nist-csf-specialist

NIST CSF 2.0 Specialist

Implement, assess, and manage cybersecurity programs aligned with the NIST Cybersecurity Framework 2.0 — the definitive standard for organizational cybersecurity risk management. CSF 2.0 (Feb 2024) applies to all organizations and adds GOVERN as a sixth, top-level function alongside IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER.

Core Capabilities

• Maturity assessment — score all 22 categories across 6 functions on the 1–4 tier scale (Partial → Risk Informed → Repeatable → Adaptive) with evidence-backed gap analysis
• Profiles & gap analysis — build current and target profiles, then derive a prioritized, phased remediation roadmap
• Cross-framework mapping — map CSF categories to ISO 27001:2022, SOC 2 TSC, HIPAA Security Rule, and PCI-DSS v4.0 to reduce dual-audit burden
• Program implementation — 12-month phased roadmap covering governance, core protections, detection/response, and resilience

When to Use

Use this skill when you hear: "NIST cybersecurity framework", "CSF 2.0", "NIST compliance", "cybersecurity risk management", "NIST controls", "NIST assessment", "cybersecurity maturity", "NIST CSF profile", "cybersecurity governance", "cybersecurity program assessment", "CSF gap analysis", or "cross-framework compliance mapping".

Clarify First

Before running the assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• [ ] Target tier — Partial, Risk Informed, Repeatable, or Adaptive goal (drives the gap analysis and remediation roadmap)
• [ ] Current-state data — the present maturity scores across the 6 functions / 22 categories (the scoring depends on it)
• [ ] Task — maturity assessment, profile/gap analysis, or cross-framework mapping (selects the script and any target framework)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the maturity report.

Quick Start

# Assess cybersecurity maturity against a target tier
python scripts/csf_maturity_assessor.py --input assessment.json --target-tier 3 --output maturity_report.json

# Map controls across frameworks
python scripts/csf_control_mapper.py --source-framework nist-csf --target-framework iso27001 --output mapping.json

# Generate a markdown gap analysis
python scripts/csf_maturity_assessor.py --input assessment.json --target-tier 4 --format markdown --output gap_analysis.md

# Build a multi-framework unified matrix
python scripts/csf_control_mapper.py --source-framework nist-csf --target-framework all --output unified_matrix.json

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

• [references/framework-reference.md](references/framework-reference.md) — CSF 2.0 overview, the six functions with all categories (key activities, implementation guidance, maturity indicators), profiles, tiers, and the full cross-framework mapping tables (ISO 27001, SOC 2, HIPAA, PCI-DSS). Read when you need framework foundations or mapping detail.
• [references/assessment-and-roadmap.md](references/assessment-and-roadmap.md) — per-function assessment checklists, the 5-week maturity-assessment workflow, the 12-month implementation roadmap, validation checkpoints, and success criteria. Read when planning or running an engagement.
• [references/tools-and-troubleshooting.md](references/tools-and-troubleshooting.md) — detailed tool capabilities, input JSON format, full usage examples, flag reference tables, and the troubleshooting guide. Read when running the scripts or debugging output.
• [references/csf-functions-guide.md](references/csf-functions-guide.md) — complete CSF 2.0 taxonomy: every function, category, subcategory, evidence requirement, and common assessment question. Read for subcategory-level depth during detailed assessment.
• [references/csf-implementation-playbook.md](references/csf-implementation-playbook.md) — step-by-step implementation guide with templates, prioritization, and budgeting. Read when standing up or maturing a program.

Scope & Limitations

In Scope:

• NIST CSF 2.0 maturity assessment across all 6 functions and 22 categories
• Current and target profile creation with gap analysis
• Cross-framework control mapping to ISO 27001:2022, SOC 2 TSC, HIPAA Security Rule, and PCI-DSS v4.0
• Implementation roadmap generation with phased milestones
• Tier-based scoring (Partial, Risk Informed, Repeatable, Adaptive)

Out of Scope:

• NIST SP 800-53 control-level implementation (CSF is a framework, not a control catalog; use SP 800-53 for prescriptive controls)
• Technical security testing, vulnerability scanning, or penetration testing (use infrastructure-compliance-auditor)
• Sector-specific Community Profiles (the tool provides organizational profiles; community profiles require sector-specific customization)
• Real-time security monitoring or SIEM configuration
• Compliance certification (NIST CSF is voluntary and does not offer formal certification)
• Legal or regulatory advice on specific compliance obligations

Integration Points

| Skill | Integration |

|-------|------------|

| [soc2-compliance-expert](../soc2-compliance-expert/) | SOC 2 TSC maps directly to CSF functions; use the control mapper to generate a unified control matrix reducing dual-audit burden |

| [information-security-manager-iso27001](../information-security-manager-iso27001/) | ISO 27001 Annex A controls are the implementation backbone for CSF categories; CSF maturity scores inform ISMS continual improvement |

| [infrastructure-compliance-auditor](../infrastructure-compliance-auditor/) | Validates technical controls (access, encryption, monitoring, endpoints) that underpin PROTECT and DETECT function scores |

| [pci-dss-specialist](../pci-dss-specialist/) | PCI-DSS v4.0 requirements map to CSF categories; use cross-framework mapper for payment environments |

| [nis2-directive-specialist](../nis2-directive-specialist/) | NIS2 Article 21 measures align to CSF functions; CSF maturity assessment benchmarks NIS2 compliance posture |

| [dora-compliance-expert](../dora-compliance-expert/) | DORA ICT risk management pillars map to GOVERN and IDENTIFY functions; use CSF as the unifying assessment framework |