csf-mapping

Name: csf-mapping
Author: briiirussell

320stars36forks

How to install csf-mapping?

briiirussell/cybersecurity-skills/csf-mapping

$npx -y skills add briiirussell/cybersecurity-skills --skill csf-mapping

Installs into the current project.

Summary

Map your security posture against the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover). Produce a gap analysis, current/target tier assessment, and roadmap in the governance language that boards, auditors, and CISOs actually use. Use when the

Files · 1

View on GitHub

SKILL.md

1	# CSF Mapping — NIST Cybersecurity Framework 2.0 Posture Assessment
2
3	Translate your security posture into the language every CISO, board, auditor, and insurer already speaks. Distinct from the audit skills (which find specific issues); this skill assesses your program against a recognized framework and produces governance-ready output.
4
5	NIST CSF 2.0 is the framework that, as of 2024, replaced CSF 1.1. It added a sixth function — Govern — recognizing that the others can't work without governance backing.
6
7	The six functions:
8
9	\| Function \| What it covers \|
10	\|---\|---\|
11	\| Govern (GV) \| Cybersecurity strategy, roles, policies, oversight, supply chain risk \|
12	\| Identify (ID) \| Asset inventory, business environment, risk assessment, supply chain \|
13	\| Protect (PR) \| Access control, awareness, data security, baseline configurations, maintenance, protective tech \|
14	\| Detect (DE) \| Continuous monitoring, anomaly detection, adverse event analysis \|
15	\| Respond (RS) \| Incident management, analysis, mitigation, reporting, comms \|
16	\| Recover (RC) \| Recovery planning, improvements, communications \|
17
18	Each function contains Categories (e.g., `PR.AA` — Identity Management, Authentication, and Access Control), and each category contains Subcategories (e.g., `PR.AA-01` — Identities and credentials for authorized users, services, and hardware are managed).
19
20	This skill maps your reality to those Subcategories.
21
22	Cross-references: every audit skill in this repo (they produce evidence that becomes the "current state" entries here), `iam-audit` (most of PR.AA), `siem-detection` (most of DE), `incident-triage` (most of RS), `threat-modeling` (informs ID.RA risk assessment), `breach-patterns` (informs ID.IM improvements from lessons learned).
23
24	## Methodology
25
26	### Step 1 — Establish scope
27
28	CSF assessments are scope-bounded. Decide which of these you're assessing:
29
30	- Whole organization — every system, every business unit
31	- One product / service — for vendor due-diligence questionnaires (SIG, CAIQ)
32	- One environment — production cloud only, or PCI-in-scope only
33	- Regulatory scope — HIPAA-covered systems, FedRAMP boundary, etc.
34
35	Write down what's in and what's out. Most CSF assessments fail at scope drift.
36
37	### Step 2 — Choose your CSF profile
38
39	CSF 2.0 introduced Organizational Profiles — instead of "score every Subcategory equally," you tailor based on what matters.
40
41	- Current Profile — where you actually are
42	- Target Profile — where you want to be (informed by business goals, regulatory requirements, risk appetite)
43	- Community Profile — pre-built profile for your sector (manufacturing, healthcare, financial services — published by NIST and others)
44
45	For a first-pass assessment, start with a Community Profile if one exists for your sector, then tailor.
46
47	### Step 3 — Assess each Subcategory
48
49	For each Subcategory in scope:
50
51	\| Field \| What to record \|
52	\|---\|---\|
53	\| ID \| e.g., `PR.AA-05` \|
54	\| Subcategory text \| Verbatim from NIST or paraphrased \|
55	\| Current state \| What you actually do today (evidence, not aspiration) \|
56	\| Evidence \| Document / system / process that proves the current state \|
57	\| Tier \| Partial / Risk-Informed / Repeatable / Adaptive (1-4) \|
58	\| Target tier \| What you're aiming for \|
59	\| Gap \| The delta \|
60	\| Plan \| What closes the gap \|
61	\| Owner \| Who's accountable \|
62	\| Timeline \| When \|
63
64	#### CSF Implementation Tiers
65
66	\| Tier \| Name \| Characteristic \|
67	\|---\|---\|---\|
68	\| 1 \| Partial \| Ad-hoc, reactive, undocumented; awareness is informal \|
69	\| 2 \| Risk-Informed \| Risk management is approved but not org-wide; processes are repeatable for some teams \|
70	\| 3 \| Repeatable \| Documented org-wide policies; consistent processes; risk-informed budgeting \|
71	\| 4 \| Adaptive \| Continuous improvement; quantitative risk; learning from incidents (yours and peers'); cybersecurity culture \|
72
73	Tier 4 is rare and expensive. Most mature SaaS orgs target Tier 3 across most subcategories. Set targets based on what the business actually needs, not what looks good.
74
75	### Step 4 — Identify gaps and prioritize
76
77	For each gap, ask:
78
79	- Impact if exploited / not addressed (regulatory, reputational, financial)
80	- Likelihood given current threat landscape and your specific exposure
81	- Cost to close (engine

People who liked this also viewed

6 picks

Type

csf-mapping

320stars36forks

View on GitHub

How to install csf-mapping?

briiirussell/cybersecurity-skills/csf-mapping

$npx -y skills add briiirussell/cybersecurity-skills --skill csf-mapping

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# CSF Mapping — NIST Cybersecurity Framework 2.0 Posture Assessment
2
3	Translate your security posture into the language every CISO, board, auditor, and insurer already speaks. Distinct from the audit skills (which find specific issues); this skill assesses your program against a recognized framework and produces governance-ready output.
4
5	NIST CSF 2.0 is the framework that, as of 2024, replaced CSF 1.1. It added a sixth function — Govern — recognizing that the others can't work without governance backing.
6
7	The six functions:
8
9	\| Function \| What it covers \|
10	\|---\|---\|
11	\| Govern (GV) \| Cybersecurity strategy, roles, policies, oversight, supply chain risk \|
12	\| Identify (ID) \| Asset inventory, business environment, risk assessment, supply chain \|
13	\| Protect (PR) \| Access control, awareness, data security, baseline configurations, maintenance, protective tech \|
14	\| Detect (DE) \| Continuous monitoring, anomaly detection, adverse event analysis \|
15	\| Respond (RS) \| Incident management, analysis, mitigation, reporting, comms \|
16	\| Recover (RC) \| Recovery planning, improvements, communications \|
17
18	Each function contains Categories (e.g., `PR.AA` — Identity Management, Authentication, and Access Control), and each category contains Subcategories (e.g., `PR.AA-01` — Identities and credentials for authorized users, services, and hardware are managed).
19
20	This skill maps your reality to those Subcategories.
21
22	Cross-references: every audit skill in this repo (they produce evidence that becomes the "current state" entries here), `iam-audit` (most of PR.AA), `siem-detection` (most of DE), `incident-triage` (most of RS), `threat-modeling` (informs ID.RA risk assessment), `breach-patterns` (informs ID.IM improvements from lessons learned).
23
24	## Methodology
25
26	### Step 1 — Establish scope
27
28	CSF assessments are scope-bounded. Decide which of these you're assessing:
29
30	- Whole organization — every system, every business unit
31	- One product / service — for vendor due-diligence questionnaires (SIG, CAIQ)
32	- One environment — production cloud only, or PCI-in-scope only
33	- Regulatory scope — HIPAA-covered systems, FedRAMP boundary, etc.
34
35	Write down what's in and what's out. Most CSF assessments fail at scope drift.
36
37	### Step 2 — Choose your CSF profile
38
39	CSF 2.0 introduced Organizational Profiles — instead of "score every Subcategory equally," you tailor based on what matters.
40
41	- Current Profile — where you actually are
42	- Target Profile — where you want to be (informed by business goals, regulatory requirements, risk appetite)
43	- Community Profile — pre-built profile for your sector (manufacturing, healthcare, financial services — published by NIST and others)
44
45	For a first-pass assessment, start with a Community Profile if one exists for your sector, then tailor.
46
47	### Step 3 — Assess each Subcategory
48
49	For each Subcategory in scope:
50
51	\| Field \| What to record \|
52	\|---\|---\|
53	\| ID \| e.g., `PR.AA-05` \|
54	\| Subcategory text \| Verbatim from NIST or paraphrased \|
55	\| Current state \| What you actually do today (evidence, not aspiration) \|
56	\| Evidence \| Document / system / process that proves the current state \|
57	\| Tier \| Partial / Risk-Informed / Repeatable / Adaptive (1-4) \|
58	\| Target tier \| What you're aiming for \|
59	\| Gap \| The delta \|
60	\| Plan \| What closes the gap \|
61	\| Owner \| Who's accountable \|
62	\| Timeline \| When \|
63
64	#### CSF Implementation Tiers
65
66	\| Tier \| Name \| Characteristic \|
67	\|---\|---\|---\|
68	\| 1 \| Partial \| Ad-hoc, reactive, undocumented; awareness is informal \|
69	\| 2 \| Risk-Informed \| Risk management is approved but not org-wide; processes are repeatable for some teams \|
70	\| 3 \| Repeatable \| Documented org-wide policies; consistent processes; risk-informed budgeting \|
71	\| 4 \| Adaptive \| Continuous improvement; quantitative risk; learning from incidents (yours and peers'); cybersecurity culture \|
72
73	Tier 4 is rare and expensive. Most mature SaaS orgs target Tier 3 across most subcategories. Set targets based on what the business actually needs, not what looks good.
74
75	### Step 4 — Identify gaps and prioritize
76
77	For each gap, ask:
78
79	- Impact if exploited / not addressed (regulatory, reputational, financial)
80	- Likelihood given current threat landscape and your specific exposure
81	- Cost to close (engine

People who liked this also viewed

6 picks

Type