mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-26 06:10:57 +03:00
mukul975
efca3ec611
Mapped every skill to NIST CSF 2.0 subcategory IDs (GV/ID/PR/DE/RS/RC functions) based on subdomain and content analysis. Restores 11 skills corrupted during prior rebase, re-enriching with ATLAS, D3FEND, NIST AI RMF, and CSF 2.0 fields. All 754 skills now carry structured mappings for all 5 security frameworks: - MITRE ATT&CK (in tags) - MITRE ATLAS v5.5 (atlas_techniques) - MITRE D3FEND v1.3 (d3fend_techniques) - NIST AI RMF 1.0 (nist_ai_rmf) - NIST CSF 2.0 (nist_csf)
132 lines
5.8 KiB
Markdown
132 lines
5.8 KiB
Markdown
---
|
|
name: performing-nist-csf-maturity-assessment
|
|
description: >-
|
|
The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, provides a
|
|
comprehensive taxonomy for managing cybersecurity risk through six core Functions -
|
|
Govern, Identify, Protect, Detect, Respond, and Recover. This skill covers conducting
|
|
a maturity assessment against the CSF using Implementation Tiers to measure organizational
|
|
cybersecurity posture and create improvement roadmaps.
|
|
domain: cybersecurity
|
|
subdomain: compliance-governance
|
|
tags: [compliance, governance, nist, csf, maturity-assessment, risk-management]
|
|
nist_csf: [GV.OC-01, GV.RM-01, GV.PO-01, ID.RA-01, GV.OV-01]
|
|
version: "1.0"
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
---
|
|
# Performing NIST CSF Maturity Assessment
|
|
|
|
## Overview
|
|
The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, provides a comprehensive taxonomy for managing cybersecurity risk through six core Functions: Govern, Identify, Protect, Detect, Respond, and Recover. This skill covers conducting a maturity assessment against the CSF, using the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) to measure organizational cybersecurity posture and create improvement roadmaps.
|
|
|
|
|
|
## When to Use
|
|
|
|
- When conducting security assessments that involve performing nist csf maturity assessment
|
|
- When following incident response procedures for related security events
|
|
- When performing scheduled security testing or auditing activities
|
|
- When validating security controls through hands-on testing
|
|
|
|
## Prerequisites
|
|
- Understanding of cybersecurity risk management principles
|
|
- Access to NIST CSF 2.0 documentation and reference tool
|
|
- Knowledge of organizational IT/OT environment and security controls
|
|
- Stakeholder access across business units for assessment interviews
|
|
|
|
## Core Concepts
|
|
|
|
### CSF 2.0 Functions (6 Functions, 22 Categories)
|
|
|
|
| Function | Code | Categories | Purpose |
|
|
|----------|------|-----------|---------|
|
|
| **Govern** | GV | 6 | Establish and monitor cybersecurity risk management strategy |
|
|
| **Identify** | ID | 3 | Determine current cybersecurity risk to the organization |
|
|
| **Protect** | PR | 5 | Implement safeguards to prevent or reduce risk |
|
|
| **Detect** | DE | 2 | Find and analyze possible cybersecurity attacks |
|
|
| **Respond** | RS | 4 | Take action regarding detected cybersecurity incidents |
|
|
| **Recover** | RC | 2 | Restore capabilities impaired by cybersecurity incidents |
|
|
|
|
### Govern Function (New in CSF 2.0)
|
|
- GV.OC: Organizational Context
|
|
- GV.RM: Risk Management Strategy
|
|
- GV.RR: Roles, Responsibilities, and Authorities
|
|
- GV.PO: Policy
|
|
- GV.OV: Oversight
|
|
- GV.SC: Cybersecurity Supply Chain Risk Management
|
|
|
|
### Implementation Tiers
|
|
| Tier | Name | Description |
|
|
|------|------|-------------|
|
|
| Tier 1 | Partial | Ad hoc, reactive; limited awareness of cybersecurity risk |
|
|
| Tier 2 | Risk-Informed | Risk-aware but not organization-wide; approved but may not be policy |
|
|
| Tier 3 | Repeatable | Formal policies; consistently implemented; regularly updated |
|
|
| Tier 4 | Adaptive | Continuous improvement; real-time risk response; lessons learned integrated |
|
|
|
|
## Workflow
|
|
|
|
### Phase 1: Scoping and Preparation (Weeks 1-2)
|
|
1. Define assessment scope (enterprise-wide vs. business unit)
|
|
2. Identify stakeholders and schedule interviews
|
|
3. Gather existing documentation (policies, procedures, architecture diagrams)
|
|
4. Customize CSF Profile for organizational context
|
|
5. Select assessment methodology (self-assessment, facilitated, third-party)
|
|
|
|
### Phase 2: Current State Assessment (Weeks 3-6)
|
|
1. Assess each CSF Category and Subcategory against Implementation Tiers
|
|
2. For each subcategory, evaluate:
|
|
- Policy/documentation maturity
|
|
- Implementation completeness
|
|
- Automation level
|
|
- Measurement and metrics
|
|
- Continuous improvement evidence
|
|
3. Score using tier criteria (1-4 scale)
|
|
4. Document evidence supporting each tier rating
|
|
5. Identify strengths, gaps, and improvement areas
|
|
|
|
### Phase 3: Target State Definition (Weeks 7-8)
|
|
1. Define target tier for each Function based on:
|
|
- Risk appetite and tolerance
|
|
- Industry requirements and benchmarks
|
|
- Regulatory obligations
|
|
- Available resources and budget
|
|
2. Create Target Profile documenting desired maturity state
|
|
3. Validate target state with executive leadership
|
|
|
|
### Phase 4: Gap Analysis and Roadmap (Weeks 9-12)
|
|
1. Compare Current Profile to Target Profile
|
|
2. Prioritize gaps based on risk reduction potential
|
|
3. Develop improvement roadmap with:
|
|
- Short-term quick wins (0-3 months)
|
|
- Medium-term improvements (3-12 months)
|
|
- Long-term strategic initiatives (12-24 months)
|
|
4. Estimate resource requirements for each initiative
|
|
5. Assign ownership and timelines
|
|
|
|
### Phase 5: Implementation and Reassessment (Ongoing)
|
|
1. Execute improvement roadmap initiatives
|
|
2. Track progress against milestones
|
|
3. Conduct periodic reassessments (annually recommended)
|
|
4. Report maturity progress to leadership
|
|
5. Adjust roadmap based on evolving threats and business changes
|
|
|
|
## Key Artifacts
|
|
- CSF Current Profile (by Function/Category/Subcategory)
|
|
- CSF Target Profile
|
|
- Gap Analysis Report
|
|
- Maturity Assessment Scorecard
|
|
- Improvement Roadmap with Priorities
|
|
- Executive Summary and Dashboard
|
|
|
|
## Common Pitfalls
|
|
- Assessing technology only without evaluating governance and people
|
|
- Setting unrealistic target tiers without resource commitment
|
|
- Treating assessment as one-time rather than continuous process
|
|
- Ignoring the new Govern function in CSF 2.0
|
|
- Not aligning CSF assessment with existing compliance requirements (ISO 27001, SOC 2)
|
|
|
|
## References
|
|
- NIST CSF 2.0: https://csf.tools/reference/nist-cybersecurity-framework/v2-0/
|
|
- NIST SP 800-53 Rev 5 (control catalog that maps to CSF)
|
|
- NIST CSF 2.0 Quick Start Guides
|
|
- CSF 2.0 Reference Tool: https://csrc.nist.gov/projects/cybersecurity-framework
|