NIST CSF 2.0 Specialist

Implement, assess, and manage cybersecurity programs aligned with the NIST Cybersecurity Framework 2.0 — the definitive standard for organizational cybersecurity risk management.

[Trigger Phrases](#trigger-phrases)
[Quick Start](#quick-start)
[Tools](#tools)
[NIST CSF 2.0 Overview](#nist-csf-20-overview)
[Six Core Functions](#six-core-functions)
[CSF Profiles](#csf-profiles)
[CSF Tiers](#csf-tiers)
[Cross-Framework Mapping](#cross-framework-mapping)
[Infrastructure Security Assessment](#infrastructure-security-assessment)
[Maturity Assessment Workflow](#maturity-assessment-workflow)
[Implementation Roadmap](#implementation-roadmap)
[Reference Guides](#reference-guides)
[Validation Checkpoints](#validation-checkpoints)

Trigger Phrases

Use this skill when you hear:

"NIST cybersecurity framework"
"CSF 2.0"
"NIST compliance"
"cybersecurity risk management"
"NIST controls"
"NIST assessment"
"cybersecurity maturity"
"NIST CSF profile"
"cybersecurity governance"
"cybersecurity program assessment"
"CSF gap analysis"
"cross-framework compliance mapping"

Quick Start

Assess Cybersecurity Maturity

python scripts/csf_maturity_assessor.py --input assessment.json --target-tier 3 --output maturity_report.json

Map Controls Across Frameworks

python scripts/csf_control_mapper.py --source-framework nist-csf --target-framework iso27001 --output mapping.json

Generate Gap Analysis

python scripts/csf_maturity_assessor.py --input assessment.json --target-tier 4 --format markdown --output gap_analysis.md

Multi-Framework Unified Matrix

python scripts/csf_control_mapper.py --source-framework nist-csf --target-framework all --output unified_matrix.json

Tools

csf_maturity_assessor.py

Comprehensive maturity assessment engine for NIST CSF 2.0.

Capabilities:

Scores each function and category on a 1–4 tier scale
Compares current profile against target profile
Generates prioritized gap analysis with remediation actions
Maps gaps to specific CSF subcategories
Produces JSON or Markdown output

Usage:

# Full maturity assessment with gap analysis
python scripts/csf_maturity_assessor.py \
  --input current_state.json \
  --target-tier 3 \
  --output report.json

# Markdown report for executive presentation
python scripts/csf_maturity_assessor.py \
  --input current_state.json \
  --target-tier 4 \
  --format markdown \
  --output executive_report.md

# Assess specific functions only
python scripts/csf_maturity_assessor.py \
  --input current_state.json \
  --functions GOVERN,IDENTIFY,PROTECT \
  --target-tier 3 \
  --output partial_report.json

Input Format (current_state.json):

{
  "organization": "Acme Corp",
  "assessment_date": "2026-03-09",
  "assessor": "Security Team",
  "functions": {
    "GOVERN": {
      "GV.OC": {
        "score": 2,
        "evidence": "Mission documented, partial stakeholder mapping",
        "notes": "Legal requirements catalog incomplete"
      },
      "GV.RM": {
        "score": 1,
        "evidence": "No formal risk management strategy",
        "notes": "Risk appetite not defined"
      }
    },
    "IDENTIFY": {
      "ID.AM": {
        "score": 3,
        "evidence": "CMDB maintained, automated discovery",
        "notes": "Shadow IT gap exists"
      }
    }
  }
}

csf_control_mapper.py

Cross-framework control mapping engine.

Capabilities:

Maps NIST CSF 2.0 categories to ISO 27001, SOC 2, HIPAA, PCI-DSS
Identifies overlapping controls for multi-framework programs
Generates unified control matrices
Highlights gaps unique to each framework

Usage:

# Map CSF to ISO 27001
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework iso27001 \
  --output iso_mapping.json

# Map CSF to all supported frameworks
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework all \
  --output unified_matrix.json

# Map specific functions only
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework soc2 \
  --functions GOVERN,PROTECT \
  --output soc2_mapping.json

# Markdown output for documentation
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework iso27001 \
  --format markdown \
  --output mapping_report.md

NIST CSF 2.0 Overview

What Changed in CSF 2.0

Released in February 2024, NIST CSF 2.0 represents a major evolution from the original 2014 framework and 2018 v1.1 update:

Expanded Scope: CSF 2.0 applies to ALL organizations — not just critical infrastructure. Small businesses, government agencies, higher education, and nonprofits are now explicitly in scope.

New GOVERN Function: The most significant change. GOVERN elevates cybersecurity governance to a top-level function, recognizing that executive leadership, policy, and oversight are prerequisites for effective cybersecurity.

Enhanced Supply Chain Focus: Cybersecurity Supply Chain Risk Management (C-SCRM) is now a category under GOVERN, reflecting the reality that supply chain attacks are a primary threat vector.

Improved Guidance: CSF 2.0 includes implementation examples and quick-start guides that were absent in earlier versions. The framework is more actionable and prescriptive while maintaining its flexible, risk-based approach.

Profile Updates: Profiles are now more clearly defined as organizational profiles (describing current/target states) and community profiles (sector-specific templates).

Framework Architecture

┌─────────────────────────────────────────────────────┐
│                    CSF CORE                          │
│                                                     │
│  ┌─────────┐                                        │
│  │ GOVERN  │ ← NEW: Overarching governance          │
│  └────┬────┘                                        │
│       │                                             │
│  ┌────▼────┐  ┌─────────┐  ┌────────┐  ┌─────────┐│
│  │IDENTIFY │→ │ PROTECT  │→ │ DETECT │→ │ RESPOND ││
│  └─────────┘  └─────────┘  └────────┘  └────┬────┘│
│                                              │      │
│                                         ┌────▼────┐ │
│                                         │ RECOVER │ │
│                                         └─────────┘ │
├─────────────────────────────────────────────────────┤
│                   PROFILES                           │
│          Current State ↔ Target State                │
├─────────────────────────────────────────────────────┤
│                    TIERS                             │
│    Partial → Risk Informed → Repeatable → Adaptive  │
└─────────────────────────────────────────────────────┘

Six Core Functions

1. GOVERN (GV) — NEW in CSF 2.0

The GOVERN function establishes and monitors the organization's cybersecurity risk management strategy, expectations, and policy. It is the connective tissue across all other functions.

GV.OC — Organizational Context

Understanding the organization's mission, stakeholder expectations, and dependencies is the foundation for all cybersecurity decisions.

Key Activities:

Document organizational mission, objectives, and stakeholder expectations
Catalog legal, regulatory, and contractual cybersecurity obligations
Map critical business processes and their technology dependencies
Define risk appetite and risk tolerance statements
Identify internal and external stakeholders with cybersecurity interests

Implementation Guidance:

Maintain a regulatory obligations register updated quarterly
Conduct annual stakeholder mapping exercises
Align cybersecurity objectives with enterprise risk management (ERM)
Document dependencies between business processes and IT assets

**Matu

nist-csf-specialist

Como adicionar

Cole no README do seu repo

Skills relacionadas

internal-comms

smart-explore

babysit

do

Receba novas skills de DevOps e Infra toda segunda