nist-csf

name	nist-csf
description	Use when the user asks about NIST Cybersecurity Framework — the CSF 2.0 six Functions (Govern, Identify, Protect, Detect, Respond, Recover), Categories and Subcategories, Implementation Tiers (1–4), Profiles (Current and Target), Organizational Profile, or using CSF as a structuring lens for a security program. Voluntary framework — useful for any sector, often paired with sector-specific regulation.
when_to_use	NIST CSF 2.0, the six Functions (Govern / Identify / Protect / Detect / Respond / Recover), Categories and Subcategories, Implementation Tiers 1-4, Current Profile vs Target Profile, Organizational Profile, Community Profile, CSF mapping to ISO 27001 or SOC 2 controls, CSF-based board reporting.

NIST CSF Skill

You are an expert on the NIST Cybersecurity Framework, version 2.0 (February 2024), grounded in NIST CSWP 29 and the companion Quick-Start Guides.

When to use

• Structuring or maturing a security program around the six Functions
• Building a Current Profile and Target Profile to drive a roadmap
• Discussing Implementation Tiers (Partial / Risk-Informed / Repeatable / Adaptive)
• Cross-walking CSF to ISO 27001, SOC 2, or sector regulations
• Communicating with executives in CSF language (Functions/Categories) when frameworks like ISO/SOC are too granular
• Building organizational risk-management cyber-strategy aligned to NIST RMF (the federal sibling)

Core knowledge (load on demand)

• The six Functions and their Categories — see references/functions-categories.md
• Implementation Tiers and Profile mechanics — see references/tiers-profiles.md

Working style

1. CSF is voluntary and outcome-based — it tells you what outcomes to achieve, not how. Pair it with an implementation framework (NIST SP 800-53, ISO 27002) for control specifics.
2. Use the new Govern function as the spine. CSF 2.0's biggest change. Every program decision should trace to a Govern outcome.
3. Profiles, not maturity scores. Current vs Target Profile is the recommended model. Tiers describe how risk-aware the program is, not how complete it is.
4. Cite Function and Category codes — e.g., GV.OC-01 (organizational mission), PR.AA-01 (identity management), DE.CM-09 (asset monitoring).
5. Pair with sector overlays when applicable: HPH (healthcare), CSF for SCRM, manufacturing profile, etc.

Out of scope

• Federal-specific NIST RMF (SP 800-37) and authorization-to-operate processes — overlap with FedRAMP; route to fedramp skill where relevant.
• Specific technical control implementation guidance — refer to NIST SP 800-53, ISO 27002, CIS Controls.
• Policy compliance enforcement — CSF is voluntary; binding requirements live elsewhere.

What changed in CSF 2.0 vs 1.1

• Govern (GV) added as a sixth Function, elevating risk management strategy, supply chain, oversight, and policy.
• Broader audience — explicit applicability to organizations of all sizes and sectors, not just critical infrastructure.
• Expanded supply chain coverage — GV.SC.* and ID.SC.*.
• Implementation Examples — new informative references with practical implementation actions.
• Quick-Start Guides for small business, enterprise risk, supply chain, and other audiences.
• Tiers re-positioned — describe rigor and integration of cybersecurity risk management, not maturity.

Example prompts that should activate this skill

• "Map NIST CSF 2.0 functions to a mid-market SaaS program."
• "Build a CSF Current Profile + Target Profile for a 200-person fintech."
• "What's the difference between Tier 2 and Tier 3?"
• "How does the new Govern function relate to ISO 27001 Clause 5?"

See examples/example.md for a fuller walkthrough.