Cybersecurity Governance for Leaders: NIST CSF 2.0 and SEC Rules

Cybersecurity used to be treated as a technical specialty that reported up through IT. Today it is a governance matter: boards ask about it, regulators expect structured oversight, and in public companies some of it must be disclosed to investors.

Two documents shape much of the conversation in the United States. The first is version 2.0 of the NIST Cybersecurity Framework (CSF), which added a Govern function. The second is the set of cybersecurity disclosure rules the Securities and Exchange Commission (SEC) adopted for public companies in 2023.

This guide explains both in plain language and shows how a technology leader can use the framework to build governance that would also support disclosure. It is general information, not legal advice. Public companies should work with their securities counsel on any disclosure decision.

What the NIST CSF 2.0 is

NIST published CSF 2.0 on February 26, 2024, as NIST CSWP 29. It describes high-level cybersecurity outcomes and is designed for organizations of all sizes and sectors. It deliberately does not prescribe how to achieve those outcomes, which is why it works as a common language between security teams, executives and boards.

The framework's core has six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST also describes Organizational Profiles, which capture a current and a target state, and four Tiers (Partial, Risk Informed, Repeatable and Adaptive) that characterize how rigorous an organization's risk governance and management practices are.

The Govern function, category by category

NIST defines Govern as: "The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored." It says governance activities are critical for incorporating cybersecurity into enterprise risk management. Govern has six categories:

1. Organizational Context (GV.OC): understanding the mission, stakeholder expectations, dependencies, and legal, regulatory and contractual requirements.
2. Risk Management Strategy (GV.RM): priorities, constraints, risk appetite and tolerance statements, and including cybersecurity in enterprise risk management.
3. Roles, Responsibilities, and Authorities (GV.RR): including that organizational leadership is responsible and accountable for cybersecurity risk, and that adequate resources are allocated.
4. Policy (GV.PO): establishing, communicating, enforcing and regularly updating cybersecurity policy.
5. Oversight (GV.OV): reviewing results and performance to adjust strategy.
6. Cybersecurity Supply Chain Risk Management (GV.SC): knowing and prioritizing suppliers, building security requirements into contracts and monitoring third-party risk over the relationship.

For a technology leader, Govern is a ready-made checklist for questions boards tend to ask: who owns this, how much risk are we willing to take, how do we know it is working, and what about our vendors?

What the SEC rules require

The SEC adopted its cybersecurity disclosure rules on July 26, 2023. They apply to companies that report under the Securities Exchange Act of 1934. There are two main parts.

Incident disclosure (Form 8-K, Item 1.05). A company must disclose a cybersecurity incident it determines to be material, describing the material aspects of the incident's nature, scope and timing, and its material impact or reasonably likely material impact. The filing is generally due four business days after the company determines the incident is material. The rule's instructions say the materiality determination must be made "without unreasonable delay after discovery of the incident." Disclosure can be delayed if the U.S. Attorney General determines it would pose a substantial risk to national security or public safety and notifies the SEC.

Annual disclosure (Regulation S-K Item 106, reported in Form 10-K Item 1C). Companies must describe their processes, if any, for assessing, identifying and managing material risks from cybersecurity threats, including whether they are integrated into overall risk management, whether outside assessors are used, and whether there are processes for third-party service provider risk. They must describe whether cybersecurity risks have materially affected or are reasonably likely to materially affect the business. They must also describe the board's oversight of cybersecurity risk and management's role, including which positions or committees are responsible, their relevant expertise and how they report to the board.

A few further points from the SEC's materials:

• The SEC did not adopt a proposed requirement to disclose board members' cybersecurity expertise.
• Foreign private issuers make comparable disclosures on Forms 6-K and 20-F.
• Annual disclosures began with fiscal years ending on or after December 15, 2023. Incident disclosures began on the later of 90 days after Federal Register publication or December 18, 2023, with an extra 180 days for smaller reporting companies.
• On May 21, 2024, the director of the SEC's Division of Corporation Finance issued a statement encouraging companies that voluntarily disclose an incident not yet determined to be material, or determined to be immaterial, to use a different Form 8-K item, such as Item 8.01, rather than Item 1.05.

Using CSF Govern to support disclosure readiness

The CSF and the SEC rules are separate, and following the framework does not by itself satisfy any legal obligation. But the Govern outcomes line up well with what the annual disclosure asks companies to describe.

• Integration with enterprise risk. GV.RM-03 calls for including cybersecurity in enterprise risk management processes, which matches the disclosure question about integration with overall risk management.
• Clear roles. GV.RR outcomes help you document which positions own cybersecurity risk and how they are qualified, which is what management's-role disclosure asks about.
• Board reporting. GV.OV outcomes give the board a regular, evidence-based view of performance.
• Third parties. GV.SC outcomes support the disclosure question about overseeing risks from service providers.

Building a materiality decision process before you need it

The four-business-day clock starts at the materiality determination, not at discovery, but that determination must not be unreasonably delayed. The time to design the process is before an incident.

1. Define escalation triggers so the security team knows when to bring in legal, finance and investor relations.
2. Name the decision group and a deputy for each member.
3. Agree what information the group needs, recognizing that early facts will be incomplete.
4. Document each decision and its reasoning.
5. Rehearse with a tabletop exercise that includes the disclosure decision, not just the technical response.

For example, imagine a hypothetical manufacturer whose plant systems are disrupted on a Friday night. If the escalation path, decision group and documentation template already exist, the team can focus on facts rather than on who should be in the room.

Key takeaways

• NIST CSF 2.0 (February 26, 2024) added Govern to Identify, Protect, Detect, Respond and Recover.
• Govern covers context, risk strategy, roles, policy, oversight and supply chain risk management.
• SEC rules adopted July 26, 2023 require material incident disclosure on Form 8-K Item 1.05, generally within four business days of a materiality determination, plus annual risk management and governance disclosure.
• The CSF does not create legal compliance on its own, but Govern outcomes map closely to what the annual disclosure asks.
• Design and rehearse the materiality decision process before an incident, with counsel involved.

Sources

• National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024)
• National Institute of Standards and Technology, Cybersecurity Framework
• U.S. Securities and Exchange Commission, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, Press Release 2023-139 (July 26, 2023)
• U.S. Securities and Exchange Commission, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Final Rule, Release No. 33-11216 (2023)
• U.S. Securities and Exchange Commission, Erik Gerding, Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents (May 21, 2024)