NIST Releases CSF 2.0 Quick-Start Guides for ERM and Informative References
Summary: NIST announced two Cybersecurity Framework 2.0 quick-start guide updates on March 23, 2026. The agency released the final SP 1308 guide on connecting CSF 2.0 with enterprise risk management and workforce management, and it also opened public comments on SP 1347, a guide focused on using informative references to support cybersecurity risk management. NIST says both publications are part of its broader effort to make CSF 2.0 easier to implement for specific audiences and use cases.
Why it matters: This is squarely in the GRC lane because it tries to translate the framework into governance and organizational operating language. The useful part is not the existence of another guide; it is NIST’s attempt to connect cyber risk communication, workforce planning, and framework implementation without pretending those functions can stay in separate silos.
What to watch: The real question is whether practitioners use SP 1308 to improve decision-making across risk, staffing, and security operations, or whether it just becomes another citation in compliance paperwork. The draft guide on informative references is also worth watching because it affects how people map frameworks to controls and evidence.
Source: NIST