Govern
Last updated
Was this helpful?
Last updated
Was this helpful?
Download free policy and standard templates for the Govern Core Function, which ensures that a small business's cybersecurity risk management strategy, expectations, and overall policy are established, communicated, and monitored.
The Govern Function ensures that an organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored. It provides insights to help prioritize and achieve the outcomes of the other five Core Functions in line with the organization’s mission and stakeholder expectations. Governance activities are essential for integrating cybersecurity into the broader enterprise risk management strategy.
The Govern function encompasses understanding the organizational context, establishing the cybersecurity strategy and supply chain risk management, defining roles and responsibilities, creating policies, and overseeing cybersecurity initiatives. The Govern Function is comprised of . These Categories break down the Function into more specific outcomes and activities, providing a structured approach for organizations to manage and implement cybersecurity practices.
The following policy and standard templates help ensure that the NIST CSF Govern categories are adequately addressed, including ; , ; ; and :
Visit for help completing these templates and the for tips on how to implement these policies and standards once the templates are completed.
Description: This general Information Security Policy establishes the minimum mandatory requirements for information security within the organization. While organizations can exceed these requirements based on specific business needs and legal obligations, they must meet the baseline standards set forth in this policy.
Word Template Link:
Primary NIST CSF 2.0 Category:
Description: The Acceptable Use of Information Technology Resources Policy outlines the proper use of information and technology resources within the organization, emphasizing the importance of workforce participation and support for effective security. Inappropriate usage can lead to significant risks, including ransomware attacks, system compromises, and legal issues.
Description: The Planning Policy ensures that IT resources and information systems are established with effective security controls and control enhancements that reflect applicable federal and state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
Description: The Personnel Security Policy ensures that safeguards are implemented for personnel access to and use of information technology resources and data. This policy establishes protocols to verify the trustworthiness of personnel, mitigating risks related to insider threats and ensuring that only authorized individuals have access to sensitive information. It is crucial for protecting the organization’s information assets and maintaining overall security.
Description: The System and Services Acquisition Policy ensures that Information Technology resources and information systems are acquired with security requirements to meet the information systems mission and business objectives.
Description: The Information Security Risk Management Standard is vital for identifying, analyzing, and maintaining acceptable levels of risk to confidentiality, integrity, and availability. Regular risk assessments enable management to prioritize the most critical information assets, supporting informed decision-making. Compliance with federal and state mandates requires routine assessments to identify risks and implement necessary controls. Addressing security risks early is more cost-effective than dealing with incidents later. This standard provides a framework for evaluating the current security posture, identifying gaps, and determining appropriate actions.
The Govern Function is comprised of a set of governance-focused Categories designed to help organizations strengthen their cybersecurity posture. These Govern Categories are designed to enhance the management and oversight of cybersecurity risks at an organizational level. These Categories emphasize leadership commitment, risk management governance, and organizational alignment with cybersecurity goals, ensuring that cybersecurity is integrated into the broader business strategy. A list and description of each specific Govern Category can be found below:
Description: The circumstances — mission, stakeholder expectations, dependencies, and legal, regulatory, and contractual requirements — surrounding the organization’s cybersecurity risk management decisions are understood
NIST CSF 2.0 Identifier: GV.OC
Description: The organization’s priorities, constraints, risk tolerance and appetite statements, and assumptions are established, communicated, and used to support operational risk decisions
NIST CSF 2.0 Identifier: GV.RM
Description: Cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated
NIST CSF 2.0 Identifier: GV.RR
Description: Organizational cybersecurity policy is established, communicated, and enforced
NIST CSF 2.0 Identifier: GV.PO
Description: Results of organization-wide cybersecurity risk management activities and performance are used to inform, improve, and adjust the risk management strategy
NIST CSF 2.0 Identifier: GV.OV
Description: Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders
NIST CSF 2.0 Identifier: GV.SC
Word Template Link:
Primary NIST CSF 2.0 Category:
Word Template Link:
Primary NIST CSF 2.0 Category:
Word Template Link:
Primary NIST CSF 2.0 Category:
Document Link:
Primary NIST CSF 2.0 Category:
Word Template Link:
Primary NIST CSF 2.0 Category:
“Securing Small and Medium-Sized Business Supply Chains.” Cybersecurity & Infrastructure Security Agency, . Accessed 5 Nov. 2024.
Arctic Wolf. “NIST CSF 2.0: Understanding and Implementing the Govern Function.” Arctic Wolf, 30 May 2024, .
“Choosing a Vendor/Service Provider.” National Institute of Standards and Technology, 24 Aug. 2020, .
“Govern - CSF Tools.” CSF Tools - The Cybersecurity Framework for Humans, 1 Mar. 2024, .
National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0, .
Nihill, Caroline. “Updated NIST Cybersecurity Framework Adds Core Function, Focuses on Supply Chain Risk Management.” FedScoop, 26 Feb. 2024, .
“NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide Overview.” NIST Cybersecurity Framework 2.0, National Institute of Standards and Technology, Feb. 2024, .
Quinn, Stephen, et al. “Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight.” Computer Security Resource Center, 6 Mar. 2024, .
