Security Leadership: frameworks and certification paths

01

The security leader's job, and CSF 2.0 in depth

In simple words

In course 7.8.3 you were the captain of one small boat. Now you are the harbour master. You don't steer every boat. You set the rules of the harbour, check that every boat follows them, and report to the town council when something needs money or a decision.

Before this course: Security for Teams: risk reviews and incident plans (course 7.8.3). You can already name a security owner, build an asset list, run a risk assessment into a risk register, write an incident-response plan, run a tabletop exercise, train staff on phishing and give leaders a one-page report. Now you lead a whole programme and teach others. Our example all course: "Harbour Foods", the imagined bakery from course 7.8.3, now grown to 60 staff with three shops, an online store, a small warehouse and an outside IT helper.

Key facts

NIST CSF 2.0 (NIST CSWP 29) was published on 26 February 2024. Its Core has 6 Functions, 22 Categories and 106 Subcategories (we counted them in the document):

Function	Categories	Subcategories
Govern (GV)	6	31
Identify (ID)	3	21
Protect (PR)	5	22
Detect (DE)	2	11
Respond (RS)	4	13
Recover (RC)	2	8

NIST says the CSF does not prescribe how outcomes should be achieved. It says what good looks like; you choose the how, which is why you combine it with other guidance (Lesson 3).
Govern has six Categories, the core of a leader's work:
GV.OC Organizational Context: mission, stakeholders, dependencies, and legal, regulatory and contractual duties (GV.OC-03 includes privacy obligations).
GV.RM Risk Management Strategy: priorities, constraints, risk appetite and tolerance.
GV.RR Roles, Responsibilities, and Authorities: GV.RR-01 says leadership is responsible and accountable for cybersecurity risk.
GV.PO Policy: policy is set, communicated, enforced and reviewed.
GV.OV Oversight: results are used to adjust the strategy.
GV.SC Cybersecurity Supply Chain Risk Management: managing suppliers' risk (Lesson 5).
NIST also publishes online resources:
Informative References: mappings between CSF outcomes and other standards, such as a control in NIST SP 800-53.
Implementation Examples: short, action-oriented steps. NIST says they are not a full list and not a required baseline.
Quick Start Guides: short guides, including a Small Business Quick Start Guide (NIST SP 1300), with translations in French, Japanese, Portuguese and Spanish.

Step by step

Open the CSF 2.0 page on nist.gov and download the framework document and the Small Business Quick Start Guide.
Read the six Govern Category descriptions out loud. For each one, write who owns it at Harbour Foods (or your organisation).
Read GV.OC-03 and list every legal, contract and privacy duty you know about (for example card payment rules in your contract with the payment provider, and your privacy law from the box in Lesson 6).
Write a one-paragraph "security programme charter": purpose, scope, who is accountable (a leader, per GV.RR-01) and how often you report.
Ask the leader to sign it.
Check: for each of the six Functions, you can name one thing your organisation already does.

Watch on YouTube

The NIST Cybersecurity Framework (CSF) 2.0National Institute of Standards and Technology · YouTube · youtube.com

Videos by other creators on YouTube, for reference. They are not made by or affiliated with The Future Market.

LESSON 01The security leader's job, and CSF 2.0 in depth

LESSON 01 / ANIMATED LESSON / AI VOICE00:00 / 01:00

Voice

Read the video script

[Host] "In the last course you captained one boat. Now you're the harbour master."
[Text on screen: 6 Functions, 22 Categories, 106 Subcategories] "NIST CSF 2.0 has six Functions, 22 Categories and 106 Subcategories. It says what good looks like, not exactly how."
[Screen: the six Govern categories as building blocks] "Govern is the leader's toolbox: context, risk strategy, roles, policy, oversight and suppliers."
[Text on screen: Leadership is accountable (GV.RR-01)] "And one rule sits on top: leadership is accountable for cybersecurity risk. Your job is to make that real."

Try it now

Write the programme charter for your organisation (or Harbour Foods) and a table of the six Govern Categories with an owner and one current activity each.

ClaudeStuck? Copy a ready-made prompt for Claude

Copy this, open Claude, paste it, and Claude will walk you through the lesson step by step.

For a grown-up: Claude is for adults (18+). Copy this, paste it into Claude, and use the answer to explain the lesson to your child.

I'm learning "Security Leadership: frameworks and certification paths" on The Future Market. Lesson 1: "The security leader's job, and CSF 2.0 in depth".

What the lesson teaches:
- NIST CSF 2.0 (NIST CSWP 29) was published on 26 February 2024. Its Core has 6 Functions, 22 Categories and 106 Subcategories (we counted them in the document):
- Govern (GV) - 6 - 31
- Identify (ID) - 3 - 21
- Protect (PR) - 5 - 22
- Detect (DE) - 2 - 11
- Respond (RS) - 4 - 13
- Recover (RC) - 2 - 8

The exercise I'm working on:
Write the programme charter for your organisation (or Harbour Foods) and a table of the six Govern Categories with an owner and one current activity each.

I'm stuck. Please:
1. Explain the main idea in plain, simple words with one everyday example.
2. Walk me through the exercise one small step at a time. Ask me what I've done so far before giving the next step.
3. Don't just give me the final answer. Help me do it myself, and check my work when I share it.

I'm a parent helping my child (about 8 years old) with a lesson called "The security leader's job, and CSF 2.0 in depth" from the course "Security Leadership: frameworks and certification paths".

Here's what the lesson says:
In course 7.8.3 you were the captain of one small boat. Now you are the harbour master. You don't steer every boat. You set the rules of the harbour, check that every boat follows them, and report to the town council when something needs money or a decision.

The activity:
Write the programme charter for your organisation (or Harbour Foods) and a table of the six Govern Categories with an owner and one current activity each.

Please explain this so an 8-year-old understands: short sentences, a fun everyday example, and no hard words.
Then give me 3 simple questions I can ask my child to check they understood, and a way to do the activity together, one tiny step at a time.

Open Claude

Sources

NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (PDF): nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
NIST, CSF 2.0 release announcement: www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmar
NIST Small Business Cybersecurity Corner, CSF 2.0 resources: www.nist.gov/itl/smallbusinesscyber/nist-cybersecurity-framework-0

My notes

I learned this

02