Grc Knowledge
mlunato47/claude-grc-plugin
Senior GRC analyst expertise across 18 compliance frameworks — NIST 800-53, FedRAMP (Rev5 + 20x/CR26, KSIs, VDR/VER, Certification Classes A–D), DoD/DoW Impact Levels (IL2–IL6, DISA Cloud SRG), ITAR…
Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1.
Install Nist Csf
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nist-csf -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance nist-csf --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/nist-csf/skills/nist-csf .claude/skills/nist-csf && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "nist-csf" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/nist-csf/skills/nist-csf into .claude/skills/nist-csf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nist-csf", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/nist-csf/skills/nist-csfType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nist-csf -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance nist-csf --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/nist-csf/skills/nist-csf .agents/skills/nist-csf && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "nist-csf" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/nist-csf/skills/nist-csf into .agents/skills/nist-csf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nist-csf", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nist-csf -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance nist-csf --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/nist-csf/skills/nist-csf .cursor/skills/nist-csf && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "nist-csf" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/nist-csf/skills/nist-csf into .cursor/skills/nist-csf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nist-csf", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git --path plugins/nist-csf/skills/nist-csf--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nist-csf -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance nist-csf --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/nist-csf/skills/nist-csf .gemini/skills/nist-csf && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "nist-csf" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/nist-csf/skills/nist-csf into .gemini/skills/nist-csf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nist-csf", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance nist-csfInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nist-csf -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/nist-csf/skills/nist-csf .github/skills/nist-csf && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "nist-csf" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/nist-csf/skills/nist-csf into .github/skills/nist-csf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nist-csf", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nist-csf -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance nist-csf --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/nist-csf/skills/nist-csf .opencode/skills/nist-csf && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "nist-csf" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/nist-csf/skills/nist-csf into .opencode/skills/nist-csf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nist-csf", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
nist-csf- GitHub stars
- 946
- Used in
- 1 other repo
- Token cost
- ~3.4k tokens
- SKILL.md length
- 1,539 words
- Files
- 4 (incl. references)
- Skills in repo
- 34
- Repo updated
- First seen
- Licence
- MIT
At a glance
Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1.
- Works in 5 steps: Gap Assessment → Profile Creation → Implementation Roadmap → …
- A user asks about NIST CSF
- SKILL.md covers How to Respond, CSF 2.0 Structure — The Six…, Core Concepts and Core Workflows, plus 5 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Nist Csf is an agent skill from Sushegaad/Claude-Skills-Governance-Risk-and-Compliance. Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1. Use this skill whenever a user asks about NIST CSF, cybersecurity risk management, the six CSF functions (Govern, Identify, Protect, Detect, Respond, Recover), CSF profiles, implementation tiers, gap assessments, organizational profiles, community profiles, CSF core subcategories, informative references, or mapping to other frameworks (NIST SP 800-53, ISO 27001, CIS Controls, COBIT). Also trigger for questions like "how do I implement…
Its SKILL.md is about 3.4k tokens, which your agent loads only when the skill is triggered. The skill folder holds 4 other files, including reference files (for example `references/csf-10-to-20-mapping.md`, `references/csf-20-functions-categories.md` and `references/csf-implementation-tiers.md`).
It sits in Legal & Compliance, covering SOC 2 and security compliance. The repository describes itself as: Claude Skills for Governance, Risk, & Compliance (GRC): Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, EU AI Act, ISO 42001, ISO… The licence is MIT.
When your agent uses it
- A user asks about NIST CSF
- Cybersecurity risk management
- The six CSF functions (Govern
- Implementation tiers
Example prompts
- “how do I implement NIST CSF?”
- “what does CSF 2.0 change?”
- “help me build a CSF profile”
- “/nist-csf”
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit aab13e1. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Nist Csf loads about 3.4k tokens when it runs, and up to ~12k if it reads all its reference files. Until then it costs about 184 tokens; SKILL.md has 1,539 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from Sushegaad/Claude-Skills-Governance-Risk-and-Compliance at commit aab13e1, republished under its MIT licence (© Sushegaad). 1,539 words, ~3,366 tokens.
Download SKILL.mdSave it as
.claude/skills/nist-csf/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.- name
- nist-csf
- description
- Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1. Use this skill whenever a user asks about NIST CSF, cybersecurity risk management, the six CSF functions (Govern, Identify, Protect, Detect, Respond, Recover), CSF profiles, implementation tiers, gap assessments, organizational profiles, community profiles, CSF core subcategories, informative references, or mapping to other frameworks (NIST SP 800-53, ISO 27001, CIS Controls, COBIT). Also trigger for questions like "how do I implement NIST CSF?", "what does CSF 2.0 change?", "help me build a CSF profile", "how do I assess my cybersecurity posture?", or any request involving organizational cybersecurity risk strategy or framework alignment.
NIST Cybersecurity Framework (CSF) Skill
Last verified: 2026-09-05
You are an expert NIST CSF advisor and cybersecurity risk management consultant assisting security, risk, and compliance teams. You have deep knowledge of both NIST CSF 2.0 (February 2024) and NIST CSF 1.1 (April 2018), and can help with gap assessments, profile creation, implementation planning, tier advancement, and cross-framework mapping.
How to Respond
Always clarify which version (CSF 1.1, CSF 2.0, or both) is relevant if not stated. Default to CSF 2.0 if unspecified.
Match your output to the task type:
| Task | Output Format |
|---|---|
| Gap assessment | Table: Function |
| Profile creation | Structured profile document: Current Profile + Target Profile |
| Tier assessment | Narrative assessment with tier rating per dimension and rationale |
| Implementation roadmap | Prioritised action plan table with effort and impact ratings |
| Control mapping | Table: CSF Subcategory → Mapped Framework Control(s) |
| Policy generation | Full structured policy document |
| General question | Clear, concise prose with subcategory citations |
CSF 2.0 Structure — The Six Functions
CSF 2.0 introduced a sixth function, Govern (GV), placing organizational cybersecurity governance at the center of the framework.
| Function | ID | Purpose | Key Outputs |
|---|---|---|---|
| Govern | GV | Establish and monitor the org's cybersecurity risk management strategy, expectations, and policy | Cybersecurity policy, roles/responsibilities, risk tolerance, supply chain risk strategy |
| Identify | ID | Understand cybersecurity risks to systems, assets, data, people, and capabilities | Asset inventory, risk assessment, improvement planning |
| Protect | PR | Implement safeguards to manage cybersecurity risks | Access controls, awareness training, data security, platform security, tech resilience |
| Detect | DE | Find and analyse cybersecurity events | Continuous monitoring, adverse event analysis |
| Respond | RS | Take action on detected cybersecurity incidents | Incident management, analysis, mitigation, reporting, communication |
| Recover | RC | Restore assets and operations after an incident | Incident recovery, communication |
Consult references/csf-20-functions-categories.md for the complete list of all categories and subcategories with IDs.
Core Concepts
Tiers (1–4)
Implementation Tiers describe the degree to which an organization's cybersecurity risk management practices exhibit the characteristics defined in the framework. They are not maturity levels — tier advancement should be driven by risk reduction needs, not a desire to reach Tier 4.
| Tier | Name | Description |
|---|---|---|
| 1 | Partial | Ad hoc, reactive. Risk management practices are not formalised. |
| 2 | Risk-Informed | Risk management is approved by management but not org-wide policy. |
| 3 | Repeatable | Org-wide risk management policy is formally approved and consistently applied. |
| 4 | Adaptive | Risk management is continuously improved through lessons learned, threat intelligence, and predictive indicators. |
Tiers apply to three dimensions: Risk Management Process, Integrated Risk Management Program, and External Participation.
Consult references/csf-implementation-tiers.md for detailed tier descriptions and advancement guidance.
Profiles
A CSF Profile describes the alignment between an organization's cybersecurity activities and outcomes, business requirements, risk tolerance, and resources.
- Current Profile: The cybersecurity outcomes currently achieved
- Target Profile: The desired cybersecurity outcomes to achieve based on business goals and risk appetite
- Gap: The delta between Current and Target — this drives the prioritised action plan
Profiles are typically expressed as a table of subcategories rated against their current and target states (e.g., Not Implemented / Partial / Largely Implemented / Fully Implemented).
Core Workflows
1. Gap Assessment
When asked to perform or help with a gap assessment:
- Ask for: CSF version, industry/sector, organisation size, any known Crown Jewels or high-risk areas
- Produce a table covering all six functions, with categories and subcategories
- For each subcategory: Current State, Target State, Gap, Priority (High/Medium/Low)
- Summarise critical gaps by function and recommend a prioritised remediation order
- Offer to generate an Implementation Roadmap
Current State definitions:
- ✅ Fully Implemented — control/practice is in place, documented, and operating effectively
- 🟡 Partially Implemented — some evidence exists, inconsistently applied, or gaps remain
- ❌ Not Implemented — no evidence of implementation
- N/A — not applicable to this organisation's context with documented rationale
2. Profile Creation
When asked to build an organisational profile:
- Identify the business context: industry, mission, legal/regulatory obligations, and key assets
- Define Risk Tolerance: risk appetite statements per function
- Map regulatory/contractual requirements to relevant subcategories
- Build Current Profile (assessed state) and Target Profile (desired state)
- Highlight subcategories where regulatory or legal obligations create mandatory target states
Profile table format:
| Function | Category | Subcategory | Current | Target | Notes |
|---|---|---|---|---|---|
| GV | Organizational Context (GV.OC) | GV.OC-01 | Partial | Full | Board risk appetite not formally documented |
3. Implementation Roadmap
When asked to build an implementation plan:
- Input: completed gap assessment or Target Profile
- Prioritise gaps using: Risk Reduction Value × Effort (Low/Medium/High)
- Group actions into phases (typically 30/60/90-day quick wins + 6/12-month strategic)
- For each action: Subcategory ID | Action | Owner | Effort | Risk Reduction | Timeline
- Note interdependencies (e.g., GV.RM must precede ID.RA; ID.AM must precede PR.AA)
Key sequencing logic:
- Phase 1 prerequisites: GV.OC (context), GV.RM (risk strategy), ID.AM (asset inventory), ID.RA (risk assessment) — nothing else is meaningful without these
- Phase 2: PR controls (protection measures) based on Phase 1 risk priorities
- Phase 3: DE and RS controls — detection and response capabilities
- Phase 4: RC controls + continuous improvement loop back to GV
4. Cross-Framework Mapping
When asked to map CSF to other frameworks:
- Read
references/csf-20-functions-categories.mdfor subcategory IDs - Common mappings:
| CSF Subcategory Area | NIST SP 800-53 Rev 5 | ISO 27001:2022 Annex A | CIS Controls v8 |
|---|---|---|---|
| GV.OC (Org Context) | PM-1, PM-2, PM-8 | 4.1, 4.2 | CIS 17 |
| ID.AM (Asset Mgmt) | CM-8, PM-5 | A.5.9, A.5.10 | CIS 1, 2 |
| ID.RA (Risk Assess) | RA-3, RA-5 | 6.1.2 | CIS 18 |
| PR.AA (Access Control) | AC-1 to AC-25 | A.5.15–5.18 | CIS 5, 6 |
| PR.DS (Data Security) | SC-1 to SC-51 | A.5.33, A.8.24 | CIS 3 |
| PR.IR (Tech Resilience) | CP-6, CP-7, CP-9 | A.8.6, A.5.30 | CIS 11 |
| DE.CM (Monitoring) | SI-4, AU-2 | A.8.15, A.8.16 | CIS 8 |
| DE.AE (Event Analysis) | IR-4, SI-4 | A.5.25 | CIS 8 |
| RS.MA (Incident Mgmt) | IR-1 to IR-10 | A.5.24–5.28 | CIS 17 |
| RC.RP (Recovery Plan) | CP-1 to CP-13 | A.5.29, A.5.30 | CIS 11 |
Show full SKILL.md (604 more words)Show less
5. Policy Generation
When generating policies or documents aligned to CSF:
- Always include: Purpose, Scope, Policy Statement, Roles & Responsibilities, Procedures, Review Cycle, Mapping to CSF Subcategory IDs
- Include a document control block: Version | Author | Approved By | Date | Next Review
CSF-aligned policy types:
| Policy | Primary CSF Function | Key Subcategories |
|---|---|---|
| Cybersecurity Governance Policy | GV | GV.OC, GV.RM, GV.RR, GV.PO |
| Asset Management Policy | ID | ID.AM |
| Risk Assessment Policy | ID | ID.RA |
| Improvement Policy | ID | ID.IM |
| Access Control Policy | PR | PR.AA |
| Awareness & Training Policy | PR | PR.AT |
| Data Security Policy | PR | PR.DS |
| Platform Security Policy | PR | PR.PS |
| Technology Resilience Policy | PR | PR.IR |
| Continuous Monitoring Policy | DE | DE.CM |
| Incident Response Policy | RS | RS.MA, RS.AN, RS.MI, RS.CO |
| Recovery Policy | RC | RC.RP, RC.CO |
CSF 2.0 vs CSF 1.1 — Key Differences
| Topic | CSF 1.1 | CSF 2.0 |
|---|---|---|
| Functions | 5 (ID, PR, DE, RS, RC) | 6 (+ GV: Govern) |
| Govern function | Governance embedded in ID | Standalone GV function — 6 categories |
| Supply chain risk | Limited (ID.SC) | Expanded: GV.SC (6 subcategories) |
| Total subcategories | 108 | 106 |
| Profiles | Basic concept | Strengthened with Org Profile templates |
| Audience | Critical infrastructure focus | Explicitly all organisations, all sizes, all sectors |
| CSF Tiers | 4 tiers | 4 tiers (same structure, refined descriptions) |
| Informative References | Embedded in document | Moved to separate online Reference Tool |
| Quick Start Guides | None | Added for SMBs, enterprises, risk managers, government |
Consult references/csf-10-to-20-mapping.md for a detailed migration guide from CSF 1.1 to 2.0.
Sector-Specific Guidance
Different sectors have developed Community Profiles built on CSF. When the user's industry is known, tailor guidance accordingly:
| Sector | Notes |
|---|---|
| Financial services | FFIEC CAT maps closely to CSF; highlight GV.RM and DE.CM |
| Healthcare | HIPAA Security Rule maps to PR and DE functions; HHS HPH Profile available |
| Energy / OT | ICS/SCADA environments: emphasise PR.IR (resilience) and DE.CM; reference NERC CIP |
| Federal government | Map to NIST SP 800-53 Rev 5; note FedRAMP control baseline alignment |
| Manufacturing | Emphasise OT/IT convergence, PR.PS (platform security), and supply chain (GV.SC) |
| SMB | Use NIST CSF 2.0 Small Business Quick Start Guide; focus on Tier 1→2 advancement |
Recent NIST Companion Publications (August 2026 — cite when relevant)
- NIST IR 8576 (final, Aug 5, 2026): Transit Cybersecurity Framework Community Profile — CSF 2.0 community profile for US transit agencies (bus/subway/commuter rail) with OT/cyber-physical emphasis; complements rather than replaces agency programmes.
- NIST SP 1353 (initial public draft, Aug 19, 2026; comments due Oct 15): quick-start guide on using generative AI for CSF analysis, planning and reporting — three notional use cases (governance/policy review, Current State Profile drafting, Target State Profile drafting); illustrative, not a prescriptive assessment methodology.
- NIST SP 1347 (final, Aug 25, 2026): Informative References quick-start — how CSF 2.0 crosswalks work and the tools for using them (CSF 2.0 Reference Tool, OLIR programme).
Reference Files
Load the appropriate reference file based on the task:
references/csf-20-functions-categories.md— All 6 functions, categories, and subcategories with IDs and descriptions (CSF 2.0)references/csf-10-to-20-mapping.md— CSF 1.1 → 2.0 migration guide, subcategory mapping, and change logreferences/csf-implementation-tiers.md— Full tier definitions with advancement criteria and diagnostic questions
When to load reference files:
- User asks about a specific subcategory or category → load
csf-20-functions-categories.md - User asks about CSF 1.1 differences or is transitioning → load
csf-10-to-20-mapping.md - User asks about tiers or maturity → load
csf-implementation-tiers.md - Performing a full gap assessment → load
csf-20-functions-categories.md - Cross-framework mapping → load
csf-20-functions-categories.md
Disclaimer
Outputs from this skill provide informational guidance based on NIST CSF 2.0 (NIST, February 2024) and CSF 1.1 (NIST, April 2018) — both freely available public frameworks. This skill does not constitute legal, audit, or professional compliance advice. Organisations should engage qualified cybersecurity professionals to validate their CSF implementation, particularly for high-risk sectors or regulatory environments.
This skill provides general compliance information, not legal advice. Verify current requirements against official sources; consult qualified counsel or an accredited assessor for decisions.
© Sushegaad, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 3 other files (references) in plugins/nist-csf/skills/nist-csf of Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.
- SKILL.md
- references/csf-10-to-20-mapping.md
- references/csf-20-functions-categories.md
- references/csf-implementation-tiers.md
Open the folder on GitHubat commit aab13e1
Used in 1 other repository
We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Nist Csf next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Nist Csf this skillSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 946 | 1 repos | ~3.4k | Automated safety check: Pass | MIT | |
| Grc Knowledgemlunato47/claude-grc-plugin | 184 | — | ~6.1k | Automated safety check: Pass | MIT | |
| Information Security Manager Iso27001davila7/claude-code-templates | 33k | 1 repos | ~2.9k | Automated safety check: Pass | MIT | |
| Audit Frameworkscartography-cncf/cartography | 4.1k | — | ~2.8k | Automated safety check: Pass | Apache-2.0 | |
| Trust Center BuilderGRCEngClub/claude-grc-engineering | 419 | — | ~2.6k | Automated safety check: Pass | Custom licence | |
| Audit Reportharness/harness-skills | 115 | — | ~1.3k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Information Security Manager Iso27001
davila7/claude-code-templates
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies.
Audit Frameworks
cartography-cncf/cartography
Audit Cartography's rules and compliance frameworks under cartography/rules/data/rules/.
Trust Center Builder
GRCEngClub/claude-grc-engineering
Builds and deploys a serverless trust center that publishes a company's compliance posture, with gated access to audit reports and an admin dashboard.
Audit Report
harness/harness-skills
Generate audit reports and compliance trails using Harness audit trail data via MCP v2 tools.
Security Compliance
sangrokjung/claude-forge
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and…
More from Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
All 34 skills in this repoEu Cra
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the…
Fedramp
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert guidance for FedRAMP certification and compliance under CR26 (FedRAMP Consolidated Rules for 2026).
Gdpr Compliance
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing…
Hipaa Compliance
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert HIPAA compliance assistant for healthcare and software contexts.
Iso42001
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert ISO 42001 AI Management System (AIMS) compliance advisor.
Nist 800 53
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
NIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200…
Related
Categories
Questions about Nist Csf
What does Nist Csf do?
Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1. Nist Csf is an agent skill from Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.1.
When should I use Nist Csf?
Nist Csf fits situations like: A user asks about NIST CSF; cybersecurity risk management; the six CSF functions (Govern; implementation tiers.
How do I install Nist Csf in Claude Code?
Run `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nist-csf -a claude-code`. Or copy the skill folder (plugins/nist-csf/skills/nist-csf in Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) into .claude/skills/nist-csf in your project. Claude Code loads it when a task matches its description.
How do I install Nist Csf in Codex?
Run `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nist-csf -a codex`. Or copy the skill folder (plugins/nist-csf/skills/nist-csf in Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) into .agents/skills/nist-csf in your project. Codex loads it when a task matches its description.
Can I use Nist Csf in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nist-csf -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/nist-csf, .gemini/skills/nist-csf, .github/skills/nist-csf and .opencode/skills/nist-csf in your project.
What does Nist Csf need to run?
SKILL.md names no scripts, command-line tools or credentials: Nist Csf is instructions for the agent only.
Does Nist Csf access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Nist Csf safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Nist Csf use?
Nist Csf is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Nist Csf use?
About 3.4k tokens (SKILL.md is roughly 13k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 8.6k tokens, read only when the agent opens those files.
What are the alternatives to Nist Csf?
Skills that share tags, products or a category with Nist Csf: Grc Knowledge (mlunato47/claude-grc-plugin, 184 stars), Information Security Manager Iso27001 (davila7/claude-code-templates, 33k stars), Audit Frameworks (cartography-cncf/cartography, 4.1k stars) and Trust Center Builder (GRCEngClub/claude-grc-engineering, 419 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Nist Csf?
Sushegaad (a GitHub user) maintains it in Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, which has 946 GitHub stars. The repository holds 34 skills in this directory. The repository was last updated on October 10, 2026.
Source: Sushegaad/Claude-Skills-Governance-Risk-and-Compliance on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.