In February 2024, the National Institute of Standards and Technology released Cybersecurity Framework 2.0 — the first major revision to the framework since its original publication in 2014. For organizations in the private sector, the update was widely covered. For local and county governments — some of the most significant users of the original CSF — the practical implications have gotten less attention.
That gap matters. County IT departments manage election infrastructure, public records, emergency dispatch systems, and essential services. They face the same threat landscape as enterprise organizations, with a fraction of the resources. The CSF has been a useful tool for structuring their security programs — but the 2.0 update introduces changes that require real attention, not just a checkbox acknowledgment.
what the original CSF got right — and why it needed an update
The original NIST CSF (version 1.1) organized cybersecurity activities around five functions: Identify, Protect, Detect, Respond, and Recover. This model was intuitive and widely adopted. The framework's voluntary, outcome-based approach made it accessible across organization sizes and sectors.
But a decade of use exposed real gaps. The original framework said relatively little about how cybersecurity decisions get made within an organization — who owns risk, how security integrates with broader objectives, what governance structures are needed. It also originally described itself as intended for critical infrastructure, which led many smaller organizations to underestimate its applicability to them.
CSF 2.0 addresses both of these directly.
the most significant change: the GOVERN function
The headline change in CSF 2.0 is the addition of a sixth function: Govern. This is not a renaming or reorganization — it's genuinely new capability territory that the original framework didn't cover.
The Govern function addresses the organizational context in which cybersecurity decisions are made:
- Organizational Context (GV.OC) — Understanding the organization's mission, legal obligations, and risk environment as they relate to cybersecurity.
- Risk Management Strategy (GV.RM) — Establishing explicit cybersecurity risk tolerance and integrating it into enterprise risk management.
- Roles, Responsibilities, and Authorities (GV.RR) — Defining who is accountable for cybersecurity decisions and how those roles are understood across the organization.
- Policy (GV.PO) — Cybersecurity policy that is established, communicated, and enforced.
- Oversight (GV.OV) — How the organization monitors its own cybersecurity performance and risk posture.
- Cybersecurity Supply Chain Risk Management (GV.SC) — Managing cybersecurity risk from vendors, service providers, and other third parties.
Why this matters for local government: Local government IT teams often operate without formal cybersecurity governance: no explicit risk tolerance statement, no documented accountability chain, no structured process for making risk decisions. The Govern function creates a framework for these conversations with elected officials and leadership — which is exactly where many local government security programs get stuck.
expanded scope: beyond critical infrastructure
CSF 2.0 explicitly removes the "critical infrastructure" framing of the original. The updated framework is now described as applicable to any organization, regardless of sector or size. For county governments that previously viewed the CSF as "probably meant for federal agencies and power utilities," this formalization matters.
The CSF is now an unambiguous fit for municipal water utilities, county health departments, school district IT teams, and local transit authorities — all of which manage sensitive systems and data without the resources of federal or major private-sector organizations.
what else changed
profiles got more useful
CSF 2.0 introduces Community Profiles — pre-built profile templates designed for specific sectors and use cases. NIST is developing and publishing Community Profiles for common contexts, including one specifically targeted at small and medium-sized enterprises. For local government IT teams, these provide a starting point that dramatically reduces the friction of initial framework adoption.
supply chain risk moved to center stage
Supply chain cybersecurity risk moved from a secondary consideration in CSF 1.1 to a dedicated section under the new Govern function. This reflects the operational reality that a significant portion of local government breaches originate in third-party compromise or exploitation of vendor-supplied software.
implementation tiers were clarified
The CSF's Implementation Tiers (1–4, from Partial to Adaptive) were often misread as a maturity scoring system. CSF 2.0 explicitly clarifies that tiers describe risk management practices, not security program quality. A Tier 2 organization with practices appropriate to its risk context is operating correctly.
what local government IT teams should actually do
-
Start with the Govern function gap analysis — Most local government security programs are strong on Protect and weak on Govern. Before addressing technical controls, assess whether you have documented risk tolerance, clear accountability for security decisions, and an explicit policy framework.
-
Map your third-party dependencies — The expanded supply chain risk guidance in GV.SC requires an inventory of vendors with access to your systems or data. The work is formalizing it, assessing risk levels, and putting controls around the highest-risk relationships.
-
Use the SME Community Profile as a baseline — NIST's small and medium enterprise Community Profile provides a pre-prioritized set of outcomes appropriate for resource-constrained organizations.
-
Align with SLTT resources — The Multi-State Information Sharing and Analysis Center (MS-ISAC) provides free membership to state, local, tribal, and territorial governments. CISA's SLTT programs offer free assessments, training, and resources specifically calibrated for government entities at this level.
-
Set a realistic target profile — not a perfect one — Use the framework to identify your three to five highest-priority improvements. Build a credible, time-bounded plan and communicate it to leadership as a risk management decision, not a technical project.
what hasn't changed
The core five functions — Identify, Protect, Detect, Respond, and Recover — remain intact. Organizations that have built programs around these functions don't need to start over. The addition of Govern is additive to the existing structure, not a replacement of it.
The voluntary nature of the framework also remains. CSF 2.0 is not a regulatory requirement for local governments in most contexts. Its value is as a structured, flexible tool for organizing security thinking.
Bottom line: CSF 2.0 doesn't require a program rebuild. It does require honest attention to the governance and accountability questions that most local government security programs have deferred. The Govern function provides structure for exactly those conversations — and for many county IT teams, that's the most valuable thing the update delivers.
where to start reading
The full CSF 2.0 documentation is available at nist.gov/cyberframework. The Quick Start Guides — particularly the one designed for small organizations — provide a condensed, practical entry point. NIST also maintains an online reference tool at csf.tools that makes the framework subcategory structure significantly more navigable than the PDF documentation.