Notifications
Clear all
Topic starter
19/08/2026 4:08 pm
TL;DR: NIST CSF 2.0 turns human risk management into an explicit governance problem by tying policy, accountability, and measurable oversight to behavior, identity, and access signals, according to Living Security Human Risk Management Platform. The practical shift is that security teams must govern human and AI-agent risk as an enterprise decision loop, not a training activity.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: NIST CSF Human Risk Management: A Practical Alignment Guide
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should organisations govern human risk in NIST CSF 2.0?
A: They should treat human risk as an enterprise governance issue, not a training outcome.
Q: Why do identity and access controls matter in human risk management?
A: Because most meaningful human-risk events become security problems when they intersect with access.
Q: What breaks when human risk is tracked without governance?
A: You get visibility without action.
Practitioner guidance
- Define a human-risk decision register Create a register that maps each recurring human-risk signal to an accountable owner, a policy threshold, and a required response.
- Correlate behaviour with identity scope Do not evaluate risky behaviour in isolation.
- Set risk tolerance thresholds for intervention Translate executive appetite into clear thresholds that define when a signal can be monitored, when it needs review, and when it requires immediate action.
What's in the full article
Living Security Human Risk Management Platform's full blog post covers the operational detail this post intentionally leaves for the source:
- The article's step-by-step mapping between NIST CSF 2.0 Govern outcomes and human-risk operating practices
- Specific examples of how behaviour, identity and access, and threat signals are correlated inside the HRM model
- The practical interpretation of GV.RR, GV.OC, GV.SC, and GV.RM for human-risk oversight
- The article's examples of how predictive intelligence can support risk tolerance and intervention decisions
👉 Read Living Security Human Risk Management Platform's guide to NIST CSF 2.0 human risk management →
NIST CSF human risk management: what changes for governance teams?
Explore further
19/08/2026 4:41 pm
Governance is the missing layer between human-risk signals and security action. The article correctly treats NIST CSF 2.0 Govern as a strategy and accountability function rather than a documentation exercise. That matters because most human-risk programmes fail when they can observe behaviour but cannot assign ownership or trigger a consistent intervention. For IAM and PAM leaders, the lesson is that risk visibility without decision rights is just reporting.
A question worth separating out:
Q: Who should be accountable when an AI agent causes a security incident?
A: Accountability should sit with the human owner, platform team, or business function that granted and operated the agent. The identity may act independently, but governance cannot detach responsibility from the delegation chain. Programs should define ownership, escalation, and remediation paths before deployment so responsibility is clear when the agent's behaviour changes.
👉 Read our full editorial: NIST CSF 2.0 makes human risk a governed security outcome
