NIST Cybersecurity Framework (CSF) 2.0

Source: NIST CSWP 29 (US Government work, public domain) | Chapters: 8

When to use

Reach for this pack when designing, assessing, or communicating about a cybersecurity program using the NIST CSF 2.0 vocabulary and structure. It is the right starting point for mapping cybersecurity outcomes to the six Functions, understanding how Profiles and Tiers work, addressing supply chain cybersecurity risk (GV.SC), or integrating cybersecurity into enterprise risk management. Also use it to orient incident response, detection, and recovery planning against NIST's authoritative outcome taxonomy.

Prerequisites: none — plain Markdown; no MCP server, API key, or licence tier needed at runtime.

How to Use This Skill

Without arguments — load the core frameworks below.
With a topic — ask about governance, supply chain risk, identity and access control, incident response, detection, recovery, Profiles, Tiers, or ERM integration; I read the relevant chapter.
With a chapter — ask for ch01, ch02, ch03, ch04, ch05, ch06, ch07, or ch08.

Supporting files: glossary.md, patterns.md, cheatsheet.md.

Core Frameworks & Mental Models

The Six CSF Functions

The CSF Core is organized into six Functions. GOVERN sits at the center; the other five surround it. All six operate concurrently — GOVERN, IDENTIFY, PROTECT, and DETECT run continuously; RESPOND and RECOVER must be ready at all times.

Function	Identifier	Core question answered
GOVERN	GV	How does the organization set cybersecurity strategy, policy, and oversight?
IDENTIFY	ID	What are our assets and what cybersecurity risks do they face?
PROTECT	PR	What safeguards prevent or reduce the impact of adverse events?
DETECT	DE	How do we find cybersecurity attacks and compromises in progress?
RESPOND	RS	What actions do we take once an incident is declared?
RECOVER	RC	How do we restore normal operations after an incident?

GOVERN (GV) — Six Categories

GV.OC — Organizational Context: mission, stakeholders, dependencies, legal/regulatory obligations
GV.RM — Risk Management Strategy: risk appetite, risk tolerance, standardized risk method, ERM integration
GV.RR — Roles, Responsibilities, Authorities: accountability, resources, HR integration
GV.PO — Policy: establishment, enforcement, periodic review
GV.OV — Oversight: results feed strategy adjustments (the governance feedback loop)
GV.SC — Cybersecurity Supply Chain Risk Management: full supplier life cycle from due diligence through post-relationship obligations

IDENTIFY (ID) — Three Categories

ID.AM — Asset Management: inventory of hardware, software, data, network flows, supplier services; life-cycle management; criticality classification
ID.RA — Risk Assessment: vulnerability identification, threat intelligence, likelihood/impact estimation, risk response prioritization
ID.IM — Improvement: continuous learning from evaluations, exercises, operations, and incident plan maintenance

PROTECT (PR) — Five Categories

PR.AA — Identity Management, Authentication, and Access Control: credential management, identity proofing, authentication, least privilege, separation of duties, physical access
PR.AT — Awareness and Training: general and specialized-role training
PR.DS — Data Security: at-rest, in-transit, and in-use data protection; tested backups
PR.PS — Platform Security: configuration management, software/hardware maintenance, log generation, unauthorized software prevention, secure development life cycle
PR.IR — Technology Infrastructure Resilience: network protection, environmental threat protection, resilience mechanisms, capacity management

DETECT (DE) — Two Categories

DE.CM — Continuous Monitoring: networks, physical environments, personnel activity, external service providers, computing hardware/software/runtime
DE.AE — Adverse Event Analysis: correlation across sources, impact/scope estimation, threat intelligence integration, incident declaration (DE.AE-08)

RESPOND (RS) — Four Categories

RS.MA — Incident Management: plan execution, triage, categorization, prioritization, escalation, recovery criteria
RS.AN — Incident Analysis: root cause establishment, record integrity/provenance preservation, magnitude validation
RS.CO — Incident Response Reporting and Communication: stakeholder notification, information sharing
RS.MI — Incident Mitigation: containment, eradication

RECOVER (RC) — Two Categories

RC.RP — Incident Recovery Plan Execution: recovery action selection, backup integrity verification (RC.RP-03), post-incident operational norms (RC.RP-04), restoration verification, formal recovery declaration (RC.RP-06)
RC.CO — Incident Recovery Communication: stakeholder coordination, approved public messaging

Organizational Profiles and Tiers

Profiles translate Core outcomes into documented posture:

Current Profile — what the organization is achieving now
Target Profile — prioritized desired outcomes given mission, risk appetite, and threat landscape
Gap analysis — comparison driving a prioritized action plan (risk register, POA&M)
Community Profile — sector-specific published baseline usable as a Target Profile starting point

Tiers characterize governance and management rigor:

Tier	Name	Governance	Management
1	Partial	Ad hoc	Limited organizational awareness
2	Risk Informed	Ad hoc, not formally based on objectives	Irregular, case-by-case implementation
3	Repeatable	Formally approved, expressed as policy	Organization-wide approach; cybersecurity information shared routinely
4	Adaptive	Risk-informed, culturally embedded, predictive	Adapts based on lessons learned; real-time supply chain risk information

Key decision rule: Progress to higher Tiers only when risks/mandates are greater OR cost-benefit analysis justifies it. Tier 4 is not a universal target.

CSF and Enterprise Risk Management

The CSF explicitly integrates with ERM: GV.RM-03 requires cybersecurity risk activities to be included in enterprise risk management processes. The CSF helps translate cybersecurity terminology into general risk language that executives understand. NIST IR 8286 series provides detailed integration guidance. Cybersecurity risk sits alongside financial, privacy, supply chain, and reputational risks in the enterprise risk portfolio.

Key Interlock Points (cross-Function dependencies)

PROTECT → DETECT: PR.PS-04 log generation is the monitoring substrate DE.CM requires.
PROTECT → RECOVER: PR.DS-11 tested backups must exist before RC.RP-03 backup integrity verification can occur.
DETECT → RESPOND: DE.AE-08 incident declaration is the formal trigger for RS.MA.
RESPOND → RECOVER: RS.MA-05 recovery initiation criteria gate the transition to RC.RP.
RECOVER → IDENTIFY: RC.RP-06 documentation feeds ID.IM improvement identification.
IDENTIFY → GOVERN: ID.IM improvements escalate to GV.PO and GV.OV for strategy and policy updates.

Chapter Index

#	Section	Key content
ch01	CSF Overview and Components	Core, Profiles, Tiers, Informative References, Implementation Examples, QSGs
ch02	GOVERN (GV) Function	GV.OC, GV.RM, GV.RR, GV.PO, GV.OV, GV.SC; risk appetite; C-SCRM; ERM integration
ch03	IDENTIFY (ID) Function	ID.AM, ID.RA, ID.IM; asset inventories; threat intelligence; risk assessment; continuous improvement
ch04	PROTECT (PR) Function	PR.AA, PR.AT, PR.DS, PR.PS, PR.IR; least privilege; data security; platform security; resilience
ch05	DETECT (DE) Function	DE.CM, DE.AE; continuous monitoring; anomaly detection; incident declaration criteria
ch06	RESPOND (RS) Function	RS.MA, RS.AN, RS.CO, RS.MI; triage; root cause; containment; eradication; communication
ch07	RECOVER (RC) Function	RC.RP, RC.CO; backup integrity; post-incident norms; recovery declaration; public messaging
ch08	Organizational Profiles, Tiers, and Using the CSF	Current/Target Profiles; gap analysis; POA&M; Tier 1-4 descriptors; ERM integration; bidirectional communication

Topic Index

Access control / least privilege / separation of duties → ch04 (PR.AA)
Adaptive (Tier 4) → ch08
Asset inventory / asset management → ch03 (ID.AM)
Awareness and training → ch04 (PR.AT)
Backup / data recovery → ch04 (PR.DS-11), ch07 (RC.RP-03)
Community Profile → ch01, ch08
Continuous monitoring → ch05 (DE.CM)
C-SCRM / supply chain risk → ch02 (GV.SC)
Current Profile / Target Profile → ch08
Data security (at rest / in transit / in use) → ch04 (PR.DS)
DETECT function overview → ch05
Enterprise risk management (ERM) → ch02 (GV.RM-03), ch08
Gap analysis / action plan / POA&M → ch08
GOVERN function overview → ch02
Identification of assets → ch03 (ID.AM)
IDENTIFY function overview → ch03
Incident declaration → ch05 (DE.AE-08)
Incident management / triage → ch06 (RS.MA)
Incident response plan → ch03 (ID.IM-04), ch06
Improvement / lessons learned → ch03 (ID.IM)
Indicators of compromise → ch05 (DE.CM)
Informative References → ch01
KPIs / KRIs / reporting → ch08
Organizational Profile → ch01, ch08
Oversight / feedback loop → ch02 (GV.OV)
Partial (Tier 1) → ch08
Platform security / configuration management → ch04 (PR.PS)
Policy → ch02 (GV.PO)
Privacy risk → ch01, ch08
Quick-Start Guides (QSGs) → ch01
RECOVER function overview → ch07
Recovery declaration → ch07 (RC.RP-06)
Repeatable (Tier 3) → ch08
RESPOND function overview → ch06
Risk appetite / risk tolerance → ch02 (GV.RM-02)
Risk assessment → ch03 (ID.RA)
Risk Informed (Tier 2) → ch08
Roles, responsibilities, authorities → ch02 (GV.RR)
Root cause analysis → ch06 (RS.AN-03)
Secure software development → ch04 (PR.PS-06)
Supplier / third-party risk → ch02 (GV.SC), ch03 (ID.RA-09, ID.RA-10)
Technology infrastructure resilience → ch04 (PR.IR)
Threat intelligence → ch03 (ID.RA-02), ch05 (DE.AE-07)
Tiers overview → ch08

Supporting Files

glossary.md — alphabetical definitions for ~45 CSF 2.0 terms with chapter references
patterns.md — 12 named patterns with When/How/Trade-offs for implementing CSF outcomes
cheatsheet.md — decision rules, function/category quick-reference table, and tells & smells

Scope & Limits

This pack covers NIST CSWP 29 (CSF 2.0) as published February 26, 2024 — the framework document itself, including the CSF Core (Appendix A), Tiers (Appendix B), and Glossary (Appendix C). It does not cover the content of Informative References (e.g., SP 800-53 control details, SP 800-161r1 C-SCRM practices, NIST RMF authorization steps), sector-specific Community Profiles, or the CSF 2.0 online Reference Tool. This is a US Government public domain work; no copyright restrictions apply to the source document.

nist-csf

SKILL.mdpacks/nist-csf/SKILL.md