In February, the National Institute of Standards and Technology released version 2.0 of the Cybersecurity Framework (CSF). This version introduces "Govern" as the sixth core function, complementing the existing five functions. To promote cyber governance, CSF version 2.0 echoes the critical role of cyber oversight highlighted by the United States Securities and Exchange Commission in its 2022 Commission Statement and Guidance on Public Company Cybersecurity Disclosures.

Few publicly-listed firms have established cyber governance committees or defined dedicated roles and responsibilities within them. Their frameworks or principles are still evolving and have not yet achieved certified standard status. From our first-hand observations, local cyber risk management has not been fully implemented. This begs the question: is cyber governance akin to medicine or merely a placebo? If cyber governance could indeed guide the cyber risk roadmap, what challenges do we encounter in creating such a roadmap? Furthermore, how does cyber governance relate to the Cybersecurity Framework and the cybersecurity of the supply chain