Cybersecurity used to be a problem a business could hand off entirely to whoever managed the servers: firewalls, antivirus software, patches applied on a schedule, all handled well out of view of the executive team. That arrangement worked as long as the business’s technology stayed inside a perimeter IT could actually defend. Artificial intelligence does not respect that perimeter. An employee experimenting with a public chatbot, a vendor quietly building AI into software the business already relies on, or an attacker running a phishing campaign written by a language model instead of a person: each of these is now a decision that touches company risk, and none of them can be fully delegated to IT alone.
Earlier versions of the NIST framework organized cybersecurity around five functions, read in order as a defensive cycle. CSF 2.0 kept that cycle and added a sixth function on top of it:
- Identify: Know what data, systems, and risks the business actually has
- Protect: Put safeguards in place to manage those risks
- Detect: Watch for signs that something has gone wrong
- Respond: Act when an incident happens
- Recover: Restore operations afterward
- Govern: Decide how much risk is acceptable, and who answers for that decision
That sixth function, Govern, acknowledged something specific: cybersecurity had become a decision that needed a named owner, a documented strategy, and ongoing oversight from leadership, not just a problem IT could solve on its own. NIST built a companion framework for artificial intelligence risk on that same logic, before most businesses had finished adopting the technology it was written for. The businesses managing this well are not the ones with the most advanced technology. They are the ones applying that same governance discipline to the newer, faster-moving risk AI represents.
How quickly that shift has become urgent is visible in the data. In the World Economic Forum’s Global Cybersecurity Outlook 2026, 94% of survey respondents named artificial intelligence as the most significant driver of change in cybersecurity for the year ahead, and 87% called AI-related vulnerabilities the fastest-growing cyber risk of the past year. That level of agreement is rare in an industry that argues about almost everything else, and it points to a risk moving faster than most businesses’ governance can keep up with.
NIST is explicit that this discipline was never meant only for large enterprises with compliance departments. The framework document itself states that CSF 2.0 “is designed to help organizations of all sizes and sectors…to manage and reduce their cybersecurity risks,” and that it is “useful regardless of the maturity level and technical sophistication of an organization’s cybersecurity programs,” according to NIST’s official Cybersecurity Framework 2.0 publication. A business without a dedicated security team is exactly the audience the framework describes. The rest of this article works through what that framework actually changed, why AI is testing it from two directions at once, and what applying the same thinking to your own AI adoption looks like in practice.
From Perimeter Defense to Continuous Risk Management
That five-function cycle is still the operational core of CSF 2.0, and a business skips it at its own risk. But read on its own, it describes what to do once risk has already been decided for you. It does not say who decides how much risk is acceptable, who is told when that risk changes, or who is responsible when a decision turns out to be wrong.
CSF 2.0 answers that with Govern, defined in NIST’s framework document as the function that ensures “the organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.” NIST places Govern at the center of its diagram of the six functions on purpose: the document explains that Govern “is in the center of the wheel because it informs how an organization will implement the other five Functions.” Identify, Protect, Detect, Respond, and Recover describe the work. Govern describes who is accountable for deciding how that work gets prioritized, funded, and adjusted as risk changes. A business that has firewalls, backups, and antivirus software but no one clearly responsible for cybersecurity decisions has the five outer functions and is missing the one in the middle.
The Govern Function: Why Leadership Now Has a Named Job
For a CEO or business owner, Govern is the part of the framework written directly to them rather than to a technician. It is the function that turns cybersecurity from a line item IT manages into a business decision leadership owns: what risks the organization is willing to accept, who has the authority to accept them, and how often that decision gets revisited as circumstances change.
In practice, that means:
- A named person, not a department, responsible for cybersecurity risk decisions;
- A written policy that says what that risk tolerance actually is, rather than an assumption everyone shares informally; and
- A recurring point on the calendar where that policy gets checked against what has actually changed in the business.
None of that requires new technology or a large budget. It requires leadership treating the decision as theirs to make, rather than deferring it entirely to whoever manages the servers. A small business that has never formally assigned this responsibility has, in NIST’s own terms, skipped the function the framework treats as foundational to all the others.
AI Is Raising the Stakes on Both Sides of the Business
Artificial intelligence has turned that governance gap into an urgent one, and it is doing so in two directions at once. On the outside, attackers are using AI to make old tactics more effective. Microsoft’s 2025 Digital Defense Report found that AI-driven phishing is now three times more effective than traditional campaigns, meaning the same employee who could once reasonably spot a poorly written scam email is now facing messages written with the fluency of a native speaker and tailored to their role. The World Economic Forum’s Global Cybersecurity Outlook 2026 puts a number on how fast this is moving overall, with 87% of respondents identifying AI-related vulnerabilities as the fastest-growing cyber risk of the past year, even as the share of organizations with a process to assess the security of the AI tools they use has nearly doubled, from 37% to 64%.
On the inside, the risk is different: it is the AI a business has adopted for itself, often without anyone deciding to adopt it. IBM’s 2026 Cost of a Data Breach Report found that roughly one in five organizations had already experienced a breach targeting their own AI models or applications, and that among those organizations, 92% lacked proper AI access controls. More than two-thirds of breached organizations, according to Cybersecurity Dive’s coverage of the report, still had no governance process in place to limit shadow AI, the unapproved tools employees turn to on their own. That gap carries a real cost: IBM found that malicious breaches involving AI cost an average of $6 million, against a global average of $4.99 million across all breaches. Attackers getting faster and better-resourced is one problem. A business that cannot say who approved the AI tools its own employees are using is a second, separate problem, and it is the one squarely inside a business’s own control.
Applying NIST’s Playbook to Your Own AI Adoption
NIST did not leave businesses to work out that second problem on their own. Its AI Risk Management Framework (RMF) mirrors the same structure as CSF 2.0, built around four functions: Govern, Map, Measure, and Manage. Govern plays the identical role it does in the cybersecurity framework. According to NIST’s own framework document, Govern “cultivates and implements a culture of risk management” across an organization and is deliberately cross-cutting, meaning it is meant to inform and run through the other three functions rather than sit beside them. Map establishes what a given AI system is actually being used for and who it could affect. Measure evaluates whether it is behaving the way it is supposed to. Manage puts resources behind fixing what Map and Measure turn up. NIST has also published a Generative AI Profile, a companion resource that applies the same framework specifically to generative AI tools, the category most employees are already using.
Read against the finding that more than two-thirds of breached organizations still have no governance process to limit shadow AI, the AI RMF describes exactly the gap that shows up in the data: a business that has never named who is accountable for AI decisions, never documented which tools are approved, and never revisited that decision as employees keep adopting new ones on their own. A business can capture the benefit of that framework without producing NIST’s full set of AI RMF documentation. What it needs is the same discipline CSF 2.0 already asks of its cybersecurity program, applied to a second category of risk: someone accountable, a written policy, and a scheduled point to check whether that policy still matches what employees are actually doing.
Turning the Framework Into a Habit
For a business without a dedicated security or compliance function, the value of NIST’s approach is that it breaks an overwhelming topic into a sequence rather than a single, all-or-nothing project:
- Start with Govern: Decide who owns cybersecurity and AI risk decisions, and put in writing what the business will and will not accept.
- Move to Identify and Map: Take an honest inventory of what data and systems the business actually depends on, and, separately, what AI tools employees have already started using, approved or not.
- Apply Protect at a level proportionate to what that inventory turns up, rather than treating every system as equally critical.
- Build in Detect: Find some reliable way of noticing when something has gone wrong instead of finding out from a customer or a vendor first.
- Finish with Respond and Recover: A plan for what happens next, tested before it is needed rather than written for the first time during an actual incident.
None of these steps requires enterprise-scale resources. They require doing them in order, and doing them at all.
Governance Is the Advantage
NIST’s own framework changed because cybersecurity stopped being something a technical team could fully own on its own, and became a decision that belongs to leadership. AI is asking businesses to make that same shift again, in a newer area, on much the same terms: name an owner, write down the policy, and revisit it as things change.
Building that habit now, while most businesses’ use of AI is still taking shape, is simply easier than retrofitting it later, once tools and workarounds are already baked into how people work. It is less about a looming deadline and more about the same logic that made Govern useful for cybersecurity in the first place: a decision this important is easier to make deliberately, early, than to reconstruct after the fact.
For a business without a dedicated security or compliance function, translating a framework like NIST’s into a working policy, on top of running the business itself, is exactly the kind of groundwork a technology partner can help with: naming an owner, drafting the policy, and keeping it current as the business’s use of AI keeps evolving.
Cybersecurity: Builds the access controls and monitoring that close the exact gaps NIST’s framework flags as foundational.
AI Integration & Governance: Turns a shadow AI problem into a documented policy with a named owner, before it shows up in a breach report.
IT Consulting & Strategy: Translates NIST’s framework into a working plan sized for your business, not a federal agency.
👉 If your organization is ready to bring the same governance discipline to its AI adoption that it already applies to cybersecurity, our team is ready to help you take the next step.
