nist-csf-specialist

What this skill does

# NIST CSF 2.0 Specialist

Implement, assess, and manage cybersecurity programs aligned with the NIST Cybersecurity Framework 2.0 — the definitive standard for organizational cybersecurity risk management.

---

## Table of Contents

- [Trigger Phrases](#trigger-phrases)
- [Quick Start](#quick-start)
- [Tools](#tools)
- [NIST CSF 2.0 Overview](#nist-csf-20-overview)
- [Six Core Functions](#six-core-functions)
- [CSF Profiles](#csf-profiles)
- [CSF Tiers](#csf-tiers)
- [Cross-Framework Mapping](#cross-framework-mapping)
- [Infrastructure Security Assessment](#infrastructure-security-assessment)
- [Maturity Assessment Workflow](#maturity-assessment-workflow)
- [Implementation Roadmap](#implementation-roadmap)
- [Reference Guides](#reference-guides)
- [Validation Checkpoints](#validation-checkpoints)

---

## Trigger Phrases

Use this skill when you hear:
- "NIST cybersecurity framework"
- "CSF 2.0"
- "NIST compliance"
- "cybersecurity risk management"
- "NIST controls"
- "NIST assessment"
- "cybersecurity maturity"
- "NIST CSF profile"
- "cybersecurity governance"
- "cybersecurity program assessment"
- "CSF gap analysis"
- "cross-framework compliance mapping"

---

## Quick Start

### Assess Cybersecurity Maturity

```bash
python scripts/csf_maturity_assessor.py --input assessment.json --target-tier 3 --output maturity_report.json
```

### Map Controls Across Frameworks

```bash
python scripts/csf_control_mapper.py --source-framework nist-csf --target-framework iso27001 --output mapping.json
```

### Generate Gap Analysis

```bash
python scripts/csf_maturity_assessor.py --input assessment.json --target-tier 4 --format markdown --output gap_analysis.md
```

### Multi-Framework Unified Matrix

```bash
python scripts/csf_control_mapper.py --source-framework nist-csf --target-framework all --output unified_matrix.json
```

---

## Tools

### csf_maturity_assessor.py

Comprehensive maturity assessment engine for NIST CSF 2.0.

**Capabilities:**
- Scores each function and category on a 1–4 tier scale
- Compares current profile against target profile
- Generates prioritized gap analysis with remediation actions
- Maps gaps to specific CSF subcategories
- Produces JSON or Markdown output

**Usage:**

```bash
# Full maturity assessment with gap analysis
python scripts/csf_maturity_assessor.py \
  --input current_state.json \
  --target-tier 3 \
  --output report.json

# Markdown report for executive presentation
python scripts/csf_maturity_assessor.py \
  --input current_state.json \
  --target-tier 4 \
  --format markdown \
  --output executive_report.md

# Assess specific functions only
python scripts/csf_maturity_assessor.py \
  --input current_state.json \
  --functions GOVERN,IDENTIFY,PROTECT \
  --target-tier 3 \
  --output partial_report.json
```

**Input Format (current_state.json):**

```json
{
  "organization": "Acme Corp",
  "assessment_date": "2026-03-09",
  "assessor": "Security Team",
  "functions": {
    "GOVERN": {
      "GV.OC": {
        "score": 2,
        "evidence": "Mission documented, partial stakeholder mapping",
        "notes": "Legal requirements catalog incomplete"
      },
      "GV.RM": {
        "score": 1,
        "evidence": "No formal risk management strategy",
        "notes": "Risk appetite not defined"
      }
    },
    "IDENTIFY": {
      "ID.AM": {
        "score": 3,
        "evidence": "CMDB maintained, automated discovery",
        "notes": "Shadow IT gap exists"
      }
    }
  }
}
```

### csf_control_mapper.py

Cross-framework control mapping engine.

**Capabilities:**
- Maps NIST CSF 2.0 categories to ISO 27001, SOC 2, HIPAA, PCI-DSS
- Identifies overlapping controls for multi-framework programs
- Generates unified control matrices
- Highlights gaps unique to each framework

**Usage:**

```bash
# Map CSF to ISO 27001
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework iso27001 \
  --output iso_mapping.json

# Map CSF to all supported frameworks
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework all \
  --output unified_matrix.json

# Map specific functions only
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework soc2 \
  --functions GOVERN,PROTECT \
  --output soc2_mapping.json

# Markdown output for documentation
python scripts/csf_control_mapper.py \
  --source-framework nist-csf \
  --target-framework iso27001 \
  --format markdown \
  --output mapping_report.md
```

---

## NIST CSF 2.0 Overview

### What Changed in CSF 2.0

Released in February 2024, NIST CSF 2.0 represents a major evolution from the original 2014 framework and 2018 v1.1 update:

**Expanded Scope:** CSF 2.0 applies to ALL organizations — not just critical infrastructure. Small businesses, government agencies, higher education, and nonprofits are now explicitly in scope.

**New GOVERN Function:** The most significant change. GOVERN elevates cybersecurity governance to a top-level function, recognizing that executive leadership, policy, and oversight are prerequisites for effective cybersecurity.

**Enhanced Supply Chain Focus:** Cybersecurity Supply Chain Risk Management (C-SCRM) is now a category under GOVERN, reflecting the reality that supply chain attacks are a primary threat vector.

**Improved Guidance:** CSF 2.0 includes implementation examples and quick-start guides that were absent in earlier versions. The framework is more actionable and prescriptive while maintaining its flexible, risk-based approach.

**Profile Updates:** Profiles are now more clearly defined as organizational profiles (describing current/target states) and community profiles (sector-specific templates).

### Framework Architecture

```
┌─────────────────────────────────────────────────────┐
│                    CSF CORE                          │
│                                                     │
│  ┌─────────┐                                        │
│  │ GOVERN  │ ← NEW: Overarching governance          │
│  └────┬────┘                                        │
│       │                                             │
│  ┌────▼────┐  ┌─────────┐  ┌────────┐  ┌─────────┐│
│  │IDENTIFY │→ │ PROTECT  │→ │ DETECT │→ │ RESPOND ││
│  └─────────┘  └─────────┘  └────────┘  └────┬────┘│
│                                              │      │
│                                         ┌────▼────┐ │
│                                         │ RECOVER │ │
│                                         └─────────┘ │
├─────────────────────────────────────────────────────┤
│                   PROFILES                           │
│          Current State ↔ Target State                │
├─────────────────────────────────────────────────────┤
│                    TIERS                             │
│    Partial → Risk Informed → Repeatable → Adaptive  │
└─────────────────────────────────────────────────────┘
```

---

## Six Core Functions

### 1. GOVERN (GV) — NEW in CSF 2.0

The GOVERN function establishes and monitors the organization's cybersecurity risk management strategy, expectations, and policy. It is the connective tissue across all other functions.

#### GV.OC — Organizational Context

Understanding the organization's mission, stakeholder expectations, and dependencies is the foundation for all cybersecurity decisions.

**Key Activities:**
- Document organizational mission, objectives, and stakeholder expectations
- Catalog legal, regulatory, and contractual cybersecurity obligations
- Map critical business processes and their technology dependencies
- Define risk appetite and risk tolerance statements
- Identify internal and external stakeholders with cybersecurity interests

**Implementation Guidance:**
- Maintain a regulatory obligations register updated quarterly
- Conduct annual stakeholder mapping exercises
- Align cybersecurity objectives with enterprise risk management (ERM)
- Document dependencies between business processes and IT assets

**Matu