a cybersecurity program are very different tasks. An independent assessment can provide an external perspective and challenge assumptions through evidence. It also evaluates whether practices are documented, assigned, evidenced, monitored, and aligned to business risk rather than simply confirming that activities occur.
This perspective is especially valuable when cybersecurity responsibilities are spread across teams. Spreading cybersecurity responsibility across teams — including management, IT, legal, compliance, finance, operations, and third-party providers — is how a mature program is supposed to work. But the catch is that the more distributed those responsibilities become, the harder it is for any single team to see the whole picture.
That is precisely where an independent assessment earns its value, because it connects the pieces into one objective, evidence-based view that leadership can use to make decisions.
Why Cherry Bekaert
Cherry Bekaert’s Risk & Cybersecurity team helps organizations translate cybersecurity concerns into business-focused risk management actions. A NIST CSF 2.0 gap assessment can help leadership understand where cybersecurity risk is concentrated, where governance or oversight should improve, and which actions to prioritize based on business impact.
Our approach is practical, risk-based, and scalable. Rather than creating unnecessary control overhead, we help organizations identify meaningful improvements that align with their operating model, third-party dependencies, regulatory considerations, customer expectations, and available resources.
Where emerging technologies such as AI change the risk profile, our AI risk assessment and security testing services can complement the broader review of governance, third-party dependencies, and cybersecurity practices.
For organizations that have grown, outsourced IT, expanded technology platforms, received increasing customer or insurance questions, or need clearer board reporting, a NIST CSF 2.0 reassessment can provide a more actionable view of cyber risk and a stronger path toward resilience.
