Compliance FrameworksAmericas
NIST CSF 2.0
Cybersecurity Framework 2.0: identify, protect, detect, respond, and recover functions.
Cybersecurity Framework 2.0: identify, protect, detect, respond, and recover functions.
| Short name | NIST CSF |
| Region | Americas |
| Country or scope | United States |
| Sector | Government |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers NIST CSF
- Scan requirements: 7, all decided by a scan.
- Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for NIST CSF.
- Automated tests: none map to it directly. Evidence from the frameworks the crosswalk relates it to counts toward its controls where a reviewed or approved equivalent row links them (the crosswalk).
- Policy templates: 25: 3 written for NIST CSF and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
CSF-ID.AM-1 Asset Inventory | Software assets must be inventoried (NIST CSF ID.AM-1) | Scan |
CSF-ID.AM-2 Software Platform Enumeration | Software platforms and applications must be enumerated (NIST CSF ID.AM-2) | Scan |
CSF-ID.SC-1 Supply Chain Risk Policy | Supply chain risk management policy must be established (NIST CSF ID.SC-1) | Scan |
CSF-PR.DS-6 Integrity Checking | Integrity checking mechanisms must be used to verify software (NIST CSF PR.DS-6) | Scan |
CSF-DE.CM-4 Malicious Code Detection | Malicious code must be detectable in software (NIST CSF DE.CM-4) | Scan |
CSF-RS.AN-3 Forensic Evidence Preservation | Evidence must be preserved to support incident analysis (NIST CSF RS.AN-3) | Scan |
CSF-RC.IM-1 Recovery Plan Incorporated | Recovery plans must incorporate SBOM-driven dependency awareness (NIST CSF RC.IM-1) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
ID.AM-1 | Inventory physical and software assets |
ID.RA-1 | Identify and document asset vulnerabilities |
ID.GV-1 | Establish and communicate cybersecurity policy |
PR.AC-1 | Manage identities and credentials for authorized users |
PR.DS-1 | Protect data at rest |
PR.IP-1 | Maintain baseline configuration of systems |
DE.CM-1 | Monitor the network for cybersecurity events |
DE.AE-2 | Analyze detected events to understand attack targets |
RS.RP-1 | Execute an incident response plan |
RC.RP-1 | Execute a recovery plan post-incident |
RS.CO-2 | Report cybersecurity incidents per established criteria |
PR.AT-1 | Provide security awareness training to all users |
Policy templates
Written for NIST CSF:
- Cybersecurity Supply Chain Risk Governance Policy
- Asset Identification and Management Policy
- Continuous Cybersecurity Monitoring Policy
And 22 from the standard set, adapted to NIST CSF.