/csf-mapping

name: csf-mapping
description: "Map your security posture against the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover). Produce a gap analysis, current/target tier assessment, and roadmap in the governance language that boards, auditors, and CISOs actually use. Use when the user mentions 'NIST CSF,' 'CSF 2.0,' 'cybersecurity framework,' 'security posture,' 'governance mapping,' 'CSF gap analysis,' 'CSF tiers,' 'cybersecurity maturity,' 'security roadmap,' 'CISO report,' 'board reporting,' 'security program,' or needs to translate technical findings into governance language."
allowed-tools: Read, Grep, Glob, Bash, WebSearch

CSF Mapping — NIST Cybersecurity Framework 2.0 Posture Assessment

Translate your security posture into the language every CISO, board, auditor, and insurer already speaks. Distinct from the audit skills (which find specific issues); this skill assesses your *program* against a recognized framework and produces governance-ready output.

NIST CSF 2.0 is the framework that, as of 2024, replaced CSF 1.1. It added a sixth function — **Govern** — recognizing that the others can't work without governance backing.

The six functions:

| Function | What it covers | |---|---| | **Govern (GV)** | Cybersecurity strategy, roles, policies, oversight, supply chain risk | | **Identify (ID)** | Asset inventory, business environment, risk assessment, supply chain | | **Protect (PR)** | Access control, awareness, data security, baseline configurations, maintenance, protective tech | | **Detect (DE)** | Continuous monitoring, anomaly detection, adverse event analysis | | **Respond (RS)** | Incident management, analysis, mitigation, reporting, comms | | **Recover (RC)** | Recovery planning, improvements, communications |

Each function contains Categories (e.g., `PR.AA` — Identity Management, Authentication, and Access Control), and each category contains Subcategories (e.g., `PR.AA-01` — Identities and credentials for authorized users, services, and hardware are managed).

This skill maps your reality to those Subcategories.

Cross-references: every audit skill in this repo (they produce evidence that becomes the "current state" entries here), `iam-audit` (most of PR.AA), `siem-detection` (most of DE), `incident-triage` (most of RS), `threat-modeling` (informs ID.RA risk assessment), `breach-patterns` (informs ID.IM improvements from lessons learned).

Methodology

Step 1 — Establish scope

CSF assessments are scope-bounded. Decide which of these you're assessing:

• **Whole organization** — every system, every business unit
• **One product / service** — for vendor due-diligence questionnaires (SIG, CAIQ)
• **One environment** — production cloud only, or PCI-in-scope only
• **Regulatory scope** — HIPAA-covered systems, FedRAMP boundary, etc.

Write down what's in and what's out. Most CSF assessments fail at scope drift.

Step 2 — Choose your CSF profile

CSF 2.0 introduced Organizational Profiles — instead of "score every Subcategory equally," you tailor based on what matters.

• **Current Profile** — where you actually are
• **Target Profile** — where you want to be (informed by business goals, regulatory requirements, risk appetite)
• **Community Profile** — pre-built profile for your sector (manufacturing, healthcare, financial services — published by NIST and others)

For a first-pass assessment, start with a Community Profile if one exists for your sector, then tailor.

Step 3 — Assess each Subcategory

For each Subcategory in scope:

| Field | What to record | |---|---| | **ID** | e.g., `PR.AA-05` | | **Subcategory text** | Verbatim from NIST or paraphrased | | **Current state** | What you actually do today (evidence, not aspiration) | | **Evidence** | Document / system / process that proves the current state | | **Tier** | Partial / Risk-Informed / Repeatable / Adaptive (1-4) | | **Target tier** | What you're aiming for | | **Gap** | The delta | | **Plan** | What closes the gap | | **Owner** | Who's accountable | | **Timeline** | When |

CSF Implementation Tiers

| Tier | Name | Characteristic | |---|---|---| | 1 | **Partial** | Ad-hoc, reactive, undocumented; awareness is informal | | 2 | **Risk-Informed** | Risk management is approved but not org-wide; processes are repeatable for some teams | | 3 | **Repeatable** | Documented org-wide policies; consistent processes; risk-informed budgeting | | 4 | **Adaptive** | Continuous improvement; quantitative risk; learning from incidents (yours and peers'); cybersecurity culture |

Tier 4 is rare and expensive. Most mature SaaS orgs target Tier 3 across most subcategories. Set targets based on what the business actually needs, not what looks good.

Step 4 — Identify gaps and prioritize

For each gap, ask:

• **Impact** if exploited / not addressed (regulatory, reputational, financial)
• **Likelihood** given current threat landscape and your specific exposure
• **Cost to close** (engineering hours, tooling, headcount)
• **Dependencies** on other gaps closing first

Prioritize by **Risk × Cost-to-close** — not just by risk. Some critical-risk items take a year and three vendors; some quick wins reduce real risk in a sprint.

Step 5 — Build the roadmap

CSF roadmaps usually run in quarters with annual targets. A useful structure:

• **Next 30 days** — immediate gaps (quick wins, low-cost high-risk items)
• **Next 90 days** — medium effort, named owners, defined success criteria
• **Next 12 months** — strategic gaps requiring budget approval, tooling decisions, headcount
• **Annual review** — full reassessment; profile refresh; tier movement

Each item on the roadmap names: the Subcategory it closes, the owner, the budget, the success metric, the review date.

Subcategory cross-references to skills in this repo

A useful shortcut — these are the audit skills that produce evidence for which CSF Subcategories.

| CSF Subcategory | Audit skill | Type of evidence | |