NIST CSF 2.0 (Full)

GV.SC-07 SBOM, ID.AM-05 asset inventory, PR.DS-02 integrity, GV.SC-04 supplier risk.


Short name	CSF 2.0
Region	Americas
Country or scope	United States
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CSF 2.0

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 13 controls from Safeguard's control catalog for CSF 2.0.
Automated tests: 835 map to its controls, and 360 connectors provide automated evidence for them. See NIST CSF 2.0 and connectors.
Policy templates: 25: 3 written for CSF 2.0 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CSF2-ID.AM-02` Software and Services Inventory	Inventories of software, services and systems must be maintained (NIST CSF 2.0 ID.AM-02)	Scan
`CSF2-GV.SC-04` Suppliers Known and Prioritized	Suppliers must be known and prioritized by criticality, presupposing a named supplier for the software components in use (NIST CSF 2.0 GV.SC-04)	Scan
`CSF2-GV.SC-07` Supplier and Product Risk Understanding	The risks posed by suppliers and their products must be understood and recorded, which for software requires components identifiable against risk and vulnerability data (NIST CSF 2.0 GV.SC-07)	Scan
`CSF2-GV.SC-07-SBOM` SBOM as Supply Chain Evidence	Understanding product risk is supported by obtaining bills of materials in standardized machine-readable form (NIST CSF 2.0 GV.SC-07 implementation examples referencing SBOMs)	Scan
`CSF2-ID.RA-01` Vulnerability Identification	Vulnerabilities in assets must be identified, validated and recorded, which requires current version information for the software in those assets (NIST CSF 2.0 ID.RA-01)	Scan
`CSF2-PR.DS-INT` Software Integrity Protection	The integrity of software and data must be protected and verifiable, supported by integrity hashes for components (NIST CSF 2.0 Protect function, data security integrity subcategory)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`GV.OC-01`	Communicate organizational mission and cybersecurity risk
`GV.RM-01`	Define and communicate risk management strategy
`GV.SC-01`	Establish supply chain risk management program
`GV.SC-02`	Establish and maintain supplier security requirements
`ID.AM-01`	Maintain inventory of organizational assets
`ID.AM-07`	Inventory and manage data assets
`PR.AA-01`	Manage identities and credentials for authorized users
`PR.AA-05`	Control access based on least privilege
`DE.CM-01`	Monitor networks and systems for cybersecurity events
`DE.CM-09`	Monitor computing hardware and software supply chain
`RS.CO-01`	Coordinate incident response with stakeholders
`RC.RP-01`	Execute recovery plan for cybersecurity incidents
`RC.RP-05`	Integrate lessons learned into recovery plans

Policy templates

Written for CSF 2.0:

Organizational Cybersecurity Strategy and Governance Policy
Cybersecurity Risk Assessment Policy
Cybersecurity Recovery and Resilience Planning Policy

And 22 from the standard set, adapted to CSF 2.0.