NIST CSF 2.0: What it means for modern software supply chain risk management

**NIST has released CSF 2.0**, a major update that adds a sixth function—govern—emphasizing cybersecurity governance, supply chain risk management, and secure software development, while expanding relevance to organizations of all sizes. The framework promotes continuous improvement (e.g., monitoring, assessments, red teaming), aligns with business risk decisions, and integrates with other NIST resources via new reference tools, earning broad industry praise for making risk management more practical, measurable, and accessible.