NIST CSF 2.0 · ISO/IEC 27001:2022
How mature is your cybersecurity programme against the NIST CSF 2.0?
70 requirements covering all 106 subcategories of the NIST Cybersecurity Framework 2.0, grouped by the 22 categories of the six Functions Govern, Identify, Protect, Detect, Respond and Recover. Rate each requirement on the 0-4 scale, which maps to the CSF Implementation Tiers: 0 not started, 1 Partial, 2 Risk Informed, 3 Repeatable, 4 Adaptive. The result is your Current Profile compared with a Target Profile by Function (the suggested target tier is shown for each requirement), with prioritised gaps, practical guidance and a PDF report. The CSF is voluntary and sector-neutral: it fits organisations of any size and sector, inside and outside the United States, and every requirement is mapped to ISO/IEC 27001:2022 so the same work supports an ISMS.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- Report: free summary PDF; with Pro the full report with action plan, guidance, control map, roadmap and Excel export.
70 requirements · 22 assessment areas · mapped to ISO 27001 · 60-120 minutes
NIST CSF 2.0 (CSWP 29)Published 26/02/2024: six Functions (Govern added in 2.0), 22 Categories and 106 Subcategories describing cybersecurity outcomes, with Implementation Examples, Informative References and Quick-Start Guides (small business, supply chain, ERM and workforce, informative references).
Profiles and Implementation TiersA Current Profile describes the outcomes achieved today, a Target Profile those to be achieved; the gap drives the action plan. Tiers 1-4 (Partial, Risk Informed, Repeatable, Adaptive) characterise the rigour of governance and management practices and are used here as the maturity scale.
ISO/IEC 27001:2022 mappingEvery requirement is linked to Annex A controls and clauses 4-10, consistent with the ISO/IEC 27001:2022 to CSF 2.0 informative reference in NIST OLIR (final 30/05/2025): the coverage map shows how a certified ISMS evidences CSF outcomes and vice versa.
Assessment areas
- GVOC – GV.OC – Organizational Context
Document the mission, the stakeholders and their expectations, the legal and contractual obligations and the dependencies in both directions (what others rely on you for, what you rely on). This context is the input for the risk appetite and for prioritising every other category; in ISO 27001 terms it is clause 4. - GVRM – GV.RM – Risk Management Strategy
Agree risk management objectives, risk appetite and tolerance, a common method to assess and prioritise cyber risk and its integration into enterprise risk management (ERM). Without a stated appetite, Target Profiles and investment decisions cannot be justified to the board. - GVRR – GV.RR – Roles, Responsibilities, and Authorities
Leadership must be accountable for cyber risk, roles must be defined with authority and resources, and cybersecurity must be embedded in HR processes from hiring to exit. Evidence is a board-approved RACI, budget lines and HR records, not only an organisation chart. - GVPO – GV.PO – Policy
A cybersecurity policy set derived from context, strategy and priorities, communicated and enforced, and reviewed when threats, technology, law or mission change. Keep it short at the top level and push detail into topic-specific policies and standards. - GVOV – GV.OV – Oversight
Results of the risk strategy and of the cybersecurity programme are reviewed by leadership and used to adjust direction. Use a small set of KPIs/KRIs, the Current vs Target Profile gap and audit results as standing inputs to a periodic management review. - GVSC – GV.SC – Cybersecurity Supply Chain Risk Management
C-SCRM covers the full supplier life cycle: programme and roles, supplier inventory by criticality, requirements in contracts, due diligence before onboarding, ongoing monitoring, joint incident handling and exit. NIST SP 1305 (C-SCRM Quick-Start Guide) and SP 800-161r1 give the practical steps. - IDAM – ID.AM – Asset Management
Maintain inventories of hardware, software, services, suppliers' services and data, with data-flow maps, criticality and life-cycle management. Automated discovery (MDM, EDR, CMDB, cloud asset inventory) is the only sustainable way to keep them current. - IDRA – ID.RA – Risk Assessment
Identify vulnerabilities and threats (including threat intelligence), estimate likelihood and impact, decide and track risk responses, manage changes and exceptions, handle vulnerability disclosures and verify the integrity of what you acquire. Feed results back into GV.RM. - IDIM – ID.IM – Improvement
Improvements are identified from audits and assessments, from tests and exercises (also with suppliers) and from day-to-day operations, and response and continuity plans are maintained. Keep one improvement backlog with owners and due dates. - PRAA – PR.AA – Identity Management, Authentication, and Access Control
Manage identities and credentials for people, services and devices, authenticate them according to risk (phishing-resistant MFA for privileged and remote access), protect identity assertions, enforce least privilege and separation of duties, and control physical access. - PRAT – PR.AT – Awareness and Training
Everyone receives awareness training adapted to their tasks; people in specialised roles (administrators, developers, executives, SOC, procurement) receive role-based training. Measure behaviour (phishing simulations, incident reports) rather than only completion rates. - PRDS – PR.DS – Data Security
Protect confidentiality, integrity and availability of data at rest, in transit and in use, and keep tested, protected backups. Base the depth of protection on the data classification and inventory from ID.AM. - PRPS – PR.PS – Platform Security
Harden and maintain platforms: configuration baselines, patching and end-of-life replacement of software and hardware, log generation, prevention of unauthorised software and secure software development. These are the controls attackers test first. - PRIR – PR.IR – Technology Infrastructure Resilience
Segment and protect networks and environments, protect technology from environmental threats, build resilience (redundancy, failover) and keep enough capacity. Resilience requirements should derive from the RTO/RPO of critical services identified in GV.OC. - DECM – DE.CM – Continuous Monitoring
Monitor networks, the physical environment, user activity and technology usage, external service providers and computing resources (endpoints, servers, cloud workloads, runtimes) to find potentially adverse events. Define coverage explicitly: what is monitored, by whom, 24x7 or not. - DEAE – DE.AE – Adverse Event Analysis
Analyse and correlate events from multiple sources with threat intelligence, estimate impact and scope, route information to the right people and tools and declare incidents against defined criteria. The quality of this step drives detection time. - RSMA – RS.MA – Incident Management
Once an incident is declared, execute the response plan with the relevant third parties, triage and validate reports, categorise and prioritise, escalate and apply criteria for starting recovery. NIST SP 800-61r3 (2025) is the CSF 2.0 incident response community profile. - RSAN – RS.AN – Incident Analysis
Establish what happened and the root cause, estimate and validate the magnitude and collect and record evidence with integrity and provenance preserved, so that it can support legal, insurance and regulatory needs. - RSCO – RS.CO – Incident Response Reporting and Communication
Notify internal and external stakeholders (management, customers, regulators, law enforcement, insurers) within required time frames and share information with designated parties, using pre-approved templates and contact lists. - RSMI – RS.MI – Incident Mitigation
Contain incidents to stop their spread and eradicate the cause (malware, persistence, compromised accounts, exploited vulnerabilities) before recovery. Pre-authorise containment actions so responders do not wait for approvals at 3 a.m. - RCRP – RC.RP – Incident Recovery Plan Execution
Execute the recovery portion of the response plan: prioritise restoration by business criticality, verify backups and restored assets before returning to service, define post-incident operating norms and declare the end of recovery with documentation completed. - RCCO – RC.CO – Incident Recovery Communication
Communicate recovery progress to internal and external stakeholders and, where needed, publish public updates through approved channels and spokespersons. Inconsistent messages during recovery cause as much damage as the outage.
Key dates and milestones
| Date | Source | Status | |
|---|---|---|---|
| 12/02/2014 | NIST CSF 1.0 | Framework for Improving Critical Infrastructure Cybersecurity 1.0 published, following Executive Order 13636 (2013): five Functions Identify, Protect, Detect, Respond, Recover | Superseded |
| 11/05/2017 | Executive Order 13800 | US federal agencies required to use the Framework to manage cybersecurity risk; widespread adoption as a common language in public and private sectors | In force (federal agencies) |
| 16/04/2018 | NIST CSF 1.1 | Version 1.1: supply chain risk management, identity and authentication refinements, self-assessment section | Superseded |
| 08/08/2023 | NIST CSF 2.0 | Public draft of CSF 2.0 released for comment (Govern Function, broader scope beyond critical infrastructure) | Superseded |
| 18/12/2023 | SEC cybersecurity disclosure rules | US listed companies: Form 8-K Item 1.05 disclosure of material cybersecurity incidents within four business days of the materiality determination (rules effective 05/09/2023; smaller reporting companies from 15/06/2024); annual Regulation S-K Item 106 disclosure of risk management, strategy and governance for fiscal years ending on or after 15/12/2023 | In force |
| 26/02/2024 | NIST CSF 2.0 | CSF 2.0 (NIST CSWP 29) published with the Small Business Quick-Start Guide (SP 1300), Organizational Profiles Quick-Start Guide (SP 1301), Implementation Examples and the CSF 2.0 Reference Tool | Published |
| 21/10/2024 | NIST SP 1305 | CSF 2.0 Quick-Start Guide for Cybersecurity Supply Chain Risk Management (final) | Published |
| 03/04/2025 | NIST SP 800-61r3 | Incident Response Recommendations and Considerations for Cybersecurity Risk Management: a CSF 2.0 Community Profile (final), replacing SP 800-61r2 | Published |
| 30/05/2025 | NIST OLIR | Final informative reference ISO/IEC 27001:2022 to CSF 2.0 posted to the Online Informative References catalog | Published |
| 17/11/2025 | NIST OLIR | Final mapping CSF 2.0 to SP 800-53 Rev. 5.2.0 posted (with NICE Framework v2.0.0 mapping) | Published |
| 16/12/2025 | NIST IR 8596 | Cyber AI Profile (CSF 2.0 profile for securing AI systems, AI-enabled defence and countering AI-enabled attacks) - initial preliminary draft; comments closed 30/01/2026, initial public draft expected | Draft |
| 18/12/2025 | NIST IR 8286 series | NIST IR 8286r1, 8286Ar1 and 8286Cr1 updated to integrate CSF 2.0 with enterprise risk management and risk registers | Published |
| 23/03/2026 | NIST SP 1308 | CSF 2.0 Quick-Start Guide on Cybersecurity, Enterprise Risk Management and Workforce Management (final) | Published |
| 25/08/2026 | NIST SP 1347 | CSF 2.0 Informative References Quick-Start Guide (final): how to use OLIR mappings, the CSF 2.0 Reference Tool and downloads | Published |
| 15/10/2026 | NIST SP 1353 | Comment deadline for the draft Quick-Start Guide on Using AI for CSF 2.0 Analysis and Reporting (initial public draft released 19/08/2026) | Draft |
Frequently asked questions
Is the NIST CSF 2.0 self-assessment free?
Yes. The questionnaire, the scoring, the dashboard and a summary PDF are free and need no account; your answers stay in your browser and are never sent to our servers. An optional Pro pass (18 EUR for 45 days, all assessments) adds the full PDF report with prioritised action plan and guidance, the evidence tracker, comparisons with previous assessments, the cross-framework view and the Excel export.
Which standard is the NIST CSF 2.0 assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 27001:2022. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
CISOs, IT and risk managers, consultants and internal auditors of organisations of any size, sector or country that use the NIST CSF 2.0 to measure and communicate cybersecurity maturity; it is a self-assessment and does not replace a certification audit.
Can the result be used as a NIST CSF Current Profile?
Yes. Each requirement groups CSF 2.0 subcategories and is scored 0-4, which maps to the Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive). The dashboard shows maturity by function and category, i.e. a Current Profile you can compare with a Target Profile; the ISO/IEC 27001 control map shows where an ISMS already covers the CSF.
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
- ISO/IEC 27001 readiness – Information security management system (ISMS) gap analysis against ISO/IEC 27001:2022 - clauses 4-10 and the 93 Annex A controls, in view of certification
- ISO/IEC 42001 readiness – AI management system (AIMS) gap analysis against ISO/IEC 42001:2023 - clauses 4-10 and the 38 Annex A controls, in view of certification
- ISO/IEC 20000-1 / ITSM maturity – Service management system (SMS) gap analysis against ISO/IEC 20000-1:2018 and maturity of the ITSM processes, with ITIL practice cross-references, in view of certification
- Swiss nFADP (nLPD) – Federal Act on Data Protection (FADP/nLPD/revDSG, SR 235.1) and Data Protection Ordinance (DPO/OPDa/DSV, SR 235.11) – mapped to ISO/IEC 27701:2025
- EU laws for Swiss companies – Scoping of GDPR, AI Act, NIS2, DORA and Cyber Resilience Act for non-EU (Swiss) companies – mapped to ISO/IEC 27001:2022
- SOC 2 Type II readiness – Gap analysis against the AICPA 2017 Trust Services Criteria (revised points of focus 2022) and DC 200 description criteria - mapped to ISO/IEC 27001:2022
Self-assessment tool for information purposes only; it is not an audit, a certification or legal advice. The NIST Cybersecurity Framework is voluntary and NIST does not certify or endorse organisations or tools; GoToCertify is not affiliated with NIST, ISO or IEC. Requirements paraphrase CSF 2.0 outcomes in the publisher's own words; the official NIST publications prevail. The ISO/IEC 27001:2022 mapping reflects professional judgement aligned with published informative references and does not replace a Statement of Applicability. Snapshot 02/11/2026. No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.