Agent skill

Performing Nist Csf Maturity Assessment

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the…

Apache-2.0Auto-check passedSecurity

Install Performing Nist Csf Maturity Assessment

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-nist-csf-maturity-assessment -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills performing-nist-csf-maturity-assessment --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/performing-nist-csf-maturity-assessment .claude/skills/performing-nist-csf-maturity-assessment && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
performing-nist-csf-maturity-assessment
GitHub stars
34k
Token cost
~1.5k tokens
SKILL.md length
612 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the…

  • Works in 5 steps: Scoping and Preparation (Weeks 1-2) → Current State Assessment (Weeks 3-6) → Target State Definition (Weeks 7-8) → …
  • Benchmarking an organizations cybersecurity program maturity
  • SKILL.md covers Overview, When to Use, Prerequisites and Core Concepts, plus 4 more sections
  • Runs Python scripts from its folder

What it does

Performing Nist Csf Maturity Assessment is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) and producing an improvement roadmap. Use when benchmarking an organization's cybersecurity program maturity or preparing a CSF-based gap analysis and remediation plan.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Benchmarking an organizations cybersecurity program maturity
  • Preparing a CSF-based gap analysis and remediation plan

Example prompts

  • “/performing-nist-csf-maturity-assessment”

Requirements

  • Python 3

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Scoping and Preparation (Weeks 1-2)
  2. Current State Assessment (Weeks 3-6)
  3. Target State Definition (Weeks 7-8)
  4. Gap Analysis and Roadmap (Weeks 9-12)
  5. Implementation and Reassessment (Ongoing)

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • csf.tools
    • csrc.nist.gov

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Performing Nist Csf Maturity Assessment loads about 1.5k tokens when it runs, and up to ~3.7k if it reads all its reference files. Until then it costs about 120 tokens; SKILL.md has 612 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~120
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 612 words, ~1,494 tokens.

Download SKILL.mdSave it as .claude/skills/performing-nist-csf-maturity-assessment/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
performing-nist-csf-maturity-assessment
description
Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) and producing an improvement roadmap. Use when benchmarking an organization's cybersecurity program maturity or preparing a CSF-based gap analysis and remediation plan.
domain
cybersecurity
subdomain
compliance-governance
tags
compliance, governance, nist, csf, maturity-assessment, risk-management
nist_csf
GV.OC-01, GV.RM-01, GV.PO-01, ID.RA-01, GV.OV-01
version
1.0
author
mahipal
license
Apache-2.0
mitre_attack
T1078, T1530, T1685.002

Performing NIST CSF Maturity Assessment

Overview

The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, provides a comprehensive taxonomy for managing cybersecurity risk through six core Functions: Govern, Identify, Protect, Detect, Respond, and Recover. This skill covers conducting a maturity assessment against the CSF, using the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) to measure organizational cybersecurity posture and create improvement roadmaps.

When to Use

  • When conducting security assessments that involve performing nist csf maturity assessment
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Understanding of cybersecurity risk management principles
  • Access to NIST CSF 2.0 documentation and reference tool
  • Knowledge of organizational IT/OT environment and security controls
  • Stakeholder access across business units for assessment interviews

Core Concepts

CSF 2.0 Functions (6 Functions, 22 Categories)
FunctionCodeCategoriesPurpose
GovernGV6Establish and monitor cybersecurity risk management strategy
IdentifyID3Determine current cybersecurity risk to the organization
ProtectPR5Implement safeguards to prevent or reduce risk
DetectDE2Find and analyze possible cybersecurity attacks
RespondRS4Take action regarding detected cybersecurity incidents
RecoverRC2Restore capabilities impaired by cybersecurity incidents
Govern Function (New in CSF 2.0)
  • GV.OC: Organizational Context
  • GV.RM: Risk Management Strategy
  • GV.RR: Roles, Responsibilities, and Authorities
  • GV.PO: Policy
  • GV.OV: Oversight
  • GV.SC: Cybersecurity Supply Chain Risk Management
Implementation Tiers
TierNameDescription
Tier 1PartialAd hoc, reactive; limited awareness of cybersecurity risk
Tier 2Risk-InformedRisk-aware but not organization-wide; approved but may not be policy
Tier 3RepeatableFormal policies; consistently implemented; regularly updated
Tier 4AdaptiveContinuous improvement; real-time risk response; lessons learned integrated

Workflow

Phase 1: Scoping and Preparation (Weeks 1-2)
  1. Define assessment scope (enterprise-wide vs. business unit)
  2. Identify stakeholders and schedule interviews
  3. Gather existing documentation (policies, procedures, architecture diagrams)
  4. Customize CSF Profile for organizational context
  5. Select assessment methodology (self-assessment, facilitated, third-party)
Phase 2: Current State Assessment (Weeks 3-6)
  1. Assess each CSF Category and Subcategory against Implementation Tiers
  2. For each subcategory, evaluate:
    • Policy/documentation maturity
    • Implementation completeness
    • Automation level
    • Measurement and metrics
    • Continuous improvement evidence
  3. Score using tier criteria (1-4 scale)
  4. Document evidence supporting each tier rating
  5. Identify strengths, gaps, and improvement areas
Show full SKILL.md (233 more words)Show less
Phase 3: Target State Definition (Weeks 7-8)
  1. Define target tier for each Function based on:
    • Risk appetite and tolerance
    • Industry requirements and benchmarks
    • Regulatory obligations
    • Available resources and budget
  2. Create Target Profile documenting desired maturity state
  3. Validate target state with executive leadership
Phase 4: Gap Analysis and Roadmap (Weeks 9-12)
  1. Compare Current Profile to Target Profile
  2. Prioritize gaps based on risk reduction potential
  3. Develop improvement roadmap with:
    • Short-term quick wins (0-3 months)
    • Medium-term improvements (3-12 months)
    • Long-term strategic initiatives (12-24 months)
  4. Estimate resource requirements for each initiative
  5. Assign ownership and timelines
Phase 5: Implementation and Reassessment (Ongoing)
  1. Execute improvement roadmap initiatives
  2. Track progress against milestones
  3. Conduct periodic reassessments (annually recommended)
  4. Report maturity progress to leadership
  5. Adjust roadmap based on evolving threats and business changes

Key Artifacts

  • CSF Current Profile (by Function/Category/Subcategory)
  • CSF Target Profile
  • Gap Analysis Report
  • Maturity Assessment Scorecard
  • Improvement Roadmap with Priorities
  • Executive Summary and Dashboard

Common Pitfalls

  • Assessing technology only without evaluating governance and people
  • Setting unrealistic target tiers without resource commitment
  • Treating assessment as one-time rather than continuous process
  • Ignoring the new Govern function in CSF 2.0
  • Not aligning CSF assessment with existing compliance requirements (ISO 27001, SOC 2)

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/performing-nist-csf-maturity-assessment of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Performing Nist Csf Maturity Assessment next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Performing Nist Csf Maturity Assessment compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Performing Nist Csf Maturity Assessment this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.5kAutomated safety check: PassApache-2.0
Deepsec Documentation Guidevercel-labs/deepsec8.1k—~956Automated safety check: PassApache-2.0
Skill Scannergetsentry/skills1k4 repos~2.5kAutomated safety check: WarnApache-2.0
Serenity Aleabitoreddityan-labs/serenity-aleabitoreddit4811 repos~3.3kAutomated safety check: PassNone
Security Alert Triageelastic/agent-skills5921 repos~3.5kAutomated safety check: NotesApache-2.0
Shiro Attack CLISummerSec/ShiroAttack22.6k—~945Automated safety check: PassMIT

Similar skills

  • Deepsec Documentation Guide

    vercel-labs/deepsec

    Official

    Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.

    8.1k GitHub stars~956 tokensUpdated 12 days ago
    SecurityAuto-check passed
  • Skill Scanner

    getsentry/skills

    Official

    Scan agent skills for security issues. An agent skill from getsentry/skills.

    1k GitHub starsUsed in 4 repos~2.5k tokens
    SecurityAuto-check: warnings
  • Serenity Aleabitoreddit

    yan-labs/serenity-aleabitoreddit

    Apply trader Serenity's (@aleabitoreddit) AI/semiconductor supply-chain analytical lens to US-stock ideas and market judgment.

    481 GitHub starsUsed in 1 repo~3.3k tokens
    SecurityAuto-check passed
  • Security Alert Triage

    elastic/agent-skills

    Official

    Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.

    592 GitHub starsUsed in 1 repo~3.5k tokens
    SecurityAuto-check: notes
  • Shiro Attack CLI

    SummerSec/ShiroAttack2

    当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…

    2.6k GitHub stars~945 tokensUpdated 4 mo ago
    SecurityAuto-check passed
  • Cve Remediation

    rundeck/rundeck

    Verify if a CVE affects the project and remediate it. An agent skill from rundeck/rundeck.

    6.3k GitHub stars~2.9k tokensUpdated yesterday
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo
  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed
  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed
  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed
  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed
  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed
  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Performing Nist Csf Maturity Assessment

What does Performing Nist Csf Maturity Assessment do?

Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the…. Performing Nist Csf Maturity Assessment is an agent skill from mukul975/Anthropic-Cybersecurity-Skills.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) and producing an improvement roadmap.

When should I use Performing Nist Csf Maturity Assessment?

Performing Nist Csf Maturity Assessment fits situations like: benchmarking an organizations cybersecurity program maturity; preparing a CSF-based gap analysis and remediation plan.

How do I install Performing Nist Csf Maturity Assessment in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-nist-csf-maturity-assessment -a claude-code`. Or copy the skill folder (skills/performing-nist-csf-maturity-assessment in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/performing-nist-csf-maturity-assessment in your project. Claude Code loads it when a task matches its description.

How do I install Performing Nist Csf Maturity Assessment in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-nist-csf-maturity-assessment -a codex`. Or copy the skill folder (skills/performing-nist-csf-maturity-assessment in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/performing-nist-csf-maturity-assessment in your project. Codex loads it when a task matches its description.

Can I use Performing Nist Csf Maturity Assessment in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-nist-csf-maturity-assessment -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/performing-nist-csf-maturity-assessment, .gemini/skills/performing-nist-csf-maturity-assessment, .github/skills/performing-nist-csf-maturity-assessment and .opencode/skills/performing-nist-csf-maturity-assessment in your project.

What does Performing Nist Csf Maturity Assessment need to run?

Going by SKILL.md and its folder, Performing Nist Csf Maturity Assessment needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Performing Nist Csf Maturity Assessment access the network?

SKILL.md names 2 domains. As links in the text: csf.tools and csrc.nist.gov. This is read from the text; nothing was executed.

Is Performing Nist Csf Maturity Assessment safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Performing Nist Csf Maturity Assessment use?

Performing Nist Csf Maturity Assessment is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Performing Nist Csf Maturity Assessment use?

About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.2k tokens, read only when the agent opens those files.

What are the alternatives to Performing Nist Csf Maturity Assessment?

Skills that share tags, products or a category with Performing Nist Csf Maturity Assessment: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Skill Scanner (getsentry/skills, 1k stars), Serenity Aleabitoreddit (yan-labs/serenity-aleabitoreddit, 481 stars) and Security Alert Triage (elastic/agent-skills, 592 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Performing Nist Csf Maturity Assessment?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.