Health-ISAC Hacking Healthcare 3-1-2024

Welcome back to Hacking Healthcare™.

NIST Publishes CSF 2.0

After roughly a decade since v1.0 was released, the NIST CSF has undergone a major revision that was finalized by NIST on Monday.[i]^, [ii]  The new CSF v2.0 includes quality of life improvements, makes clarifications, and adds necessary substantive revisions to keep the framework relevant, while retaining the effective general structure with which users are familiar with.

What Is the NIST CSF

For those unfamiliar with the NIST CSF, it was originally published in 2014 as a framework to help organizations manage and reduce cyber risk. While it was specifically targeted at U.S. critical infrastructure sectors, it was ultimately designed to be agnostic to an entity’s size, sector, and organizational structure and was meant to be helpful and accessible to organizations regardless of where they are in their cybersecurity maturity journey. The NIST CSF has been extremely successful across industries and has had a global impact.

What’s New?

The largest differences can be found in the following areas:

• – Governance & Supply Chain Risk: CSF 2.0 introduces a new function, Govern, that is described as covering how an organization’s “cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.[iii] The Govern function also sees an elevation of supply chain considerations with the inclusion of Cybersecurity Supply Chain Risk Management category and ten subcategories.
• – References & New Tools: One change that will be strikingly apparent is the removal of informative references from each subcategory. While the CSF v1.1 conveniently placed these references in the right-most column of the document, NIST has eliminated this in favor of hosting the references online at its new Cybersecurity and Privacy Reference Tool (CPRT).[iv] In general, there are a few new tools that CSF v2.0 will look to take more advantage of, including the CPRT and CSF 2.0 Implementation Examples.

Actions & Analysis
**Included with Health-ISAC Membership**

Upcoming International Hearings/Meetings

• EU
  • – No relevant meetings at this time
• US
  • – No relevant meetings at this time
• Rest of World
  • – Health-ISAC APAC Summit (3/19 – 3/21)