<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-nist-csf-assessment
description: >-
  Assess organizational cybersecurity posture against the NIST Cybersecurity
  Framework (CSF) 2.0 including Govern, Identify, Protect, Detect, Respond,
  and Recover functions. Automate maturity scoring, gap analysis, and
  target profile generation with cross-references to NIST 800-53.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - nist-csf
  - cybersecurity-framework
  - risk-management
  - maturity-assessment
  - govern
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing NIST CSF Assessment

## Overview

NIST CSF 2.0 provides a risk-based framework for managing cybersecurity risk
across six functions: Govern (new in 2.0), Identify, Protect, Detect, Respond,
and Recover. Each function contains categories and subcategories mapped to
informative references (NIST 800-53, CIS Controls, ISO 27001). This skill
automates posture assessment, maturity scoring, and profile generation.

Mode: `[MODE: BLUE]` — Framework-based cybersecurity risk assessment.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | For agent tooling |
| InSpec | `gem install inspec` |
| jq | `apt install jq` |

## Key Concepts

### CSF 2.0 Core Functions

```
NIST CSF 2.0 Core:
├── GOVERN (GV) — New in 2.0
│   ├── GV.OC  Organizational Context
│   ├── GV.RM  Risk Management Strategy
│   ├── GV.RR  Roles, Responsibilities, Authorities
│   ├── GV.PO  Policy
│   ├── GV.OV  Oversight
│   └── GV.SC  Supply Chain Risk Management
├── IDENTIFY (ID)
│   ├── ID.AM  Asset Management
│   ├── ID.RA  Risk Assessment
│   └── ID.IM  Improvement
├── PROTECT (PR)
│   ├── PR.AA  Identity Management, Authentication, Access Control
│   ├── PR.AT  Awareness and Training
│   ├── PR.DS  Data Security
│   ├── PR.PS  Platform Security
│   ├── PR.IR  Technology Infrastructure Resilience
│   └── PR.AA  Identity Management
├── DETECT (DE)
│   ├── DE.CM  Continuous Monitoring
│   └── DE.AE  Adverse Event Analysis
├── RESPOND (RS)
│   ├── RS.MA  Incident Management
│   ├── RS.AN  Incident Analysis
│   ├── RS.CO  Incident Response Reporting and Communication
│   └── RS.MI  Incident Mitigation
└── RECOVER (RC)
    ├── RC.RP  Incident Recovery Plan Execution
    └── RC.CO  Incident Recovery Communication
```

### Maturity Tiers

| Tier | Name | Description |
|---|---|---|
| 1 | Partial | Risk management ad-hoc, limited awareness |
| 2 | Risk Informed | Risk practices approved but not org-wide |
| 3 | Repeatable | Formal policies, consistent implementation |
| 4 | Adaptive | Continuous improvement, lessons learned applied |

### Automated Control Checks

```bash
# ID.AM — Asset inventory verification
ip -j addr show | jq '[.[] | {name: .ifname, addresses: [.addr_info[].local]}]'
ss -tlnp | awk 'NR>1 {print $4, $6}'

# PR.AA — Access control enforcement
grep -E "^(PermitRootLogin|PasswordAuthentication|MaxAuthTries)" /etc/ssh/sshd_config
faillock --dir /var/run/faillock --user root 2>/dev/null

# PR.DS — Data security (encryption)
lsblk -o NAME,FSTYPE,MOUNTPOINT | grep crypt
openssl s_client -connect localhost:443 2>/dev/null | grep -E "Protocol|Cipher"

# DE.CM — Continuous monitoring active
systemctl is-active auditd prometheus-node-exporter fail2ban

# RS.MA — Incident response capability
which volatility3 sleuthkit 2>/dev/null
ls /opt/ir-toolkit/ 2>/dev/null
```

## Workflow

### Step 1: Initialize CSF Assessment

```bash
node scripts/agent.js --action init --tier-target 3 \
  --output /tmp/nist-csf-init.json
```

### Step 2: Assess Current Posture

```bash
node scripts/agent.js --action assess \
  --functions govern,identify,protect,detect,respond,recover \
  --output /tmp/nist-csf-assess.json
```

### Step 3: Generate Target Profile and Gap Report

```bash
node scripts/agent.js --action report --input /tmp/nist-csf-assess.json \
  --format profile --output /tmp/nist-csf-profile.json
```

## Verification

- [ ] All six CSF functions assessed with subcategory scoring
- [ ] Current Profile documented with maturity tier per category
- [ ] Target Profile established with business-justified tier targets
- [ ] Gap analysis identifies priority remediation actions
- [ ] Cross-references to NIST 800-53 controls documented
- [ ] Risk treatment plan prioritized by gap severity and business impact

## References

- [NIST CSF 2.0](https://www.nist.gov/cyberframework)
- [NIST SP 800-53 Rev 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/)
- [CSF 2.0 Reference Tool](https://csrc.nist.gov/projects/cybersecurity-framework)
