# NIST csf mapping
> Source: https://legalcode.md/skills/legalcode-nist-csf-mapping | [HTML version](https://legalcode.md/skills/legalcode-nist-csf-mapping)

NIST Cybersecurity Framework 2.0 (CSWP 29, February 2024) mapping and maturity assessment for organizations implementing, assessing, or reporting against NIST…

NIST Cybersecurity Framework 2.0 (CSWP 29, February 2024) mapping and maturity assessment for organizations implementing, assessing, or reporting against NIST CSF 2.0 across all six functions (Govern, Identify, Protect, Detect, Respond, Recover) and 22 categories. Cross-framework mapping to ISO 27001:2022, SOC 2 Trust Services Criteria (CC1–CC9, Availability, Confidentiality, Privacy), CIS Controls v8 (18 controls / 153 safeguards / IG1–IG3), CMMC 2.0 (Levels 1–3 / NIST SP 800-171/172), and COBIT 2019 (40 governance and management objectives). Regulatory overlay assessment for HIPAA Security Rule (NIST SP 800-66r2), GLBA/FTC Safeguards Rule, SEC cybersecurity disclosure rules, FISMA, NYDFS 23 NYCRR Part 500, and NIS2 Directive (2022/2555) CSF alignment. Use when assessing current-state CSF maturity, designing a Target Profile, performing gap analysis between Current and Target Profiles, preparing for a third-party CSF assessment, mapping CSF to other compliance frameworks for harmonized control implementation, benchmarking maturity against industry peers, or producing board-ready cybersecurity governance reporting. Covers all 106 CSF 2.0 subcategories with implementation evidence requirements, Tier 1–4 maturity characterization per function and overall, control-gap-to-regulatory-obligation mapping, and POAM (Plan of Action and Milestones) generation. Produces current-state maturity assessments with Partial/Risk-Informed/Repeatable/Adaptive tier classifications, cross-framework alignment matrices, prioritized implementation roadmaps (IMMEDIATE/ NEAR-TERM/BACKGROUND), GRC-platform-ready control-to-requirement mapping tables, and Glass Box audit trails. Jurisdiction-agnostic core (NIST CSF 2.0, US-originated but internationally adopted) with [JURISDICTION-SPECIFIC] markers for sector-specific regulatory overlays (HIPAA, GLBA, SEC, FISMA, NYDFS, NIS2, CRA) and international alignment (Italy National Cybersecurity Framework, ISO 27001 parallel certification paths).

This skill assesses an organization's cybersecurity control posture against the NIST Cybersecurity Framework 2.0 (CSWP 29) and produces cross-framework mappings, maturity tier assessments, gap analyses, and prioritized implementation roadmaps. It is designed for GRC professionals, CISOs, security compliance teams, and external assessors working with CSF as a risk management or regulatory alignment tool. **Covers:** - All six CSF 2.0 functions: **Govern (GV)**, Identify (ID), Protect (PR), Detect (DE), Respond (RS), Recover (RC) — with all 22 categories and 106 subcategories - Implementation Tier characterization (Tier 1: Partial through Tier 4: Adaptive) per function and overall organizational posture - Current Profile assessment and Target Profile development with gap analysis - Cross-framework mapping: CSF 2.0 ↔ ISO 27001:2022, SOC 2 TSC, CIS Controls v8, CMMC 2.0 (NIST SP 800-171/172), and COBIT 2019 - Regulatory overlay assessment for sector-specific obligations (HIPAA, GLBA/FTC Safeguards Rule, SEC cybersecurity disclosure, FISMA, NYDFS Part 500, NIS2) - POAM generation: prioritized remediation tasks with owners, timelines, and success metrics - GRC platform export guidance (ServiceNow, OneTrust, Archer, LogicGate, Cybersaint) - Control redundancy and harmonization analysis across multiple frameworks **Does not:** - Issue NIST CSF certifications or endorse organizational assessments (NIST does not do this) - Provide formal compliance ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*