Lesson 2.44: Mapping controls to NIST CSF 2.0
The NIST Cybersecurity Framework, version 2.0 since February 2024, is the most widely used way to describe a security programme. It groups outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover, each with categories such as PR.AA (identity and access) or DE.CM (continuous monitoring). Organisations describe where they are (a current profile) and where they want to be (a target profile); the difference is the work plan. In the lab you map Northwind's twelve controls to CSF, compare with the target profile, discover that the new Govern function is almost empty, and record a control that already exists but wasn't mapped.
15 min
You will learn to
- Name the six CSF 2.0 functions
- Read CSF category and subcategory IDs
- Build a current profile from controls
- Compare it with a target profile
- Explain what the Govern function adds
Key terms
- CSF functions
- Govern, Identify, Protect, Detect, Respond, Recover.
- Category / subcategory
- Groups of outcomes inside a function, and the specific outcomes.
- Current / target profile
- Which outcomes are achieved today / which should be, given the organisation's risks.
- Tiers
- How rigorous and integrated the programme is, from 1 (Partial) to 4 (Adaptive).
- Govern
- Strategy, policy, roles, risk management and supply chain risk: the decisions behind the controls.
← Threat actors and their motives · All lessons · Vulnerability SLAs: measuring remediation →