# Nist Csf Mapping

> NIST Cybersecurity Framework 2.0 mapping for static HTML/CSS websites

- Skill: `hack23/nist-csf-mapping` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hack23/nist-csf-mapping`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hack23/nist-csf-mapping/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend, Coding & Dev Tools
- License: Apache-2.0
- Author: Hack23 (https://skillmd.com/u/hack23)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hack23/nist-csf-mapping

---


# NIST CSF 2.0 Mapping (Static Site)


## 🔴 AI FIRST Quality Principle

> **Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.**

## Purpose

Map Riksdagsmonitor security controls to NIST Cybersecurity Framework 2.0 functions.

## Core Functions

### IDENTIFY (ID)

**ID.AM - Asset Management**
- Repository: Hack23/riksdagsmonitor
- Domain: riksdagsmonitor.com
- Hosting: GitHub Pages CDN
- Content: 14 HTML files, CSS, images

**ID.RA - Risk Assessment**
- Annual threat modeling (STRIDE)
- Dependency vulnerability scanning
- Security header audits

**ID.GV - Governance**
- ISMS policies (Hack23 ISMS-PUBLIC)
- Secure Development Policy
- Access control procedures

### PROTECT (PR)

**PR.AC - Access Control**
- GitHub MFA required
- Branch protection enabled
- Required PR reviews

**PR.DS - Data Security**
- HTTPS-only (TLS 1.3)
- No cookies/tracking
- Public data classification

**PR.IP - Protective Technology**
- Security headers (CSP, HSTS, X-Frame-Options)
- Dependabot scanning
- Secret scanning enabled

### DETECT (DE)

**DE.CM - Monitoring**
- GitHub audit logs
- Dependabot alerts
- CodeQL scanning

**DE.AE - Adverse Events**
- Security advisory monitoring
- Failed workflow notifications
- Deployment monitoring

### RESPOND (RS)

**RS.AN - Analysis**
- Incident classification (CRITICAL/HIGH/MEDIUM/LOW)
- Root cause analysis
- Security advisory review

**RS.MI - Mitigation**
- Rollback via git revert
- PR closure for vulnerabilities
- Emergency deployment procedures

### RECOVER (RC)

**RC.RP - Recovery Planning**
- Git version history (complete backup)
- Repository mirroring
- Deployment rollback

**RC.CO - Communications**
- Security contact: security@hack23.com
- Status updates via GitHub
- Post-incident reports

## Implementation Checklist

- ✅ Asset inventory (ID.AM)
- ✅ Access controls (PR.AC)
- ✅ Monitoring enabled (DE.CM)
- ✅ Incident procedures (RS)
- ✅ Recovery plan (RC)

## References

- **NIST CSF 2.0**: https://www.nist.gov/cyberframework
- **SECURITY_ARCHITECTURE.md**: Security controls