GV.OC Organizational context
Organizational Context: the mission, stakeholder expectations, dependencies and legal, regulatory and contractual requirements that frame cybersecurity risk decisions; five Subcategories.
NIST CSF 2.0
NIST Cybersecurity Framework 2.0: the 22 Categories and 106 Subcategories of the CSF Core across Govern, Identify, Protect, Detect, Respond and Recover, plus guides on assessment, profiles, tiers and adoption.
GV.RM Risk management strategy
Risk Management Strategy: objectives, risk appetite and tolerance, ERM integration, response options, communication lines, a standard risk method and positive risks; seven Subcategories.
GV.RR Roles, responsibilities and authorities
Roles, Responsibilities, and Authorities: leadership accountability, defined cybersecurity roles, adequate resources and cybersecurity in HR practices; four Subcategories.
GV.PO Policy
Policy: establishing the cybersecurity risk management policy and keeping it reviewed and updated; two Subcategories.
GV.OV Oversight
Oversight: reviewing strategy outcomes, strategy coverage and risk management performance so leaders can adjust direction; three Subcategories, all new in CSF 2.0.
GV.SC Cybersecurity supply chain risk management
Cybersecurity Supply Chain Risk Management: the C-SCRM program, roles, integration, supplier prioritization, contracts, due diligence, monitoring, incidents, life cycle and offboarding; ten Subcategories.
ID.AM Asset management
Asset Management: inventories of hardware, software, services, supplier services and data, network and data flow maps, prioritization and life cycle management; seven Subcategories.
ID.RA Risk assessment
Risk Assessment: vulnerabilities, threat intelligence, threats, likelihood and impact, inherent risk, risk response, change and exception management, vulnerability disclosure, authenticity checks and supplier assessment; ten Subcategories.
ID.IM Improvement
Improvement: identifying improvements from evaluations, tests and exercises and day-to-day operations, and maintaining incident response and other operational plans; four Subcategories.
PR.AA Identity management, authentication and access control
Identity Management, Authentication, and Access Control: identities and credentials, identity proofing, authentication, identity assertions, access permissions and physical access; six Subcategories.
PR.AT Awareness and training
Awareness and Training: general awareness for all personnel and role-based training for specialized roles; two Subcategories.
PR.DS Data security
Data Security: protecting data at rest, in transit and in use, and backups; four Subcategories (PR.DS-01, PR.DS-02, PR.DS-10 and PR.DS-11).
PR.PS Platform security
Platform Security: configuration management, software and hardware maintenance, log generation, preventing unauthorized software and secure software development; six Subcategories.
PR.IR Technology infrastructure resilience
Technology Infrastructure Resilience: network protection and segmentation, environmental threats, resilience mechanisms and capacity; four Subcategories.
DE.CM Continuous monitoring
Continuous Monitoring: monitoring networks, the physical environment, personnel activity, external service providers and computing and runtime environments; five Subcategories.
DE.AE Adverse event analysis
Adverse Event Analysis: analyzing and correlating events, estimating impact, distributing event information, integrating threat intelligence and declaring incidents; six Subcategories.
RS.MA Incident management
Incident Management: executing the response plan, triage, categorization and prioritization, escalation and recovery initiation; five Subcategories.
RS.AN Incident analysis
Incident Analysis: root cause analysis, recording investigation actions, preserving incident data and estimating incident magnitude; four Subcategories.
RS.CO Incident response reporting and communication
Incident Response Reporting and Communication: notifying stakeholders and sharing incident information; two Subcategories.
RS.MI Incident mitigation
Incident Mitigation: containing and eradicating incidents; two Subcategories.
RC.RP Incident recovery plan execution
Incident Recovery Plan Execution: running the recovery plan, prioritizing actions, verifying backups and restored assets, setting post-incident norms and declaring recovery complete; six Subcategories.
RC.CO Incident recovery communication
Incident Recovery Communication: communicating recovery progress to stakeholders and sharing public updates; two Subcategories.
NIST CSF functions explained
The six CSF 2.0 Functions one by one: what Govern, Identify, Protect, Detect, Respond and Recover cover, their Categories and outcome counts, what changed from CSF 1.1, and the first actions NIST suggests for each.
NIST CSF assessment and gap analysis
Measuring a program against NIST CSF 2.0: running a gap analysis between Current and Target Profiles, self-assessment tools, scoring and Tiers, independent assessments, metrics, and moving a CSF 1.1 assessment to 2.0.
NIST CSF governance and risk reporting
Using NIST CSF 2.0 at the leadership level: reporting to the board, integrating with enterprise risk management, running a cybersecurity risk register, writing the policies Govern expects, and planning cybersecurity roles and workforce.
NIST CSF by industry
How NIST CSF 2.0 is used where regulators and sector bodies build on it: healthcare under HIPAA's recognized security practices, banks after the FFIEC CAT, manufacturing and OT, federal agencies and critical infrastructure.
NIST CSF Community Profiles
Ready-made CSF 2.0 baselines for specific threats and technologies: the ransomware and incident response profiles, the draft Cyber AI Profile, and how organizations build or adopt a Community Profile as their target.
NIST CSF supply chain and vendors
NIST CSF 2.0 between customers and suppliers: setting supplier requirements, assessing vendor risk, showing your own alignment to a customer, using cloud services, and working with MSPs and MSSPs.
NIST CSF tools and mappings
The tooling side of NIST CSF 2.0: open-source tools that deliver and evidence CSF outcomes, self-hosted GRC software, NIST's informative references and Reference Tool, and the mapping to CIS Controls.
NIST CSF guides
Buyer guides for organizations asked to adopt or show alignment with NIST CSF 2.0: assessment and the absence of certification, profiles and tiers, implementation roadmap, staffing choices, comparison with ISO 27001, changes from CSF 1.1 and small businesses.
