mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-09-02 06:30:50 +03:00
mukul975
cb8d79e068
- Add validated mitre_attack frontmatter to all 754 skills (286 distinct techniques), verified against MITRE ATT&CK v19.1 via the official mitreattack-python library: 0 revoked, deprecated, or invalid IDs - Curate precise per-skill technique IDs for forensics, malware-analysis, threat-intel, and red-team skills (e.g. DCSync -> T1003.006, Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003) - Reconcile v19.1 tactic restructuring: Defense Evasion split into Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.* family and T1070.001/.002 remapped to active equivalents (T1685.*) - Normalize word-split tags across 35 skills (remove filename-derived stopword tags, add semantic cybersecurity tags) - Add api-reference.md for 3 skills that were missing it - Update README ATT&CK section with accurate v19.1 tactic distribution
146 lines
5.8 KiB
Markdown
146 lines
5.8 KiB
Markdown
---
|
|
name: performing-nist-csf-maturity-assessment
|
|
description: The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024,
|
|
provides a comprehensive taxonomy for managing cybersecurity risk through six core
|
|
Functions - Govern, Identify, Protect, Detect, Respond, and Recover. This skill
|
|
covers conducting a maturity assessment against the CSF using Implementation Tiers
|
|
to measure organizational cybersecurity posture and create improvement roadmaps.
|
|
domain: cybersecurity
|
|
subdomain: compliance-governance
|
|
tags:
|
|
- compliance
|
|
- governance
|
|
- nist
|
|
- csf
|
|
- maturity-assessment
|
|
- risk-management
|
|
nist_csf:
|
|
- GV.OC-01
|
|
- GV.RM-01
|
|
- GV.PO-01
|
|
- ID.RA-01
|
|
- GV.OV-01
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1078
|
|
- T1530
|
|
- T1685.002
|
|
---
|
|
# Performing NIST CSF Maturity Assessment
|
|
|
|
## Overview
|
|
The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, provides a comprehensive taxonomy for managing cybersecurity risk through six core Functions: Govern, Identify, Protect, Detect, Respond, and Recover. This skill covers conducting a maturity assessment against the CSF, using the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) to measure organizational cybersecurity posture and create improvement roadmaps.
|
|
|
|
|
|
## When to Use
|
|
|
|
- When conducting security assessments that involve performing nist csf maturity assessment
|
|
- When following incident response procedures for related security events
|
|
- When performing scheduled security testing or auditing activities
|
|
- When validating security controls through hands-on testing
|
|
|
|
## Prerequisites
|
|
- Understanding of cybersecurity risk management principles
|
|
- Access to NIST CSF 2.0 documentation and reference tool
|
|
- Knowledge of organizational IT/OT environment and security controls
|
|
- Stakeholder access across business units for assessment interviews
|
|
|
|
## Core Concepts
|
|
|
|
### CSF 2.0 Functions (6 Functions, 22 Categories)
|
|
|
|
| Function | Code | Categories | Purpose |
|
|
|----------|------|-----------|---------|
|
|
| **Govern** | GV | 6 | Establish and monitor cybersecurity risk management strategy |
|
|
| **Identify** | ID | 3 | Determine current cybersecurity risk to the organization |
|
|
| **Protect** | PR | 5 | Implement safeguards to prevent or reduce risk |
|
|
| **Detect** | DE | 2 | Find and analyze possible cybersecurity attacks |
|
|
| **Respond** | RS | 4 | Take action regarding detected cybersecurity incidents |
|
|
| **Recover** | RC | 2 | Restore capabilities impaired by cybersecurity incidents |
|
|
|
|
### Govern Function (New in CSF 2.0)
|
|
- GV.OC: Organizational Context
|
|
- GV.RM: Risk Management Strategy
|
|
- GV.RR: Roles, Responsibilities, and Authorities
|
|
- GV.PO: Policy
|
|
- GV.OV: Oversight
|
|
- GV.SC: Cybersecurity Supply Chain Risk Management
|
|
|
|
### Implementation Tiers
|
|
| Tier | Name | Description |
|
|
|------|------|-------------|
|
|
| Tier 1 | Partial | Ad hoc, reactive; limited awareness of cybersecurity risk |
|
|
| Tier 2 | Risk-Informed | Risk-aware but not organization-wide; approved but may not be policy |
|
|
| Tier 3 | Repeatable | Formal policies; consistently implemented; regularly updated |
|
|
| Tier 4 | Adaptive | Continuous improvement; real-time risk response; lessons learned integrated |
|
|
|
|
## Workflow
|
|
|
|
### Phase 1: Scoping and Preparation (Weeks 1-2)
|
|
1. Define assessment scope (enterprise-wide vs. business unit)
|
|
2. Identify stakeholders and schedule interviews
|
|
3. Gather existing documentation (policies, procedures, architecture diagrams)
|
|
4. Customize CSF Profile for organizational context
|
|
5. Select assessment methodology (self-assessment, facilitated, third-party)
|
|
|
|
### Phase 2: Current State Assessment (Weeks 3-6)
|
|
1. Assess each CSF Category and Subcategory against Implementation Tiers
|
|
2. For each subcategory, evaluate:
|
|
- Policy/documentation maturity
|
|
- Implementation completeness
|
|
- Automation level
|
|
- Measurement and metrics
|
|
- Continuous improvement evidence
|
|
3. Score using tier criteria (1-4 scale)
|
|
4. Document evidence supporting each tier rating
|
|
5. Identify strengths, gaps, and improvement areas
|
|
|
|
### Phase 3: Target State Definition (Weeks 7-8)
|
|
1. Define target tier for each Function based on:
|
|
- Risk appetite and tolerance
|
|
- Industry requirements and benchmarks
|
|
- Regulatory obligations
|
|
- Available resources and budget
|
|
2. Create Target Profile documenting desired maturity state
|
|
3. Validate target state with executive leadership
|
|
|
|
### Phase 4: Gap Analysis and Roadmap (Weeks 9-12)
|
|
1. Compare Current Profile to Target Profile
|
|
2. Prioritize gaps based on risk reduction potential
|
|
3. Develop improvement roadmap with:
|
|
- Short-term quick wins (0-3 months)
|
|
- Medium-term improvements (3-12 months)
|
|
- Long-term strategic initiatives (12-24 months)
|
|
4. Estimate resource requirements for each initiative
|
|
5. Assign ownership and timelines
|
|
|
|
### Phase 5: Implementation and Reassessment (Ongoing)
|
|
1. Execute improvement roadmap initiatives
|
|
2. Track progress against milestones
|
|
3. Conduct periodic reassessments (annually recommended)
|
|
4. Report maturity progress to leadership
|
|
5. Adjust roadmap based on evolving threats and business changes
|
|
|
|
## Key Artifacts
|
|
- CSF Current Profile (by Function/Category/Subcategory)
|
|
- CSF Target Profile
|
|
- Gap Analysis Report
|
|
- Maturity Assessment Scorecard
|
|
- Improvement Roadmap with Priorities
|
|
- Executive Summary and Dashboard
|
|
|
|
## Common Pitfalls
|
|
- Assessing technology only without evaluating governance and people
|
|
- Setting unrealistic target tiers without resource commitment
|
|
- Treating assessment as one-time rather than continuous process
|
|
- Ignoring the new Govern function in CSF 2.0
|
|
- Not aligning CSF assessment with existing compliance requirements (ISO 27001, SOC 2)
|
|
|
|
## References
|
|
- NIST CSF 2.0: https://csf.tools/reference/nist-cybersecurity-framework/v2-0/
|
|
- NIST SP 800-53 Rev 5 (control catalog that maps to CSF)
|
|
- NIST CSF 2.0 Quick Start Guides
|
|
- CSF 2.0 Reference Tool: https://csrc.nist.gov/projects/cybersecurity-framework
|