Csf Mapping

CSF Mapping — NIST Cybersecurity Framework 2.0 Posture Assessment

Translate your security posture into the language every CISO, board, auditor, and insurer already speaks. Distinct from the audit skills (which find specific issues); this skill assesses your program against a recognized framework and produces governance-ready output.

NIST CSF 2.0 is the framework that, as of 2024, replaced CSF 1.1. It added a sixth function — Govern — recognizing that the others can't work without governance backing.

The six functions:

Each function contains Categories (e.g., PR.AA — Identity Management, Authentication, and Access Control), and each category contains Subcategories (e.g., PR.AA-01 — Identities and credentials for authorized users, services, and hardware are managed).

This skill maps your reality to those Subcategories.

Cross-references: every audit skill in this repo (they produce evidence that becomes the "current state" entries here), iam-audit (most of PR.AA), siem-detection (most of DE), incident-triage (most of RS), threat-modeling (informs ID.RA risk assessment), breach-patterns (informs ID.IM improvements from lessons learned).

Methodology

Step 1 — Establish scope

CSF assessments are scope-bounded. Decide which of these you're assessing:

• Whole organization — every system, every business unit
• One product / service — for vendor due-diligence questionnaires (SIG, CAIQ)
• One environment — production cloud only, or PCI-in-scope only
• Regulatory scope — HIPAA-covered systems, FedRAMP boundary, etc.

Write down what's in and what's out. Most CSF assessments fail at scope drift.

Step 2 — Choose your CSF profile

CSF 2.0 introduced Organizational Profiles — instead of "score every Subcategory equally," you tailor based on what matters.

• Current Profile — where you actually are
• Target Profile — where you want to be (informed by business goals, regulatory requirements, risk appetite)
• Community Profile — pre-built profile for your sector (manufacturing, healthcare, financial services — published by NIST and others)

For a first-pass assessment, start with a Community Profile if one exists for your sector, then tailor.

Step 3 — Assess each Subcategory

For each Subcategory in scope:

CSF Implementation Tiers

Tier 4 is rare and expensive. Most mature SaaS orgs target Tier 3 across most subcategories. Set targets based on what the business actually needs, not what looks good.

Step 4 — Identify gaps and prioritize

For each gap, ask:

• Impact if exploited / not addressed (regulatory, reputational, financial)
• Likelihood given current threat landscape and your specific exposure
• Cost to close (engineering hours, tooling, headcount)
• Dependencies on other gaps closing first

Prioritize by Risk × Cost-to-close — not just by risk. Some critical-risk items take a year and three vendors; some quick wins reduce real risk in a sprint.

Step 5 — Build the roadmap

CSF roadmaps usually run in quarters with annual targets. A useful structure:

• Next 30 days — immediate gaps (quick wins, low-cost high-risk items)
• Next 90 days — medium effort, named owners, defined success criteria
• Next 12 months — strategic gaps requiring budget approval, tooling decisions, headcount
• Annual review — full reassessment; profile refresh; tier movement

Each item on the roadmap names: the Subcategory it closes, the owner, the budget, the success metric, the review date.

Subcategory cross-references to skills in this repo

A useful shortcut — these are the audit skills that produce evidence for which CSF Subcategories.

For Subcategories without direct skill coverage, the gap is usually "we have technical depth but not the program-level artifact." E.g., RC.RP-01 (Recovery plan is executed during or after an incident) needs an actual documented and tested BCP/DR plan — running incident-triage doesn't automatically produce one.