NISTNIST CSFGovern FunctionEASYFree question
How does the Govern function relate to the other five functions in NIST CSF 2.0?
- A.It supersedes the Identify function entirely and folds its asset, governance, risk, and reporting categories into one expanded control area beyond the original scope (ID.AM, ID.GV, ID.RA)
- B.It is cross-cutting and informs how the organization implements and prioritizes the other five functions (Identify, Protect, Detect, Respond, Recover)
- C.It applies within the Detect and Respond functions exclusively, addressing their categories (DE.AE, RS.AN)
- D.It operates one layer beneath Detect, capturing anomaly telemetry (DE.AE) and forwarding alerts for follow-up analysis
Why B is correct
The Govern function is cross-cutting, providing the organizational context, risk strategy, and oversight that informs and prioritizes how all other five CSF functions are implemented across the organization.
Know someone studying for NIST CSF? Send them this one.