The National Institute for Standards and Technology (NIST) has released Cybersecurity Framework 2.0, which expands its recommendations to include organizations beyond critical infrastructure. The updated framework adds a sixth function, Govern, and addresses supply chain risks. It provides a reference tool, a searchable catalog, and references to help organizations implement the framework.
The new “Govern” function focuses on establishing, communicating, and monitoring an organization’s cybersecurity risk management strategy. This addition complements the existing pillars: “identity,” “protect,” “detect,” “respond,” and “recover.”
According to the 2024 SonicWall Annual Cyber Threat Report, the increasing depth of cyberattacks has led to a growing need for managed service providers (MSPs). Cybercriminals are increasing their attacks on critical infrastructure, with a 27% rise in ransomware activity in the second half of 2023. Despite an overall annual decline, ransomware volumes hit a record high in Asia, especially targeting the financial sector. SonicWall recorded 6.06 billion malware attacks in 2023, marking the highest global attack volume since 2019, with healthcare, retail, and government sectors being heavily targeted. Intrusion attempts also increased by 20%, with a significant rise in the finance, government, and healthcare sectors. IoT exploits also saw a 15% global increase.
The headline is all about the NIST Cybersecurity Framework. This is a significant update to guide organizations in enhancing their cybersecurity postures, and like software updates, you have work to do. IT service providers should assist organizations in integrating the “Govern” function into their cybersecurity strategies. This involves helping them to define clear cybersecurity policies, implement governance structures that ensure accountability and oversight, and establish metrics for monitoring cybersecurity effectiveness.