Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-nist-csf-maturity-assessment/references/standards.md

@@ -0,0 +1,87 @@
+# NIST CSF 2.0 Standards Reference
+
+## Primary Standard
+### NIST Cybersecurity Framework (CSF) Version 2.0
+- **Published**: February 26, 2024
+- **Publisher**: National Institute of Standards and Technology (NIST)
+- **Document**: NIST CSWP 29
+- **Scope**: Applicable to all organizations regardless of size, sector, or maturity
+- **Key Change**: Added Govern function as central pillar; expanded from 5 to 6 functions
+
+## CSF 2.0 Core Structure
+
+### GV - Govern
+- GV.OC-01 to GV.OC-05: Organizational context understood
+- GV.RM-01 to GV.RM-07: Risk management strategy established
+- GV.RR-01 to GV.RR-04: Roles, responsibilities, and authorities
+- GV.PO-01 to GV.PO-02: Cybersecurity policy established
+- GV.OV-01 to GV.OV-03: Cybersecurity strategy oversight
+- GV.SC-01 to GV.SC-10: Supply chain risk management
+
+### ID - Identify
+- ID.AM-01 to ID.AM-08: Asset management
+- ID.RA-01 to ID.RA-10: Risk assessment
+- ID.IM-01 to ID.IM-04: Improvement
+- ID.BE (removed in 2.0, moved to GV)
+
+### PR - Protect
+- PR.AA-01 to PR.AA-06: Identity management, authentication, access control
+- PR.AT-01 to PR.AT-02: Awareness and training
+- PR.DS-01 to PR.DS-10: Data security
+- PR.PS-01 to PR.PS-06: Platform security
+- PR.IR-01 to PR.IR-02: Technology infrastructure resilience
+
+### DE - Detect
+- DE.CM-01 to DE.CM-09: Continuous monitoring
+- DE.AE-01 to DE.AE-08: Adverse event analysis
+
+### RS - Respond
+- RS.MA-01 to RS.MA-05: Incident management
+- RS.AN-01 to RS.AN-08: Incident analysis
+- RS.CO-01 to RS.CO-03: Incident response reporting and communication
+- RS.MI-01 to RS.MI-02: Incident mitigation
+
+### RC - Recover
+- RC.RP-01 to RC.RP-06: Incident recovery plan execution
+
+## Implementation Tiers Detail
+
+### Tier 1: Partial
+- **Risk Management Process**: Ad hoc; not formalized
+- **Integrated Risk Management**: Limited awareness; irregular risk practices
+- **External Participation**: No formal collaboration with external entities
+- **Governance**: Cybersecurity not integrated into enterprise risk management
+
+### Tier 2: Risk-Informed
+- **Risk Management Process**: Approved by management but may not be policy
+- **Integrated Risk Management**: Awareness at organizational level; some sharing
+- **External Participation**: Aware of ecosystem role; limited collaboration
+- **Governance**: Some integration of cybersecurity into enterprise risk
+
+### Tier 3: Repeatable
+- **Risk Management Process**: Formally approved policies; regularly updated
+- **Integrated Risk Management**: Organization-wide approach; consistent implementation
+- **External Participation**: Regular collaboration with partners and ecosystem
+- **Governance**: Cybersecurity fully integrated into enterprise risk management
+
+### Tier 4: Adaptive
+- **Risk Management Process**: Continuous improvement using advanced techniques
+- **Integrated Risk Management**: Real-time shared awareness; dynamic risk response
+- **External Participation**: Active leadership in ecosystem risk management
+- **Governance**: Agile cybersecurity governance adapting to changes
+
+## Related NIST Publications
+- **SP 800-53 Rev 5**: Security and Privacy Controls (detailed control catalog)
+- **SP 800-37 Rev 2**: Risk Management Framework (RMF)
+- **SP 800-30 Rev 1**: Guide for Conducting Risk Assessments
+- **SP 800-171 Rev 3**: Protecting CUI in Nonfederal Systems
+- **SP 800-207**: Zero Trust Architecture
+- **SP 800-218**: Secure Software Development Framework (SSDF)
+
+## CSF 2.0 Informative References
+The CSF references specific controls from:
+- NIST SP 800-53 Rev 5
+- ISO/IEC 27001:2022
+- CIS Controls v8
+- COBIT 2019
+- ISA/IEC 62443 (Industrial Control Systems)