Nist Csf Specialist

NIST CSF 2.0 Specialist

Implement, assess, and manage cybersecurity programs aligned with the NIST Cybersecurity Framework 2.0 — the definitive standard for organizational cybersecurity risk management.

---

Table of Contents

• Trigger Phrases
• Quick Start
• Tools
• NIST CSF 2.0 Overview
• Six Core Functions
• CSF Profiles
• CSF Tiers
• Cross-Framework Mapping
• Infrastructure Security Assessment
• Maturity Assessment Workflow
• Implementation Roadmap
• Reference Guides
• Validation Checkpoints

---

Trigger Phrases

Use this skill when you hear:

• "NIST cybersecurity framework"
• "CSF 2.0"
• "NIST compliance"
• "cybersecurity risk management"
• "NIST controls"
• "NIST assessment"
• "cybersecurity maturity"
• "NIST CSF profile"
• "cybersecurity governance"
• "cybersecurity program assessment"
• "CSF gap analysis"
• "cross-framework compliance mapping"

---

Quick Start

Assess Cybersecurity Maturity

python scripts/csf_maturity_assessor.py --input assessment.json --target-tier 3 --output maturity_report.json

Map Controls Across Frameworks

python scripts/csf_control_mapper.py --source-framework nist-csf --target-framework iso27001 --output mapping.json

Generate Gap Analysis

python scripts/csf_maturity_assessor.py --input assessment.json --target-tier 4 --format markdown --output gap_analysis.md

Multi-Framework Unified Matrix

python scripts/csf_control_mapper.py --source-framework nist-csf --target-framework all --output unified_matrix.json

---

Tools

csf_maturity_assessor.py

Comprehensive maturity assessment engine for NIST CSF 2.0.

Capabilities:

• Scores each function and category on a 1–4 tier scale
• Compares current profile against target profile
• Generates prioritized gap analysis with remediation actions
• Maps gaps to specific CSF subcategories
• Produces JSON or Markdown output

Usage:

# Full maturity assessment with gap analysis
python scripts/csf_maturity_assessor.py \
  --input current_state.json \
  --target-tier 3 \
  --output report.json

# Markdown report for executive presentation
python scripts/csf_maturity_assessor.py \
  --input current_state.json \
  --target-tier 4 \
  --format markdown \
  --output executive_report.md

# Assess specific functions only
python scripts/csf_maturity_assessor.py \
  --input current_state.json \
  --functions GOVERN,IDENTIFY,PROTECT \
  --target-tier 3 \
  --output partial_report.json

Input Format (current_state.json):

{
  "organization": "Acme Corp",
  "assessment_date": "2026-03-09",
  "assessor": "Security Team",
  "functions": {
    "GOVERN": {
      "GV.OC": {
        "score": 2,
        "evidence": "Mission documented, partial stakeholder mapping",
        "notes": "Legal requirements catalog incomplete"
      },
      "GV.RM": {
        "score": 1,
        "evidence": "No formal risk management strategy",
        "notes": "Risk appetite not defined"
      }
    },
    "IDENTIFY": {
      "ID.AM": {
        "score": 3,
        "evidence": "CMDB maintained, automated discovery",
        "notes": "Shadow IT gap exists"
      }
    }
  }
}

csf_control_mapper.py

Cross-framework control mapping engine.

Capabilities:

• Maps NIST CSF 2.0 categories to ISO 27001, SOC 2, HIPAA, PCI-DSS
• Identifies overlapping controls for multi-framework programs
• Generates unified control matrices
• Highlights gaps unique to each framework

Usage:

# Map CSF to ISO 27001
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework iso27001 \
  --output iso_mapping.json

# Map CSF to all supported frameworks
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework all \
  --output unified_matrix.json

# Map specific functions only
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework soc2 \
  --functions GOVERN,PROTECT \
  --output soc2_mapping.json

# Markdown output for documentation
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework iso27001 \
  --format markdown \
  --output mapping_report.md

---

NIST CSF 2.0 Overview

What Changed in CSF 2.0

Released in February 2024, NIST CSF 2.0 represents a major evolution from the original 2014 framework and 2018 v1.1 update:

Expanded Scope: CSF 2.0 applies to ALL organizations — not just critical infrastructure. Small businesses, government agencies, higher education, and nonprofits are now explicitly in scope.

New GOVERN Function: The most significant change. GOVERN elevates cybersecurity governance to a top-level function, recognizing that executive leadership, policy, and oversight are prerequisites for effective cybersecurity.

Enhanced Supply Chain Focus: Cybersecurity Supply Chain Risk Management (C-SCRM) is now a category under GOVERN, reflecting the reality that supply chain attacks are a primary threat vector.

Improved Guidance: CSF 2.0 includes implementation examples and quick-start guides that were absent in earlier versions. The framework is more actionable and prescriptive while maintaining its flexible, risk-based approach.

Profile Updates: Profiles are now more clearly defined as organizational profiles (describing current/target states) and community profiles (sector-specific templates).

Framework Architecture

┌─────────────────────────────────────────────────────┐
│                    CSF CORE                          │
│                                                     │
│  ┌─────────┐                                        │
│  │ GOVERN  │ ← NEW: Overarching governance          │
│  └────┬────┘                                        │
│       │                                             │
│  ┌────▼────┐  ┌─────────┐  ┌────────┐  ┌─────────┐│
│  │IDENTIFY │→ │ PROTECT  │→ │ DETECT │→ │ RESPOND ││
│  └─────────┘  └─────────┘  └────────┘  └────┬────┘│
│                                              │      │
│                                         ┌────▼────┐ │
│                                         │ RECOVER │ │
│                                         └─────────┘ │
├─────────────────────────────────────────────────────┤
│                   PROFILES                           │
│          Current State ↔ Target State                │
├─────────────────────────────────────────────────────┤
│                    TIERS                             │
│    Partial → Risk Informed → Repeatable → Adaptive  │
└─────────────────────────────────────────────────────┘

---

Six Core Functions

1. GOVERN (GV) — NEW in CSF 2.0

The GOVERN function establishes and monitors the organization's cybersecurity risk management strategy, expectations, and policy. It is the connective tissue across all other functions.

GV.OC — Organizational Context

Understanding the organization's mission, stakeholder expectations, and dependencies is the foundation for all cybersecurity decisions.

Key Activities:

• Document organizational mission, objectives, and stakeholder expectations
• Catalog legal, regulatory, and contractual cybersecurity obligations
• Map critical business processes and their technology dependencies
• Define risk appetite and risk tolerance statements
• Identify internal and external stakeholders with cybersecurity interests

Implementation Guidance:

• Maintain a regulatory obligations register updated quarterly
• Conduct annual stakeholder mapping exercises
• Align cybersecurity objectives with enterprise risk management (ERM)
• Document dependencies between business processes and IT assets

Maturity Indicators:

GV.RM — Risk Management Strategy

Key Activities:

• Establish cybersecurity risk management strategy aligned to enterprise risk
• Define organizational risk tolerance levels (quantitative where possible)
• Create formal risk statements approved by leadership
• Integrate cybersecurity risk into strategic planning and investment decisions
• Review and update risk strategy based on threat landscape changes

Implementation Guidance:

• Use quantitative risk analysis methods (FAIR, Monte Carlo) for critical assets
• Maintain risk tolerance thresholds per business unit and asset class
• Present risk posture to the board at least quarterly
• Establish risk acceptance criteria and approval workflows
• Link risk management outcomes to budget allocation

GV.RR — Roles, Responsibilities, and Authorities

Key Activities:

• Define CISO role, reporting structure, and authority
• Establish cybersecurity responsibilities across all organizational levels
• Ensure board-level cybersecurity oversight
• Define authority for cybersecurity decisions (incident response, risk acceptance)
• Integrate cybersecurity responsibilities into HR processes (job descriptions, performance reviews)

Implementation Guidance:

• CISO should report to CEO or board (not buried under IT)
• Create a RACI matrix for cybersecurity functions
• Include cybersecurity objectives in executive performance metrics
• Establish a cybersecurity steering committee with cross-functional representation
• Document delegation of authority for emergency cybersecurity decisions

GV.PO — Policy

Key Activities:

• Develop comprehensive cybersecurity policy framework
• Ensure policies are informed by organizational context and risk strategy
• Establish policy review and update cadence (annual minimum)
• Communicate policies to all stakeholders including third parties
• Enforce policy compliance through technical and administrative controls

Implementation Guidance:

• Structure policies in a hierarchy: Policy → Standards → Procedures → Guidelines
• Tag policies with applicable regulatory requirements
• Use exception management processes for policy deviations
• Measure policy awareness and compliance rates
• Automate policy distribution and acknowledgment tracking

GV.OV — Oversight

Key Activities:

• Review cybersecurity strategy execution and outcomes
• Report cybersecurity risk posture to governance bodies (board, committees)
• Establish KPIs and KRIs for cybersecurity performance
• Conduct management reviews of the cybersecurity program
• Adjust strategy based on performance metrics and changing risk landscape

Key Metrics:

• Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
• Percentage of critical assets with current risk assessments
• Policy compliance rate across business units
• Vulnerability remediation timelines (critical/high/medium/low)
• Security awareness training completion and phishing simulation results
• Third-party risk assessment coverage

GV.SC — Cybersecurity Supply Chain Risk Management

Key Activities:

• Establish C-SCRM policies and procedures
• Assess cybersecurity risk of suppliers, vendors, and partners
• Include cybersecurity requirements in procurement and contracts
• Monitor supply chain cybersecurity posture continuously
• Plan for supply chain disruption and compromise scenarios

Implementation Guidance:

• Tier suppliers by criticality and data access level
• Require SOC 2 Type II or equivalent from critical suppliers
• Include right-to-audit clauses in contracts
• Monitor supplier breach disclosures and vulnerability announcements
• Maintain a software bill of materials (SBOM) for critical applications
• Validate supplier incident response capabilities

---

2. IDENTIFY (ID)

The IDENTIFY function develops organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.

ID.AM — Asset Management

Key Activities:

• Maintain comprehensive hardware and software asset inventories
• Classify assets by criticality and sensitivity
• Map data flows between systems, networks, and external parties
• Identify and catalog all data repositories (structured and unstructured)
• Track software licensing and end-of-life/end-of-support status
• Discover and manage shadow IT

Implementation Guidance:

• Deploy automated asset discovery tools (agent-based and network-based)
• Maintain a Configuration Management Database (CMDB)
• Tag assets with owner, criticality, data classification, and regulatory scope
• Conduct quarterly asset reconciliation
• Integrate asset inventory with vulnerability management and patch systems

ID.RA — Risk Assessment

Key Activities:

• Identify and document vulnerabilities across all asset types
• Integrate threat intelligence feeds into risk assessment processes
• Conduct risk analysis combining likelihood and impact
• Prioritize risks based on organizational risk tolerance
• Document risk assessment results and risk treatment decisions

Implementation Guidance:

• Use standardized risk assessment methodologies (NIST SP 800-30, FAIR, OCTAVE)
• Maintain a risk register with assigned owners and treatment plans
• Conduct risk assessments for new systems, major changes, and annually
• Incorporate threat intelligence from ISACs, CISA advisories, and vendor bulletins
• Use vulnerability scanning results as input to risk assessment

ID.IM — Improvement

Key Activities:

• Conduct post-incident lessons learned reviews
• Track improvement actions to completion
• Benchmark cybersecurity program against peers and standards
• Integrate improvement insights into program planning and budgeting
• Share lessons learned across the organization

Implementation Guidance:

• Schedule blameless post-mortems within 2 weeks of significant incidents
• Maintain an improvement action tracker with deadlines and owners
• Conduct annual program maturity assessments
• Participate in industry information sharing organizations

---

3. PROTECT (PR)

The PROTECT function implements appropriate safeguards to ensure delivery of critical services.

PR.AA — Identity Management, Authentication, and Access Control

Key Activities:

• Implement identity governance and administration (IGA)
• Enforce multi-factor authentication (MFA) for all users — prioritize FIDO2/WebAuthn and hardware keys (YubiKey)
• Deploy single sign-on (SSO) with SAML/OIDC integration
• Implement privileged access management (PAM) for administrative accounts
• Adopt zero trust architecture principles (never trust, always verify)
• Enforce least privilege and just-in-time (JIT) access models
• Conduct regular access reviews and certification campaigns

Implementation Guidance:

• Require phishing-resistant MFA (FIDO2) for administrative and high-risk access
• Deploy PAM solutions with session recording and credential vaulting
• Implement network micro-segmentation aligned with zero trust
• Automate user provisioning/deprovisioning tied to HR systems
• Review privileged access monthly, standard access quarterly
• Maintain identity federation with partners using SAML/OIDC

PR.AT — Awareness and Training

Key Activities:

• Deliver role-based cybersecurity training (developer, executive, general staff)
• Conduct regular phishing simulation campaigns
• Provide specialized training for privileged users and administrators
• Measure training effectiveness through testing and behavioral metrics
• Update training content based on current threats

Implementation Guidance:

• Require annual security awareness training for all personnel
• Quarterly phishing simulations with progressive difficulty
• Track and remediate repeat phishing test failures
• Provide secure coding training for developers (OWASP Top 10)
• Executive training should focus on risk governance and incident decisions

PR.DS — Data Security

Key Activities:

• Encrypt data at rest using AES-256 or equivalent
• Encrypt data in transit using TLS 1.2+ (prefer TLS 1.3)
• Implement data loss prevention (DLP) controls
• Classify data per organizational taxonomy (Public, Internal, Confidential, Restricted)
• Manage encryption keys using HSMs or KMS
• Apply data retention and disposal policies

Implementation Guidance:

• Deploy endpoint DLP, network DLP, and cloud DLP
• Automate data classification using content inspection and ML
• Implement database activity monitoring for sensitive data stores
• Use tokenization for sensitive data in non-production environments
• Rotate encryption keys per policy (annually minimum)
• Secure backup data with same encryption standards as production

PR.PS — Platform Security

Key Activities:

• Implement system hardening baselines (CIS Benchmarks, DISA STIGs)
• Maintain patch management program with defined SLAs
• Enforce configuration management and drift detection
• Secure operating systems, applications, firmware, and containers
• Remove or disable unnecessary services, ports, and protocols

Implementation Guidance:

• Apply CIS Level 1 (minimum) or Level 2 benchmarks across all systems
• Patch critical vulnerabilities within 72 hours, high within 30 days
• Deploy configuration management tools (Ansible, Chef, Puppet, Terraform)
• Use immutable infrastructure patterns where possible
• Conduct regular hardening compliance scans
• Maintain golden images for standard deployments

PR.IR — Technology Infrastructure Resilience

Key Activities:

• Design redundancy into critical infrastructure components
• Implement failover mechanisms (active-active, active-passive)
• Conduct capacity planning aligned with business growth
• Test disaster recovery procedures regularly
• Maintain geographically distributed backups

Implementation Guidance:

• Define RPO/RTO for each critical system
• Test failover monthly for Tier 1 systems
• Conduct annual disaster recovery exercises
• Maintain 3-2-1 backup strategy (3 copies, 2 media types, 1 offsite)
• Monitor infrastructure capacity and alert at 80% utilization

---

4. DETECT (DE)

The DETECT function defines activities to identify the occurrence of a cybersecurity event.

DE.CM — Continuous Monitoring

Key Activities:

• Deploy and tune SIEM for centralized log collection and correlation
• Implement IDS/IPS for network threat detection
• Deploy EDR/XDR on all endpoints
• Monitor network traffic for anomalies (NetFlow, full packet capture for critical segments)
• Monitor cloud workloads and SaaS applications
• Establish security operations center (SOC) — internal or managed

Implementation Guidance:

• Centralize logs from all systems, applications, network devices, and cloud services
• Retain logs per regulatory requirements (minimum 1 year, 90 days hot)
• Tune SIEM rules quarterly to reduce false positives
• Implement user and entity behavior analytics (UEBA)
• Monitor DNS queries for indicators of compromise
• Deploy honeypots/honeytokens in critical network segments

DE.AE — Adverse Event Analysis

Key Activities:

• Correlate events from multiple sources to identify incidents
• Implement anomaly detection for baseline deviations
• Conduct proactive threat hunting campaigns
• Analyze alerts for true positives and escalate confirmed events
• Maintain detection playbooks for known attack patterns

Implementation Guidance:

• Develop threat hunting hypotheses based on threat intelligence
• Conduct weekly or monthly threat hunting exercises
• Map detection rules to MITRE ATT&CK techniques
• Maintain detection coverage matrix against ATT&CK
• Automate alert triage using SOAR playbooks
• Track detection efficacy metrics (true positive rate, MTTD)

---

5. RESPOND (RS)

The RESPOND function includes activities to take action regarding a detected cybersecurity incident.

RS.MA — Incident Management

Key Activities:

• Maintain an incident response plan (IRP) tested annually
• Define incident classification and severity levels
• Establish escalation procedures and communication chains
• Activate incident response team based on severity
• Coordinate response activities across technical and business teams

Implementation Guidance:

• Classify incidents: P1 (Critical), P2 (High), P3 (Medium), P4 (Low)
• P1 response initiation within 15 minutes, P2 within 1 hour
• Maintain on-call rotation for incident response team
• Conduct tabletop exercises quarterly and full simulations annually
• Integrate IRP with business continuity and crisis management plans

RS.AN — Incident Analysis

Key Activities:

• Conduct forensic analysis of compromised systems
• Determine root cause, attack vector, and scope of compromise
• Assess business impact (data loss, operational disruption, financial)
• Document analysis findings in incident report
• Preserve evidence chain of custody for potential legal proceedings

Implementation Guidance:

• Maintain forensic toolkit and trained forensic analysts
• Use write-blockers and forensic images for evidence preservation
• Document all analysis steps and findings in real-time
• Engage external forensic support for major incidents
• Maintain relationships with law enforcement contacts

RS.CO — Incident Response Reporting and Communication

Key Activities:

• Notify internal stakeholders per communication plan
• Report to regulatory authorities per legal requirements
• Communicate with affected individuals when required
• Coordinate with law enforcement when appropriate
• Manage media communications through designated spokesperson

Implementation Guidance:

• Pre-draft notification templates for common incident types
• Know regulatory notification timelines: GDPR (72 hours), HIPAA (60 days), state breach laws (varies)
• Maintain external communication templates reviewed by legal counsel
• Designate a single point of communication for each incident
• Document all communications as part of incident record

RS.MI — Incident Mitigation

Key Activities:

• Execute containment actions to limit incident scope
• Eradicate threat actor presence from the environment
• Initiate recovery procedures for affected systems
• Validate containment effectiveness before declaring contained
• Monitor for threat actor re-entry during and after mitigation

Implementation Guidance:

• Pre-define containment strategies: network isolation, account disable, endpoint quarantine
• Maintain containment playbooks for ransomware, data breach, insider threat, DDoS
• Validate removal of all persistence mechanisms before recovery
• Monitor compromised accounts and systems for 90 days post-incident
• Apply lessons learned to prevent recurrence

---

6. RECOVER (RC)

The RECOVER function identifies activities to maintain resilience and restore capabilities after an incident.

RC.RP — Incident Recovery Plan Execution

Key Activities:

• Execute recovery procedures per documented plans
• Prioritize system restoration based on business criticality
• Validate system integrity before returning to production
• Restore from known-good backups after verifying backup integrity
• Conduct post-recovery validation testing

Implementation Guidance:

• Restore Tier 1 (critical) systems first, then Tier 2, Tier 3
• Verify backup integrity and absence of compromise before restore
• Rebuild from golden images rather than cleaning compromised systems
• Validate application functionality and data integrity post-recovery
• Obtain business owner sign-off before declaring recovery complete

RC.CO — Incident Recovery Communication

Key Activities:

• Communicate recovery status to internal and external stakeholders
• Manage public communications and reputation
• Provide updates to regulators on recovery progress
• Document recovery activities and timeline
• Communicate improvements made to prevent recurrence

Implementation Guidance:

• Provide regular status updates during recovery (hourly for P1, daily for P2)
• Coordinate public messaging with legal, PR, and executive leadership
• Prepare customer-facing FAQs for significant incidents
• Issue post-incident summary to all stakeholders within 30 days
• Demonstrate corrective actions taken to rebuild trust

---

CSF Profiles

Profiles enable organizations to describe their current cybersecurity posture and their target state.

Current Profile

A snapshot of how the organization currently manages cybersecurity risk, assessed against CSF categories and subcategories.

Creating a Current Profile: 1. For each CSF category, assess the current implementation level 2. Document evidence supporting the assessment 3. Identify which tier best describes current practices 4. Note dependencies and constraints

Target Profile

The desired cybersecurity state, informed by business objectives, regulatory requirements, and risk appetite.

Creating a Target Profile: 1. Review organizational context (GV.OC) — mission, obligations, risk appetite 2. Determine target tier for each category based on risk tolerance 3. Prioritize categories based on business criticality 4. Align target profile with available resources and timeline

Gap Analysis

The difference between current and target profiles drives the implementation roadmap.

Gap Analysis Process: 1. Compare current tier to target tier for each category 2. Identify categories with the largest gaps 3. Assess effort required to close each gap (people, process, technology) 4. Prioritize based on risk reduction impact and implementation feasibility 5. Create phased remediation plan with milestones

---

CSF Tiers

Tiers describe the degree to which an organization's cybersecurity risk management practices exhibit the characteristics defined in the framework.

Tier 1 — Partial

• Risk Management Process: Ad hoc, not formalized
• Integrated Risk Management: Limited awareness of cybersecurity risk at organizational level
• External Participation: No formal collaboration or information sharing
• Example: Small business with antivirus and firewall but no formal security program, no documented policies, reactive approach to incidents

Tier 2 — Risk Informed

• Risk Management Process: Risk-aware but not organization-wide policy
• Integrated Risk Management: Awareness of risk at management level, some cybersecurity investment
• External Participation: Informal information sharing
• Example: Mid-size company with documented security policies, basic vulnerability scanning, security awareness training, but inconsistent implementation across departments

Tier 3 — Repeatable

• Risk Management Process: Formal, expressed as policy, regularly updated
• Integrated Risk Management: Organization-wide risk-informed approach
• External Participation: Active participation in information sharing
• Example: Enterprise with comprehensive security program, SIEM/SOC, regular assessments, defined risk appetite, consistent policy enforcement, mature incident response

Tier 4 — Adaptive

• Risk Management Process: Continuously improved based on lessons learned and predictive indicators
• Integrated Risk Management: Cybersecurity risk management is part of organizational culture
• External Participation: Active contribution to broader cybersecurity ecosystem
• Example: Organization using threat intelligence-driven defense, continuous control validation, automated response, adaptive risk management that adjusts in real-time to changing threat landscape

---

Cross-Framework Mapping

NIST CSF 2.0 maps to multiple compliance frameworks, enabling organizations to satisfy multiple requirements simultaneously.

NIST CSF → ISO 27001:2022

NIST CSF → SOC 2 Trust Service Criteria

NIST CSF → HIPAA Security Rule

NIST CSF → PCI-DSS v4.0

---

Infrastructure Security Assessment

Assessment Across All Functions

GOVERN Assessment:

• Review governance documentation completeness
• Validate board reporting cadence and content
• Assess supply chain risk management program maturity
• Evaluate policy framework coverage and currency

IDENTIFY Assessment:

• Audit asset inventory accuracy (sample validation)
• Review risk assessment methodology and outputs
• Evaluate threat intelligence integration
• Assess improvement tracking and closure rates

PROTECT Assessment:

• Test authentication controls (MFA enforcement, password policy)
• Review access control configurations (least privilege validation)
• Assess encryption implementation (at rest, in transit, key management)
• Validate hardening baselines against benchmarks
• Test backup and recovery capabilities

DETECT Assessment:

• Validate SIEM log coverage (are all critical systems sending logs?)
• Test detection rules against MITRE ATT&CK scenarios
• Assess SOC operational maturity
• Review threat hunting program effectiveness

RESPOND Assessment:

• Review incident response plan currency and completeness
• Evaluate IR team capabilities and training
• Assess forensic readiness
• Test communication plans and notification workflows

RECOVER Assessment:

• Test disaster recovery procedures and measure RPO/RTO achievement
• Validate backup integrity through restore testing
• Assess recovery communication effectiveness
• Review post-incident improvement tracking

---

Maturity Assessment Workflow

Phase 1: Preparation (Week 1)

1. Define Scope — Identify organizational units, systems, and processes in scope 2. Gather Documentation — Collect policies, procedures, architecture diagrams, audit reports 3. Schedule Interviews — Book time with CISO, IT leadership, security team, business stakeholders 4. Review Prior Assessments — Analyze previous CSF assessments, audit findings, penetration test results

Phase 2: Assessment (Weeks 2-3)

1. Function-by-Function Evaluation — Assess each category using the csf_maturity_assessor tool 2. Evidence Collection — Gather artifacts supporting each score (screenshots, configs, reports) 3. Stakeholder Interviews — Validate documented state against operational reality 4. Technical Validation — Verify technical controls through testing (not just documentation)

Phase 3: Analysis (Week 4)

1. Score Compilation — Aggregate scores across all functions and categories 2. Gap Analysis — Compare current profile to target profile 3. Risk Prioritization — Rank gaps by risk exposure and remediation effort 4. Cross-Reference — Map findings to applicable regulatory requirements

Phase 4: Reporting and Roadmap (Week 5)

1. Executive Summary — High-level maturity scores with trend analysis 2. Detailed Findings — Category-level findings with evidence and recommendations 3. Remediation Roadmap — Phased plan with milestones, owners, and resource requirements 4. Board Presentation — Strategic summary suitable for governance bodies

---

Implementation Roadmap

Phase 1: Foundation (Months 1-3)

Focus: GOVERN + IDENTIFY

• Establish cybersecurity governance structure (GV.RR)
• Define organizational context and risk appetite (GV.OC, GV.RM)
• Develop or update cybersecurity policy framework (GV.PO)
• Conduct comprehensive asset inventory (ID.AM)
• Perform baseline risk assessment (ID.RA)

Deliverables:

• Cybersecurity charter and governance structure
• Risk appetite statement
• Policy framework
• Asset inventory
• Baseline risk register

Phase 2: Core Protections (Months 4-6)

Focus: PROTECT

• Implement identity and access management improvements (PR.AA)
• Deploy MFA organization-wide (PR.AA)
• Enhance data protection controls (PR.DS)
• Apply hardening baselines to all systems (PR.PS)
• Establish security awareness program (PR.AT)

Deliverables:

• MFA deployment complete
• PAM solution operational
• Data classification applied to critical data
• Hardened system baselines deployed
• Training program launched

Phase 3: Visibility and Response (Months 7-9)

Focus: DETECT + RESPOND

• Deploy or enhance SIEM/SOC capabilities (DE.CM)
• Develop detection rules mapped to MITRE ATT&CK (DE.AE)
• Update incident response plan and test via tabletop (RS.MA)
• Establish forensic readiness (RS.AN)
• Develop communication templates and procedures (RS.CO)

Deliverables:

• SIEM operational with critical log sources
• Detection coverage for top ATT&CK techniques
• Tested incident response plan
• Forensic toolkit and procedures
• Communication templates approved

Phase 4: Resilience and Maturity (Months 10-12)

Focus: RECOVER + Continuous Improvement

• Test and validate disaster recovery procedures (RC.RP)
• Establish recovery communication procedures (RC.CO)
• Launch supply chain risk management program (GV.SC)
• Implement continuous improvement processes (ID.IM)
• Conduct year-one maturity reassessment

Deliverables:

• DR procedures tested and validated
• C-SCRM program operational
• Improvement tracking system active
• Year-one maturity assessment complete
• Year-two roadmap drafted

---

Reference Guides

---

Validation Checkpoints

Before Starting Assessment

• [ ] Scope defined and approved by stakeholders
• [ ] Assessment team identified with appropriate expertise
• [ ] Prior assessment results and audit reports collected
• [ ] Target tier defined for each function

During Assessment

• [ ] Each category scored with supporting evidence
• [ ] Stakeholder interviews conducted and documented
• [ ] Technical controls validated (not just documented)
• [ ] Cross-framework obligations identified

After Assessment

• [ ] Gap analysis completed with prioritized recommendations
• [ ] Remediation roadmap with milestones and owners
• [ ] Executive summary prepared for governance bodies
• [ ] Reassessment timeline established

Implementation Validation

• [ ] Phase milestones achieved on schedule
• [ ] Controls tested and validated post-implementation
• [ ] Metrics established and baseline measurements taken
• [ ] Continuous monitoring operational

---

Troubleshooting

---

Success Criteria

• Current profile documented with evidence-backed scores for all 22 CSF 2.0 categories across all 6 functions
• Target profile defined with stakeholder-approved tier targets aligned to organizational risk appetite and regulatory obligations
• Gap analysis completed with each gap scored by risk exposure, remediation effort, and business impact, producing a prioritized roadmap
• GOVERN function fully implemented: cybersecurity governance charter, board reporting cadence established, CISO role defined, risk appetite documented
• Cross-framework control mapping completed for all applicable compliance obligations (ISO 27001, SOC 2, HIPAA, PCI-DSS) reducing audit duplication by 30%+
• Maturity reassessment conducted within 12 months showing measurable tier improvement in at least 75% of assessed categories
• Supply chain risk management program (GV.SC) operational with tiered supplier assessments and SBOM tracking for critical applications

---

Scope & Limitations

In Scope:

• NIST CSF 2.0 maturity assessment across all 6 functions and 22 categories
• Current and target profile creation with gap analysis
• Cross-framework control mapping to ISO 27001:2022, SOC 2 TSC, HIPAA Security Rule, and PCI-DSS v4.0
• Implementation roadmap generation with phased milestones
• Tier-based scoring (Partial, Risk Informed, Repeatable, Adaptive)

Out of Scope:

• NIST SP 800-53 control-level implementation (CSF is a framework, not a control catalog; use SP 800-53 for prescriptive controls)
• Technical security testing, vulnerability scanning, or penetration testing (use infrastructure-compliance-auditor)
• Sector-specific Community Profiles (the tool provides organizational profiles; community profiles require sector-specific customization)
• Real-time security monitoring or SIEM configuration
• Compliance certification (NIST CSF is voluntary and does not offer formal certification)
• Legal or regulatory advice on specific compliance obligations

---

Integration Points

---

Tool Reference

csf_maturity_assessor.py

Assesses cybersecurity maturity across NIST CSF 2.0 functions and generates gap analysis.

csf_control_mapper.py

Maps NIST CSF 2.0 categories to controls in other compliance frameworks.

NIST CSF 2.0 Functions, Categories, and Subcategories — Complete Reference

This reference provides the complete NIST CSF 2.0 taxonomy with implementation guidance, evidence requirements, common assessment questions, and maturity indicators for each function and category.

---

1. GOVERN (GV)

Purpose: Establish and monitor the organization's cybersecurity risk management strategy, expectations, and policy. GOVERN is the connective tissue that informs how the other five functions are implemented.

GV.OC — Organizational Context

Subcategories:

Evidence Requirements:

• Documented organizational mission and cybersecurity alignment statement
• Stakeholder register with cybersecurity interests and expectations
• Regulatory obligations matrix (GDPR, HIPAA, PCI-DSS, SOX, state laws, etc.)
• Critical business process inventory with IT dependencies
• Risk appetite and tolerance documentation approved by leadership

Assessment Questions: 1. How is the organizational mission reflected in cybersecurity investment decisions? 2. Which stakeholders have been identified as having cybersecurity interests? 3. Is there a comprehensive catalog of legal and regulatory cybersecurity obligations? 4. How frequently is the regulatory obligations register reviewed and updated? 5. Has risk appetite been formally defined and approved by executive leadership?

Maturity Indicators:

---

GV.RM — Risk Management Strategy

Subcategories:

Evidence Requirements:

• Cybersecurity risk management strategy document
• Risk appetite statement with quantitative thresholds
• Risk tolerance levels per business unit and asset class
• Risk register with treatment decisions
• Board meeting minutes showing risk posture discussions
• Integration evidence with enterprise risk management

Assessment Questions: 1. Is there a formal cybersecurity risk management strategy approved by leadership? 2. Are risk appetite and tolerance quantitatively defined? 3. How is cybersecurity risk integrated with enterprise risk management? 4. How frequently is the risk strategy reviewed and updated? 5. Do investment decisions reference the risk management strategy?

---

GV.RR — Roles, Responsibilities, and Authorities

Subcategories:

Evidence Requirements:

• CISO job description and organizational chart showing reporting line
• RACI matrix for cybersecurity functions
• Cybersecurity steering committee charter and meeting minutes
• Budget allocation documents showing cybersecurity investment
• HR policies including cybersecurity responsibilities
• Performance review templates with cybersecurity objectives

Assessment Questions: 1. To whom does the CISO report (CEO, CIO, board)? 2. Is there a cybersecurity steering committee with cross-functional representation? 3. Are cybersecurity responsibilities included in all relevant job descriptions? 4. Is cybersecurity performance tracked in executive reviews? 5. Are resources (budget, staff) aligned with identified risk levels?

---

GV.PO — Policy

Subcategories:

Evidence Requirements:

• Cybersecurity policy document(s) approved by leadership
• Policy hierarchy: Policy > Standards > Procedures > Guidelines
• Policy review schedule and revision history
• Policy distribution and acknowledgment records
• Policy exception management process and log
• Evidence of policy enforcement (disciplinary actions, technical controls)

Assessment Questions: 1. Does the cybersecurity policy framework cover all CSF functions? 2. When were policies last reviewed and updated? 3. How are policies communicated to all personnel and third parties? 4. Is there a formal exception management process? 5. How is policy compliance measured and enforced?

---

GV.OV — Oversight

Subcategories:

Evidence Requirements:

• Board reporting packages with cybersecurity metrics
• KPI/KRI dashboards and trend analysis
• Management review meeting minutes
• Program maturity assessment results
• Remediation tracking for identified deficiencies
• Budget vs actual cybersecurity spending analysis

Assessment Questions: 1. How frequently does the board receive cybersecurity risk reports? 2. What KPIs and KRIs are tracked for the cybersecurity program? 3. How are assessment findings tracked to resolution? 4. Is cybersecurity performance benchmarked against peers or standards? 5. How does performance data influence strategy adjustments?

---

GV.SC — Cybersecurity Supply Chain Risk Management

Subcategories:

Evidence Requirements:

• C-SCRM policy and procedures
• Supplier tiering methodology and results
• Contracts with cybersecurity requirements (right-to-audit, breach notification, security standards)
• Supplier security assessments (questionnaires, SOC 2 reports, penetration test results)
• SBOM requirements and inventory for critical software
• Supplier incident notification procedures
• Supplier monitoring dashboards or reports

Assessment Questions: 1. Is there a formal supplier risk management program covering cybersecurity? 2. How are suppliers tiered by criticality and data access? 3. Do contracts include specific cybersecurity requirements? 4. How frequently are critical suppliers assessed? 5. Is there a process for managing security risks when supplier relationships end?

---

2. IDENTIFY (ID)

Purpose: Develop organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.

ID.AM — Asset Management

Subcategories:

Evidence Requirements:

• Hardware asset inventory (CMDB) with owner, location, criticality
• Software inventory with version, license, end-of-life dates
• Network architecture diagrams with data flows
• Data inventory with classification labels
• Shadow IT discovery scan results
• Asset lifecycle management records

Assessment Questions: 1. Is there an automated asset discovery process? 2. How frequently is the asset inventory reconciled? 3. Are all assets classified by criticality and data sensitivity? 4. Are data flows mapped between systems and external parties? 5. Is shadow IT actively discovered and managed?

---

ID.RA — Risk Assessment

Subcategories:

Evidence Requirements:

• Vulnerability scan reports (internal and external)
• Threat intelligence subscription records and integration evidence
• Risk register with likelihood, impact, and treatment decisions
• Risk assessment methodology documentation
• Penetration test results
• Change management records with risk assessment

Assessment Questions: 1. What risk assessment methodology is used? 2. How are vulnerability scan results integrated into risk assessment? 3. What threat intelligence sources are consumed? 4. How frequently are risk assessments conducted for critical systems? 5. Is there a formal risk treatment decision process?

---

ID.IM — Improvement

Subcategories:

Evidence Requirements:

• Post-incident review reports with improvement actions
• Exercise after-action reports
• Improvement action tracker with status
• Program maturity trend data
• Benchmarking results

---

3. PROTECT (PR)

Purpose: Implement appropriate safeguards to ensure delivery of critical services.

PR.AA — Identity Management, Authentication, and Access Control

Subcategories:

Evidence Requirements:

• Identity governance platform configuration
• MFA enrollment statistics (percent of users with FIDO2, authenticator app, SMS)
• PAM solution configuration and session logs
• Access review records and recertification evidence
• Zero trust architecture documentation
• Physical access control system logs

---

PR.AT — Awareness and Training

Subcategories:

Evidence Requirements:

• Training completion records
• Phishing simulation results and trend data
• Role-based training curriculum documentation
• Developer secure coding training completion
• Training effectiveness assessments

---

PR.DS — Data Security

Subcategories:

Evidence Requirements:

• Encryption configurations for databases, file systems, backups
• TLS configurations for all data in transit
• DLP policy configurations and incident reports
• Data classification taxonomy and labeling rules
• Key management procedures and rotation evidence
• Backup integrity test results

---

PR.PS — Platform Security

Subcategories:

Evidence Requirements:

• CIS Benchmark compliance scan results
• Patch management reports with SLA compliance
• Configuration management tool deployment evidence
• Golden image documentation and update process
• Application allowlisting configuration
• SDLC documentation with security gates

---

PR.IR — Technology Infrastructure Resilience

Subcategories:

Evidence Requirements:

• Architecture diagrams showing redundancy
• RPO/RTO documentation per system tier
• Failover test results and metrics
• Capacity monitoring dashboards and alert configurations
• DR test results and lessons learned
• Backup restoration test records

---

4. DETECT (DE)

Purpose: Identify the occurrence of cybersecurity events in a timely manner.

DE.CM — Continuous Monitoring

Subcategories:

Evidence Requirements:

• SIEM deployment scope and log source inventory
• IDS/IPS deployment and tuning records
• EDR/XDR deployment coverage statistics
• Network monitoring tool configurations
• SOC operational documentation (playbooks, escalation procedures)
• UEBA deployment and baseline documentation

---

DE.AE — Adverse Event Analysis

Subcategories:

Evidence Requirements:

• MITRE ATT&CK detection coverage matrix
• Threat hunting reports and outcomes
• SOAR playbook documentation
• Detection efficacy metrics (true positive rate, MTTD)
• Alert triage SOP
• Correlation rule documentation

---

5. RESPOND (RS)

Purpose: Take action regarding detected cybersecurity incidents to contain impact.

RS.MA — Incident Management

Evidence Requirements:

• Incident response plan (annually tested)
• Incident classification and severity matrix
• Escalation procedures and contact lists
• Tabletop exercise and simulation reports
• On-call rotation schedules
• Incident management tool configuration

RS.AN — Incident Analysis

Evidence Requirements:

• Forensic toolkit inventory and maintenance records
• Evidence handling and chain of custody procedures
• Root cause analysis reports
• Forensic analyst training certifications
• External forensic retainer agreements

RS.CO — Incident Response Reporting and Communication

Evidence Requirements:

• Communication plan templates (internal, regulatory, public, affected parties)
• Regulatory notification timeline reference
• Legal counsel review of notification templates
• Communication log from past incidents
• Media spokesperson designation

RS.MI — Incident Mitigation

Evidence Requirements:

• Containment playbooks per incident type (ransomware, breach, insider, DDoS)
• Containment action documentation
• Eradication verification procedures
• Post-containment monitoring procedures
• Recovery initiation criteria

---

6. RECOVER (RC)

Purpose: Maintain plans for resilience and restore capabilities impaired during cybersecurity incidents.

RC.RP — Incident Recovery Plan Execution

Evidence Requirements:

• Recovery prioritization matrix by system tier
• Backup verification and restore test results
• Golden image library for system rebuild
• Post-recovery validation checklists
• Business owner sign-off procedures

RC.CO — Incident Recovery Communication

Evidence Requirements:

• Recovery status communication templates
• Customer FAQ templates for significant incidents
• Post-incident summary report template
• Stakeholder communication logs from past recoveries
• Corrective action communication records

NIST CSF 2.0 Implementation Playbook

Step-by-step implementation guide for organizations adopting NIST CSF 2.0, including profile creation, gap analysis, prioritization, cross-framework mapping, and resource planning.

---

Table of Contents

• Pre-Implementation Readiness
• Step 1: Scope and Prioritize
• Step 2: Create Current Profile
• Step 3: Define Target Profile
• Step 4: Gap Analysis
• Step 5: Remediation Roadmap
• Step 6: Implementation Execution
• Step 7: Continuous Monitoring and Improvement
• Cross-Framework Mapping Tables
• Resource and Budget Planning
• Templates

---

Pre-Implementation Readiness

Executive Sponsorship

Before starting, secure executive sponsorship (CEO, CTO, or board member). Without visible leadership support, CSF implementation efforts stall at the policy stage.

Actions:

• Present business case for CSF 2.0 adoption to executive leadership
• Quantify risk exposure using breach cost data (IBM Cost of a Data Breach report benchmarks)
• Identify regulatory drivers (contractual requirements, insurance mandates, customer expectations)
• Secure budget commitment for assessment phase at minimum

Team Composition

Document Collection Checklist

Gather before starting the assessment:

• [ ] Current cybersecurity policies and standards
• [ ] Network architecture diagrams
• [ ] Asset inventory (CMDB or equivalent)
• [ ] Previous audit and assessment reports
• [ ] Risk register (if exists)
• [ ] Incident response plan
• [ ] Business continuity and disaster recovery plans
• [ ] Vendor/supplier inventory
• [ ] Regulatory compliance obligations list
• [ ] Organizational chart with security roles highlighted
• [ ] Current security tool inventory
• [ ] Training program documentation
• [ ] Board reporting materials related to cybersecurity

---

Step 1: Scope and Prioritize

Define Organizational Scope

Determine which parts of the organization are in scope for initial CSF implementation:

Option A — Enterprise-wide: All business units, systems, and processes. Recommended for organizations under regulatory mandate or those pursuing comprehensive program improvement.

Option B — Business unit or system-specific: Focus on a critical business unit, product line, or system. Recommended for initial adoption to demonstrate value before expanding.

Option C — Regulatory-driven scope: Scope matches a specific regulatory requirement (e.g., systems processing healthcare data for HIPAA, cardholder data for PCI-DSS). Pragmatic when regulatory compliance is the primary driver.

Prioritize Functions

While all six functions are important, organizations should prioritize based on their current state:

---

Step 2: Create Current Profile

Assessment Methodology

For each CSF category, assess using a combination of:

1. Documentation Review — Do policies, procedures, and standards exist? 2. Stakeholder Interviews — Are processes understood and followed? 3. Technical Validation — Are controls implemented and effective? 4. Evidence Collection — Can implementation be demonstrated?

Scoring Rubric

Assessment Approach per Function

GOVERN Assessment:

• Review governance documentation (charter, policies, risk strategy)
• Interview CISO, CTO, board members about cybersecurity governance
• Validate board reporting cadence and content quality
• Assess supply chain risk management program maturity
• Score: Documentation quality + consistency of execution + leadership engagement

IDENTIFY Assessment:

• Audit asset inventory accuracy through sampling
• Review risk assessment methodology and recent outputs
• Evaluate threat intelligence integration
• Validate improvement tracking and action closure rates
• Score: Completeness of inventory + risk assessment rigor + improvement velocity

PROTECT Assessment:

• Test MFA enforcement (try to access systems without MFA)
• Review access control configurations on critical systems
• Validate encryption for data at rest and in transit
• Run hardening compliance scans against CIS Benchmarks
• Test backup restoration capability
• Score: Technical control effectiveness + coverage + maintenance discipline

DETECT Assessment:

• Verify SIEM log source coverage against asset inventory
• Review detection rule coverage against MITRE ATT&CK
• Assess SOC operational maturity (staffing, playbooks, escalation)
• Evaluate threat hunting program
• Score: Detection coverage + response timeliness + analytical capability

RESPOND Assessment:

• Review incident response plan currency
• Evaluate tabletop exercise results
• Assess forensic readiness (tools, trained staff, procedures)
• Test communication procedures
• Score: Plan quality + team capability + exercise results

RECOVER Assessment:

• Test disaster recovery procedures and measure RPO/RTO
• Validate backup integrity through restoration tests
• Assess recovery communication effectiveness
• Review post-incident improvement follow-through
• Score: DR test results + backup reliability + communication readiness

---

Step 3: Define Target Profile

Target Tier Selection

Select target tiers based on organizational risk appetite, regulatory requirements, and available resources:

Tier 3 (Repeatable) is the standard target for most organizations. It represents a mature, documented, and consistently executed program.

Tier 4 (Adaptive) is appropriate for organizations in high-risk sectors (financial services, critical infrastructure, healthcare) or those with significant threat exposure.

Target Profile Development Process

1. Identify Regulatory Minimums — Some regulations effectively mandate certain tier levels:

• PCI-DSS mandates Tier 3+ for cardholder data environments
• HIPAA requires at least Tier 2+ with specific technical controls
• SOX cybersecurity controls typically need Tier 3+
• NIST 800-171 (CMMC) maps closely to Tier 3

2. Assess Business Risk — Higher business impact systems need higher tiers:

• Revenue-critical systems: Tier 3-4
• Customer-facing systems: Tier 3-4
• Internal support systems: Tier 2-3
• Development/test environments: Tier 2

3. Consider Industry Benchmarks — Use industry averages as a reference point:

• Financial services: Average Tier 3, leaders at Tier 4
• Healthcare: Average Tier 2, leaders at Tier 3
• Manufacturing: Average Tier 2, leaders at Tier 3
• Technology: Average Tier 3, leaders at Tier 4

4. Resource Constraints — Be realistic about achievable improvements:

• Moving one tier typically takes 12-18 months per category
• Budget for technology, staffing, and consulting support
• Account for organizational change management

---

Step 4: Gap Analysis

Gap Identification

For each category, calculate the gap between current and target:

Gap = Target Tier - Current Tier

Gap Classification

Gap Prioritization Framework

Prioritize gaps using a weighted scoring model:

Prioritization Score = Σ(Factor Score × Weight)

Using the Assessment Tool

# Generate gap analysis
python scripts/csf_maturity_assessor.py \
  --input current_assessment.json \
  --target-tier 3 \
  --format markdown \
  --output gap_analysis.md

# Map gaps to other framework requirements
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework all \
  --format markdown \
  --output unified_matrix.md

---

Step 5: Remediation Roadmap

Phased Approach

Phase 1: Quick Wins and Critical Gaps (Months 1-3)

• Enable MFA for all users (PR.AA)
• Deploy or tune SIEM for critical log sources (DE.CM)
• Document incident response plan (RS.MA)
• Establish asset inventory baseline (ID.AM)
• Create cybersecurity policy framework (GV.PO)

Phase 2: Foundation Building (Months 4-6)

• Implement PAM for privileged accounts (PR.AA)
• Deploy data loss prevention for critical data (PR.DS)
• Establish risk management strategy (GV.RM)
• Conduct comprehensive risk assessment (ID.RA)
• Launch security awareness program (PR.AT)

Phase 3: Program Maturation (Months 7-9)

• Implement zero trust architecture principles (PR.AA)
• Deploy EDR/XDR across all endpoints (DE.CM)
• Establish threat hunting program (DE.AE)
• Test incident response via tabletop exercises (RS.MA)
• Apply hardening baselines across all systems (PR.PS)

Phase 4: Optimization and Resilience (Months 10-12)

• Implement supply chain risk management (GV.SC)
• Test and validate disaster recovery (RC.RP)
• Establish continuous improvement processes (ID.IM)
• Deploy SOAR for automated response (RS.MI)
• Conduct full maturity reassessment

Roadmap Template

---

Step 6: Implementation Execution

Implementation Best Practices

1. Start with governance — Without governance (GOVERN), technical controls lack strategic direction 2. Build from identify — You cannot protect what you have not identified 3. Layer defenses — Implement PROTECT, then DETECT, then RESPOND, then RECOVER 4. Test continuously — Validate controls through exercises and assessments 5. Measure progress — Track maturity scores monthly during active implementation

Common Implementation Pitfalls

Control Implementation Pattern

For each control being implemented:

1. Document — Write the policy/standard/procedure 2. Implement — Deploy the technical or administrative control 3. Test — Validate the control works as intended 4. Evidence — Capture proof of implementation for auditors 5. Monitor — Establish ongoing monitoring for the control 6. Review — Schedule periodic review of control effectiveness

---

Step 7: Continuous Monitoring and Improvement

Ongoing Assessment Cadence

Metrics Dashboard

Track these metrics quarterly:

GOVERN Metrics:

• Policy coverage (% of CSF categories with approved policies)
• Board reporting frequency and metrics completeness
• Supplier assessment coverage (% of critical suppliers assessed)

IDENTIFY Metrics:

• Asset inventory accuracy (validated through sampling)
• Risk assessment currency (% of critical systems with current risk assessment)
• Improvement action closure rate

PROTECT Metrics:

• MFA adoption rate (% of users with MFA enabled)
• Privileged access review completion rate
• Patch SLA compliance (% patched within SLA by severity)
• Training completion rate
• Data classification coverage

DETECT Metrics:

• SIEM log source coverage (% of critical systems sending logs)
• Mean Time to Detect (MTTD)
• Detection true positive rate
• MITRE ATT&CK detection coverage (% of techniques with rules)

RESPOND Metrics:

• Mean Time to Respond (MTTR)
• Incident containment success rate
• Tabletop exercise completion rate
• Regulatory notification compliance rate

RECOVER Metrics:

• RPO/RTO achievement rate (actual vs target)
• Backup restoration success rate
• Post-incident improvement implementation rate

---

Cross-Framework Mapping Tables

NIST CSF 2.0 → ISO 27001:2022 Detailed Mapping

NIST CSF 2.0 → SOC 2 TSC Detailed Mapping

NIST CSF 2.0 → HIPAA Security Rule Detailed Mapping

NIST CSF 2.0 → PCI-DSS v4.0 Detailed Mapping

---

Resource and Budget Planning

Estimated Investment by Organization Size

Technology Investment Priorities

Phase 1 (Highest ROI):

• MFA/SSO platform — Addresses PR.AA, most common attack vector
• SIEM or managed SIEM — Enables DE.CM, foundational for detection
• Vulnerability scanner — Supports ID.RA, PR.PS

Phase 2 (Strong ROI):

• PAM solution — Addresses PR.AA for privileged accounts
• EDR/XDR — Enhances DE.CM endpoint visibility
• DLP — Supports PR.DS data protection

Phase 3 (Program Maturation):

• SOAR — Automates RS.MA, RS.MI response activities
• GRC platform — Supports GV.OV, GV.PO governance and compliance
• Threat intelligence platform — Enhances DE.AE, ID.RA

Phase 4 (Advanced Capabilities):

• UEBA — Advanced DE.AE behavioral analytics
• SBOM management — Supports GV.SC supply chain
• Zero trust platform — Advanced PR.AA architecture

Staffing Model

Minimum viable security team (small organization):

• CISO (fractional or part-time)
• Security Engineer (1 FTE)
• Security Analyst/SOC (1 FTE, or managed SOC)

Mature security team (mid-size):

• CISO (1 FTE)
• Security Architects (2 FTE)
• Security Engineers (2-3 FTE)
• SOC Analysts (3-5 FTE, or hybrid with managed SOC)
• GRC/Compliance Analyst (1-2 FTE)
• Risk Analyst (1 FTE)

---

Templates

Assessment Input Template

{
  "organization": "Your Organization Name",
  "assessment_date": "YYYY-MM-DD",
  "assessor": "Assessment Team Lead Name",
  "functions": {
    "GOVERN": {
      "GV.OC": { "score": 0, "evidence": "", "notes": "" },
      "GV.RM": { "score": 0, "evidence": "", "notes": "" },
      "GV.RR": { "score": 0, "evidence": "", "notes": "" },
      "GV.PO": { "score": 0, "evidence": "", "notes": "" },
      "GV.OV": { "score": 0, "evidence": "", "notes": "" },
      "GV.SC": { "score": 0, "evidence": "", "notes": "" }
    },
    "IDENTIFY": {
      "ID.AM": { "score": 0, "evidence": "", "notes": "" },
      "ID.RA": { "score": 0, "evidence": "", "notes": "" },
      "ID.IM": { "score": 0, "evidence": "", "notes": "" }
    },
    "PROTECT": {
      "PR.AA": { "score": 0, "evidence": "", "notes": "" },
      "PR.AT": { "score": 0, "evidence": "", "notes": "" },
      "PR.DS": { "score": 0, "evidence": "", "notes": "" },
      "PR.PS": { "score": 0, "evidence": "", "notes": "" },
      "PR.IR": { "score": 0, "evidence": "", "notes": "" }
    },
    "DETECT": {
      "DE.CM": { "score": 0, "evidence": "", "notes": "" },
      "DE.AE": { "score": 0, "evidence": "", "notes": "" }
    },
    "RESPOND": {
      "RS.MA": { "score": 0, "evidence": "", "notes": "" },
      "RS.AN": { "score": 0, "evidence": "", "notes": "" },
      "RS.CO": { "score": 0, "evidence": "", "notes": "" },
      "RS.MI": { "score": 0, "evidence": "", "notes": "" }
    },
    "RECOVER": {
      "RC.RP": { "score": 0, "evidence": "", "notes": "" },
      "RC.CO": { "score": 0, "evidence": "", "notes": "" }
    }
  }
}

Executive Summary Template

NIST CSF 2.0 Maturity Assessment — Executive Summary
Organization: [Name]
Date: [Date]
Assessor: [Name]

OVERALL MATURITY: [Score] / 4.0 ([Tier Name])
TARGET: [Target Score] / 4.0 ([Target Tier Name])

FUNCTION SCORES:
  GOVERN:   [Score] / 4.0  [▓▓▓░░░░░]
  IDENTIFY: [Score] / 4.0  [▓▓▓▓░░░░]
  PROTECT:  [Score] / 4.0  [▓▓░░░░░░]
  DETECT:   [Score] / 4.0  [▓▓▓░░░░░]
  RESPOND:  [Score] / 4.0  [▓▓░░░░░░]
  RECOVER:  [Score] / 4.0  [▓░░░░░░░]

TOP GAPS:
  1. [Category] — Gap: [X] tiers, Priority: [CRITICAL/HIGH]
  2. [Category] — Gap: [X] tiers, Priority: [CRITICAL/HIGH]
  3. [Category] — Gap: [X] tiers, Priority: [HIGH]

RECOMMENDED NEXT STEPS:
  Phase 1 (Months 1-3): [Summary]
  Phase 2 (Months 4-6): [Summary]
  Phase 3 (Months 7-12): [Summary]

ESTIMATED INVESTMENT: $[Amount] over 12 months
RISK REDUCTION: [Estimated] critical/high gaps closed