Nist Csf Assessment

---
name: nist-csf-assessment
enabled: true
description: |
  Use when performing nist csf assessment — conducts an assessment against the
  NIST Cybersecurity Framework (CSF 2.0), evaluating organizational maturity
  across all six core functions: Govern, Identify, Protect, Detect, Respond, and
  Recover. Produces a current state profile, target profile, and prioritized gap
  remediation plan.
required_connections:
  - prefix: grc-tool
    label: "GRC Platform"
config_fields:
  - key: organization_name
    label: "Organization Name"
    required: true
    placeholder: "e.g., Acme Corp"
  - key: industry
    label: "Industry Sector"
    required: true
    placeholder: "e.g., Financial Services, Healthcare, Technology"
  - key: target_tier
    label: "Target Implementation Tier"
    required: false
    placeholder: "e.g., Tier 2 (Risk Informed), Tier 3 (Repeatable)"
features:
  - COMPLIANCE
  - NIST
  - CYBERSECURITY
---

# NIST Cybersecurity Framework 2.0 Assessment

## Phase 1: Scoping & Context
1. Define assessment scope
   - [ ] Business units included
   - [ ] Systems and assets in scope
   - [ ] Critical business processes
   - [ ] Regulatory requirements applicable
2. Identify stakeholders and interview participants
3. Gather existing security documentation
4. Define target implementation tier

### Implementation Tier Assessment

| Criterion | Tier 1 (Partial) | Tier 2 (Risk Informed) | Tier 3 (Repeatable) | Tier 4 (Adaptive) |
|-----------|-----------------|----------------------|--------------------|--------------------|
| Risk Management Process | Ad hoc | Approved but informal | Formal, org-wide | Continuously improving |
| Integrated Risk Program | Limited | Some awareness | Org-wide awareness | Active participation |
| External Participation | None | Informal | Formal agreements | Active contribution |
| **Current Tier** | [ ] | [ ] | [ ] | [ ] |
| **Target Tier** | [ ] | [ ] | [ ] | [ ] |

## Phase 2: Govern (GV) Function Assessment
- [ ] GV.OC - Organizational Context understood
- [ ] GV.RM - Risk Management Strategy established
- [ ] GV.RR - Roles, Responsibilities, and Authorities defined
- [ ] GV.PO - Policy established and communicated
- [ ] GV.OV - Oversight of cybersecurity strategy
- [ ] GV.SC - Supply Chain Risk Management

## Phase 3: Identify (ID) Function Assessment
- [ ] ID.AM - Asset Management
- [ ] ID.RA - Risk Assessment
- [ ] ID.IM - Improvement processes

## Phase 4: Protect (PR) Function Assessment
- [ ] PR.AA - Identity Management, Authentication, and Access Control
- [ ] PR.AT - Awareness and Training
- [ ] PR.DS - Data Security
- [ ] PR.PS - Platform Security
- [ ] PR.IR - Technology Infrastructure Resilience

## Phase 5: Detect (DE) Function Assessment
- [ ] DE.CM - Continuous Monitoring
- [ ] DE.AE - Adverse Event Analysis

## Phase 6: Respond (RS) Function Assessment
- [ ] RS.MA - Incident Management
- [ ] RS.AN - Incident Analysis
- [ ] RS.CO - Incident Response Reporting and Communication
- [ ] RS.MI - Incident Mitigation

## Phase 7: Recover (RC) Function Assessment
- [ ] RC.RP - Incident Recovery Plan Execution
- [ ] RC.CO - Recovery Communication

### Maturity Scoring Summary

| Function | Categories | Current Score (1-4) | Target Score (1-4) | Gap |
|----------|-----------|--------------------|--------------------|-----|
| Govern (GV) | 6 | | | |
| Identify (ID) | 3 | | | |
| Protect (PR) | 5 | | | |
| Detect (DE) | 2 | | | |
| Respond (RS) | 4 | | | |
| Recover (RC) | 2 | | | |
| **Overall** | **22** | | | |

## Phase 8: Gap Analysis & Roadmap
1. Compare current profile to target profile
2. Prioritize gaps by risk and business impact
3. Develop remediation roadmap with quick wins and long-term initiatives
4. Estimate resource requirements per initiative
5. Define success metrics and milestones

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format
- **Current State Profile**: Maturity score per function and category
- **Target State Profile**: Desired maturity levels with justification
- **Gap Analysis**: Prioritized list of gaps with severity
- **Remediation Roadmap**: Phased plan with timelines and resources
- **Executive Summary**: One-page overview for leadership

## Action Items
- [ ] Complete stakeholder interviews
- [ ] Assess all six CSF functions
- [ ] Score current and target maturity levels
- [ ] Prioritize gaps by risk impact
- [ ] Develop phased remediation roadmap
- [ ] Present findings to executive leadership
- [ ] Schedule follow-up assessment in 12 months