csf-2-0version 2.0

NIST Cybersecurity Framework 2.0

134 controls.

Reference	Family	Title
GV.SC-09	n/a	Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
GV.SC-10	n/a	Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement
ID	n/a	IDENTIFY
ID.AM	n/a	Asset Management
ID.AM-01	n/a	Inventories of hardware managed by the organization are maintained
ID.AM-02	n/a	Inventories of software, services, and systems managed by the organization are maintained
ID.AM-03	n/a	Representations of the organization's authorized network communication and internal and external network data flows are maintained
ID.AM-04	n/a	Inventories of services provided by suppliers are maintained
ID.AM-05	n/a	Assets are prioritized based on classification, criticality, resources, and impact on the mission
ID.AM-07	n/a	Inventories of data and corresponding metadata for designated data types are maintained
ID.AM-08	n/a	Systems, hardware, software, services, and data are managed throughout their life cycles
ID.IM	n/a	Improvement
ID.IM-01	n/a	Improvements are identified from evaluations
ID.IM-02	n/a	Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
ID.IM-03	n/a	Improvements are identified from execution of operational processes, procedures, and activities
ID.IM-04	n/a	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
ID.RA	n/a	Risk Assessment
ID.RA-01	n/a	Vulnerabilities in assets are identified, validated, and recorded
ID.RA-02	n/a	Cyber threat intelligence is received from information sharing forums and sources
ID.RA-03	n/a	Internal and external threats to the organization are identified and recorded
ID.RA-04	n/a	Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
ID.RA-05	n/a	Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
ID.RA-06	n/a	Risk responses are chosen, prioritized, planned, tracked, and communicated
ID.RA-07	n/a	Changes and exceptions are managed, assessed for risk impact, recorded, and tracked
ID.RA-08	n/a	Processes for receiving, analyzing, and responding to vulnerability disclosures are established
ID.RA-09	n/a	The authenticity and integrity of hardware and software are assessed prior to acquisition and use
ID.RA-10	n/a	Critical suppliers are assessed prior to acquisition
PR	n/a	PROTECT
PR.AA	n/a	Identity Management, Authentication, and Access Control
PR.AA-01	n/a	Identities and credentials for authorized users, services, and hardware are managed by the organization
PR.AA-02	n/a	Identities are proofed and bound to credentials based on the context of interactions
PR.AA-03	n/a	Users, services, and hardware are authenticated
PR.AA-04	n/a	Identity assertions are protected, conveyed, and verified
PR.AA-05	n/a	Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
PR.AA-06	n/a	Physical access to assets is managed, monitored, and enforced commensurate with risk
PR.AT	n/a	Awareness and Training
PR.AT-01	n/a	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
PR.AT-02	n/a	Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
PR.DS	n/a	Data Security
PR.DS-01	n/a	The confidentiality, integrity, and availability of data-at-rest are protected
PR.DS-02	n/a	The confidentiality, integrity, and availability of data-in-transit are protected
PR.DS-10	n/a	The confidentiality, integrity, and availability of data-in-use are protected
PR.DS-11	n/a	Backups of data are created, protected, maintained, and tested
PR.IR	n/a	Technology Infrastructure Resilience
PR.IR-01	n/a	Networks and environments are protected from unauthorized logical access and usage
PR.IR-02	n/a	The organization's technology assets are protected from environmental threats
PR.IR-03	n/a	Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
PR.IR-04	n/a	Adequate resource capacity to ensure availability is maintained
PR.PS	n/a	Platform Security
PR.PS-01	n/a	Configuration management practices are established and applied

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.