<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# NIST CSF Assessment — API Reference

## CSF 2.0 Function Checks

```bash
# IDENTIFY — Asset discovery
ip -j addr show | jq '[.[] | {name: .ifname, addresses: [.addr_info[].local]}]'
ss -tlnp | awk 'NR>1 {print $4, $6}'
nmap -sn 10.0.0.0/24 -oX - | grep -c "status state=\"up\""

# PROTECT — Access controls
sshd -T | grep -E "^(permitrootlogin|passwordauthentication|maxauthtries)"
grep -E "^(minlen|dcredit|ucredit)" /etc/security/pwquality.conf
iptables -L -n --line-numbers

# DETECT — Monitoring services
systemctl is-active auditd fail2ban prometheus-node-exporter
auditctl -l | wc -l
journalctl -u auditd --since "1 hour ago" | wc -l

# RESPOND — IR capability
which tcpdump volatility3 yara 2>/dev/null
ls /opt/ir-toolkit/ 2>/dev/null

# RECOVER — Backup/continuity
systemctl is-active cron
restic snapshots --latest 1 --json 2>/dev/null | jq '.[0].time'
```

## CSF 2.0 to NIST 800-53 Mapping

| CSF Category | 800-53 Controls |
|---|---|
| GV.RM | PM-9, RA-1 |
| ID.AM | CM-8, PM-5 |
| PR.AA | AC-1, AC-2, IA-1 |
| PR.DS | SC-28, SC-8 |
| DE.CM | SI-4, AU-6 |
| RS.MA | IR-4, IR-5 |
| RC.RP | CP-10 |

## Maturity Tier Assessment

```bash
# Tier 1 indicators — ad-hoc, no formal process
test -f /etc/security-policy.pdf && echo "Policy exists" || echo "No policy — Tier 1"

# Tier 2 indicators — risk-informed but inconsistent
grep -rl "risk" /opt/policies/ 2>/dev/null | wc -l

# Tier 3 indicators — repeatable, org-wide
systemctl list-unit-files | grep -c enabled
crontab -l | grep -c "compliance\|audit\|scan"

# Tier 4 indicators — adaptive, continuous improvement
git log --since="1 year ago" --grep="security" --oneline | wc -l
```
