csf-2-0version 2.0

NIST Cybersecurity Framework 2.0

134 controls.

Reference	Family	Title
DE	n/a	DETECT
DE.AE	n/a	Adverse Event Analysis
DE.AE-02	n/a	Potentially adverse events are analyzed to better understand associated activities
DE.AE-03	n/a	Information is correlated from multiple sources
DE.AE-04	n/a	The estimated impact and scope of adverse events are understood
DE.AE-06	n/a	Information on adverse events is provided to authorized staff and tools
DE.AE-07	n/a	Cyber threat intelligence and other contextual information are integrated into the analysis
DE.AE-08	n/a	Incidents are declared when adverse events meet the defined incident criteria
DE.CM	n/a	Continuous Monitoring
DE.CM-01	n/a	Networks and network services are monitored to find potentially adverse events
DE.CM-02	n/a	The physical environment is monitored to find potentially adverse events
DE.CM-03	n/a	Personnel activity and technology usage are monitored to find potentially adverse events
DE.CM-06	n/a	External service provider activities and services are monitored to find potentially adverse events
DE.CM-09	n/a	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
GV	n/a	GOVERN
GV.OC	n/a	Organizational Context
GV.OC-01	n/a	The organizational mission is understood and informs cybersecurity risk management
GV.OC-02	n/a	Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered
GV.OC-03	n/a	Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
GV.OC-04	n/a	Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
GV.OC-05	n/a	Outcomes, capabilities, and services that the organization depends on are understood and communicated
GV.OV	n/a	Oversight
GV.OV-01	n/a	Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
GV.OV-02	n/a	The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
GV.OV-03	n/a	Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
GV.PO	n/a	Policy
GV.PO-01	n/a	Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
GV.PO-02	n/a	Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
GV.RM	n/a	Risk Management Strategy
GV.RM-01	n/a	Risk management objectives are established and agreed to by organizational stakeholders
GV.RM-02	n/a	Risk appetite and risk tolerance statements are established, communicated, and maintained
GV.RM-03	n/a	Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
GV.RM-04	n/a	Strategic direction that describes appropriate risk response options is established and communicated
GV.RM-05	n/a	Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
GV.RM-06	n/a	A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
GV.RM-07	n/a	Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
GV.RR	n/a	Roles, Responsibilities, and Authorities
GV.RR-01	n/a	Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
GV.RR-02	n/a	Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
GV.RR-03	n/a	Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies
GV.RR-04	n/a	Cybersecurity is included in human resources practices
GV.SC	n/a	Cybersecurity Supply Chain Risk Management
GV.SC-01	n/a	A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
GV.SC-02	n/a	Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
GV.SC-03	n/a	Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
GV.SC-04	n/a	Suppliers are known and prioritized by criticality
GV.SC-05	n/a	Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
GV.SC-06	n/a	Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
GV.SC-07	n/a	The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
GV.SC-08	n/a	Relevant suppliers and other third parties are included in incident planning, response, and recovery activities

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.