nist-csf

name	nist-csf
description	Map security controls to NIST Cybersecurity Framework 2.0 functions - Govern, Identify, Protect, Detect, Respond, Recover
license	Apache-2.0

NIST Cybersecurity Framework 2.0 Skill

Purpose

Map security implementations across all Hack23 projects to NIST CSF 2.0 framework functions and categories, ensuring comprehensive cybersecurity coverage aligned with the organization's risk profile.

Rules

CSF Core Functions

MUST address all six CSF 2.0 functions:

GOVERN (GV) - Organizational Context

• MUST maintain organizational cybersecurity strategy
• MUST define risk management strategy and appetite
• MUST establish cybersecurity supply chain risk management
• MUST maintain roles, responsibilities, and authorities

IDENTIFY (ID) - Asset & Risk Management

• MUST maintain inventory of all assets (repositories, infrastructure, data)
• MUST conduct risk assessments annually and after significant changes
• MUST identify and document all data flows and processing activities
• MUST assess improvement opportunities based on lessons learned

PROTECT (PR) - Safeguards

• MUST implement identity management and access control
• MUST enforce data security (encryption at rest and in transit)
• MUST maintain platform and infrastructure security
• MUST implement technology infrastructure resilience

DETECT (DE) - Monitoring

• MUST implement continuous security monitoring
• MUST analyze adverse events for potential incidents
• MUST enable GitHub Advanced Security features on all repositories

RESPOND (RS) - Incident Response

• MUST execute incident management procedures
• MUST perform incident analysis and triage
• MUST report incidents per regulatory requirements
• MUST contain and mitigate incidents promptly

RECOVER (RC) - Recovery

• MUST execute incident recovery plans
• MUST communicate recovery status to stakeholders
• MUST incorporate lessons learned into improved procedures

Implementation Tiers

Tier	Description	Hack23 Target
Tier 1	Partial - Ad hoc responses	Not acceptable
Tier 2	Risk Informed - Awareness exists	Minimum baseline
Tier 3	Repeatable - Formal policies	Target for all projects
Tier 4	Adaptive - Continuous improvement	Aspiration

Hack23 ISMS Policy References

• Information Security Strategy - GV
• Information Security Policy - GV
• Risk Assessment Methodology - ID.RA
• Access Control Policy - PR.AC
• Cryptography Policy - PR.DS
• Secure Development Policy - PR.IP
• Vulnerability Management - DE.CM
• Incident Response Plan - RS
• Business Continuity Plan - RC
• Backup Recovery Policy - RC.RP

References

• NIST CSF 2.0: https://www.nist.gov/cyberframework
• NIST CSF Quick Start Guide: https://doi.org/10.6028/NIST.CSWP.29