How NIST CSF 2.0 and C-SCRM help manage software supply chain risk

The report outlines NIST’s release of CSF 2.0, emphasizing the addition of the “Govern” function to strengthen cybersecurity supply chain risk management across organizations. Expert panelists note that governance is essential to address risks spanning proprietary, open source, and especially commercial software, citing recent supply chain incidents as context. They advocate for operationalizing CSF 2.0 in a business-friendly, auditable format (akin to SOC 2) to drive practical adoption and align security with organizational objectives.