NIST released Cybersecurity Framework 2.0 on February 26, 2024 (NIST CSWP 29). The most consequential change was structural. CSF 1.1’s five functions — Identify, Protect, Detect, Respond, Recover — were familiar enough that many organizations could navigate them on autopilot. CSF 2.0 added a sixth function, Govern, and placed it at the center of the framework wheel.
Govern is not a renamed Identify. It is a new layer of expectation. Cybersecurity strategy, organizational expectations, oversight, supply chain risk, and the integration of cyber risk with enterprise risk are now framed as governance responsibilities, not IT-team responsibilities. For healthcare organizations, the shift is significant because most healthcare boards have historically treated cybersecurity as an operational topic that the CIO or CISO reports up periodically. CSF 2.0 frames cybersecurity as a board-level enterprise risk responsibility that requires accountability, oversight, and integrated reporting.
This post explains what Govern actually requires, why it matters for healthcare boards specifically, and how a healthcare board cybersecurity program built to CSF 2.0 differs from the operational reporting most boards still receive.
What Govern Adds
Govern includes six categories: Organizational Context, Risk Management Strategy, Roles, Responsibilities, and Authorities, Policy, Oversight, and Cybersecurity Supply Chain Risk Management. Each translates into observable governance practice.
Organizational Context asks the organization to articulate its mission, stakeholders, legal and regulatory environment, and the threats and opportunities that shape cybersecurity strategy. For healthcare, this means explicit articulation of patient safety, HIPAA enforcement, the HIPAA Security Rule NPRM trajectory, and supply-chain dependencies as governance context.
Risk Management Strategy asks for an integrated approach to risk that connects cybersecurity to enterprise risk management. The strategy must be approved at the appropriate level (typically the board), reviewed periodically, and adjusted as the threat landscape changes.
Roles, Responsibilities, and Authorities asks for explicit assignment of cybersecurity responsibilities, from the board down through the CEO, CISO, control owners, and individual contributors. Healthcare boards that have not formally assigned cybersecurity oversight to a committee or named director are not aligned with this category.
Policy asks for cybersecurity policy that is approved, communicated, and enforced. Many healthcare organizations have HIPAA policies; fewer have integrated enterprise cybersecurity policy that integrates HIPAA, CMMC (where applicable), state law, and contractual obligations.
Oversight asks for monitoring of the cybersecurity program against the strategy, with reporting upward and adjustment as needed. This is the category most healthcare boards underserve, because oversight requires recurring board-level cybersecurity reporting that integrates enterprise risk, not just incident updates.
Cybersecurity Supply Chain Risk Management asks for a program that addresses third-party cybersecurity risk consistent with NIST SP 800-161 Rev. 1 (Boyens et al., 2022). For healthcare, this connects directly to BAA management, vendor risk assessments, and the kind of supply-chain visibility that Change Healthcare made undeniable.
Why Healthcare Boards Are Behind
Three structural factors explain why most healthcare boards have not yet caught up to CSF 2.0 Govern expectations.
Healthcare governance traditionally separates clinical from operational risk. Boards have well-developed structures for clinical-quality oversight, financial oversight, and compliance oversight (mostly tied to HIPAA Privacy Rule and clinical regulation). Cybersecurity risk has often been folded into compliance or operations rather than treated as a distinct enterprise risk category.
Most healthcare board members do not have cybersecurity backgrounds. Healthcare board composition leans toward clinical, financial, legal, and operational expertise. Cybersecurity expertise is rarer at the board level than at the executive level, which makes governance in the CSF 2.0 sense difficult to operationalize.
Reporting cadences and content are misaligned. Most healthcare boards receive cybersecurity reports only after incidents or during budget cycles. CSF 2.0 Govern expects continuous oversight with periodic, integrated reporting that connects cyber risk to enterprise risk.
The HIPAA Security Rule NPRM, the SEC cybersecurity disclosure rule (for public-company healthcare entities and partners), and OCR Risk Analysis Initiative settlements all push in the direction CSF 2.0 has named. Healthcare boards that do not catch up are increasingly exposed.
What CSF 2.0 Govern Looks Like in Practice
A healthcare board cybersecurity program built to CSF 2.0 Govern has six observable features.
A named board committee or director with cybersecurity oversight responsibility. Many large healthcare systems have moved cybersecurity oversight to a Risk Committee, an Audit Committee, a Quality and Patient Safety Committee, or a dedicated Cybersecurity or Technology Committee. Smaller systems often need a designated director with cybersecurity oversight responsibility. The choice of structure matters less than the explicit assignment.
A board-approved cybersecurity strategy. Reviewed at least annually, with explicit articulation of how the strategy supports patient care, HIPAA compliance, business continuity, and competitive positioning. The strategy should be a document a director can read in 20 minutes and explain to a peer.
Recurring cybersecurity reporting that integrates with enterprise risk. Quarterly cadence is the operational baseline, with monthly updates on material developments and immediate notice for material events. The report should include enterprise risk register summary, control posture relative to CSF 2.0, OCR enforcement-trend implications for the organization, pending regulatory changes, AI governance status (where applicable), PQC readiness milestones, vendor risk highlights, and budget commentary.
Explicit integration of cybersecurity into enterprise risk management. The cybersecurity risk register should be visible to the board’s enterprise risk oversight. Findings should connect to enterprise risk treatment decisions, not exist in a parallel cybersecurity universe.
Documented cybersecurity policy and exception management. Policies are approved, dated, communicated, enforced, and updated. Exceptions are documented with rationale, owner, and review cadence.
A cybersecurity supply chain risk program. Vendor inventory, risk-tiered review, BAA management, contractual flow-down, and supply-chain monitoring all reporting upward to the board through cybersecurity oversight.
How This Connects to OCR Enforcement
OCR’s Risk Analysis Initiative settlements, including the Cascade Eye and Skin Centers $250,000 settlement on September 26, 2024, have grounded findings in deficiencies that CSF 2.0 Govern addresses. Failure to conduct compliant risk analysis is partially a Govern failure: the organization did not have the governance structure that produces and reviews accurate risk analysis. Failure to monitor information system activity is partially a Govern failure: the organization did not have the oversight that ensures monitoring controls are operating.
A healthcare board that owns CSF 2.0 Govern is materially better positioned for an OCR investigation than a board that treats cybersecurity as an operational concern. See OCR’s Risk Analysis Initiative and the Cascade Eye Settlement for the enforcement framing.
How This Connects to the SEC Cybersecurity Disclosure Rule
For public-company healthcare entities and any healthcare organization with public-company partners, the SEC’s 2023 cybersecurity disclosure rule already creates board-level cybersecurity oversight expectations. Item 1C of Form 10-K requires annual disclosure of cybersecurity risk management, strategy, and governance, including how the board oversees cybersecurity risk and management’s role in assessing and managing material cybersecurity risk.
The SEC rule’s governance disclosure requirements are functionally a public-company implementation of CSF 2.0 Govern. Private healthcare entities are not directly subject to the SEC rule, but their public-company customers and partners increasingly expect equivalent governance practices in vendor relationships.
What Boards Should Ask
Five questions a healthcare board should be asking management today, regardless of whether the organization has formally adopted CSF 2.0:
- What is our current cybersecurity strategy, when was it last reviewed, and how does it integrate with enterprise risk?
- Who owns cybersecurity oversight at the board level, and what is the reporting cadence?
- How do we currently respond to the HIPAA Security Rule NPRM, OCR enforcement trends, and CIRCIA finalization risk? What is our timeline?
- How do we know our vendor and supply chain cybersecurity posture? When was our most consequential vendor last reviewed?
- If we had a material cybersecurity incident next week, how would the board first hear about it, and how would we coordinate with HIPAA, FTC, state, and (where applicable) SEC reporting?
These questions are not exhaustive. They are diagnostic. Boards that cannot answer them are not yet operating to CSF 2.0 Govern expectations regardless of formal framework adoption.
What to Track
Two signals matter through 2027:
- HHS, OCR, and the HIPAA Security Rule final rule on governance and oversight expectations.
- SEC enforcement under the cybersecurity disclosure rule and any healthcare-specific governance precedents.
CSF 2.0 Govern is the most consequential durable governance framework healthcare boards have available today. Adopting it is largely a matter of organizational discipline rather than budget. Failing to adopt it is increasingly a competitive and enforcement liability that is no longer survivable through cybersecurity incident response alone.
Sources
- NIST. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (CSWP 29).
- Boyens et al. (2022). NIST SP 800-161 Rev. 1, C-SCRM.
- HHS. (2025). HIPAA Security Rule NPRM. 90 Fed. Reg. 898.
- HHS Office for Civil Rights. (2024). Cascade Eye and Skin Centers ransomware settlement.
- U.S. Securities and Exchange Commission. (2023). Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure Final Rule. 88 Fed. Reg. 51896.
Soft CTA
Need help putting this into practice?
We can help you turn the idea into an action plan, implementation checklist, or review of the controls that matter most.