cloudthinker-ai NIST Cybersecurity Framework 2.0 Assessment
Phase 1: Scoping & Context
- Define assessment scope
- Business units included
- Systems and assets in scope
- Critical business processes
- Regulatory requirements applicable
- Identify stakeholders and interview participants
- Gather existing security documentation
- Define target implementation tier
Implementation Tier Assessment
| Criterion | Tier 1 (Partial) | Tier 2 (Risk Informed) | Tier 3 (Repeatable) | Tier 4 (Adaptive) |
|---|---|---|---|---|
| Risk Management Process | Ad hoc | Approved but informal | Formal, org-wide | Continuously improving |
| Integrated Risk Program | Limited | Some awareness | Org-wide awareness | Active participation |
| External Participation | None | Informal | Formal agreements | Active contribution |
| Current Tier | [ ] | [ ] | [ ] | [ ] |
| Target Tier | [ ] | [ ] | [ ] | [ ] |
Phase 2: Govern (GV) Function Assessment
- GV.OC - Organizational Context understood
- GV.RM - Risk Management Strategy established
- GV.RR - Roles, Responsibilities, and Authorities defined
- GV.PO - Policy established and communicated
- GV.OV - Oversight of cybersecurity strategy
- GV.SC - Supply Chain Risk Management
Phase 3: Identify (ID) Function Assessment
- ID.AM - Asset Management
- ID.RA - Risk Assessment
- ID.IM - Improvement processes
Phase 4: Protect (PR) Function Assessment
- PR.AA - Identity Management, Authentication, and Access Control
- PR.AT - Awareness and Training
- PR.DS - Data Security
- PR.PS - Platform Security
- PR.IR - Technology Infrastructure Resilience
Phase 5: Detect (DE) Function Assessment
- DE.CM - Continuous Monitoring
- DE.AE - Adverse Event Analysis
Phase 6: Respond (RS) Function Assessment
- RS.MA - Incident Management
- RS.AN - Incident Analysis
- RS.CO - Incident Response Reporting and Communication
- RS.MI - Incident Mitigation
Phase 7: Recover (RC) Function Assessment
- RC.RP - Incident Recovery Plan Execution
- RC.CO - Recovery Communication
Maturity Scoring Summary
| Function | Categories | Current Score (1-4) | Target Score (1-4) | Gap |
|---|---|---|---|---|
| Govern (GV) | 6 | |||
| Identify (ID) | 3 | |||
| Protect (PR) | 5 | |||
| Detect (DE) | 2 | |||
| Respond (RS) | 4 | |||
| Recover (RC) | 2 | |||
| Overall | 22 |
Phase 8: Gap Analysis & Roadmap
- Compare current profile to target profile
- Prioritize gaps by risk and business impact
- Develop remediation roadmap with quick wins and long-term initiatives
- Estimate resource requirements per initiative
- Define success metrics and milestones
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
- Current State Profile: Maturity score per function and category
- Target State Profile: Desired maturity levels with justification
- Gap Analysis: Prioritized list of gaps with severity
- Remediation Roadmap: Phased plan with timelines and resources
- Executive Summary: One-page overview for leadership
Action Items
- Complete stakeholder interviews
- Assess all six CSF functions
- Score current and target maturity levels
- Prioritize gaps by risk impact
- Develop phased remediation roadmap
- Present findings to executive leadership
- Schedule follow-up assessment in 12 months