THE EVOLUTION OF CYBER RISK MANAGEMENT THROUGH THE PRISM OF THE NIST CYBERSECURITY FRAMEWORK

Abstract

The article provides a comprehensive analysis of the evolution of the NIST Cybersecurity Framework from its initial version 1.0 to the current version 2.0. It highlights the background to the creation of the framework, its place in international practice, and its key role in improving the cyber resilience of organizations of all sizes, from small companies to global corporations and government agencies. It examines in detail the features of previous editions, in particular CSF 1.0, which laid the foundation in the form of five basic functions (Identify, Protect, Detect, Respond, Recover), and CSF 1.1, which clarified approaches to risk management in supply chains and made the framework more applicable. It is shown that the transition to CSF 2.0 in 2024 was a qualitative stage of development, as the new version focuses not only on technical aspects but also on strategic corporate governance. Among the key innovations are the Govern function, which formally establishes management responsibility, as well as expanded opportunities for integration with international standards, improved performance metrics, and increased focus on supply chain risk management. The specifics of the transition process for organizations to CSF 2.0 are analyzed separately. It includes analyzing the gaps between the current state of security and the new requirements, forming policies, building an implementation strategy, applying automation and Zero Trust tools, as well as training personnel. It is emphasized that successful adaptation depends on support from senior management, the formation of a security culture, and continuous improvement of procedures. The article also considers the Ukrainian context, where the implementation of CSF 2.0 is supported at the state level by the State Service of Special Communications and Information Protection of Ukraine and with the participation of international partners. The practical value of the study lies in the possibility of using its conclusions and recommendations to develop long-term cyber risk management strategies in both the public and private sectors.