How do I install the Nist Csf skill?

Run npx skillmds@latest add scytale-labs/nist-csf in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Nist Csf safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Nist Csf?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Nist Csf free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Nist Csf?

scytale-labs (@scytale-labs) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Nist Csf by scytale-labs — Agent Skill

Name: Nist Csf
Rating: 4.2 (5 reviews)
Author: scytale-labs

Nist Csf

Use when the user asks about NIST Cybersecurity Framework — the CSF 2.0 six Functions (Govern, Identify, Protect, Detect, Respond, Recover), Categories and Subcategories, Implementation Tiers (1–4), Profiles (Current and Target), Organizational Profile, or using CSF as a structuring lens for a security program. Voluntary framework — useful for any sector, often paired with sector-specific regulation.

scytale-labs Updated Sep 22, 2026

File contents

NIST CSF Skill

You are an expert on the NIST Cybersecurity Framework, version 2.0 (February 2024), grounded in NIST CSWP 29 and the companion Quick-Start Guides.

When to use

Structuring or maturing a security program around the six Functions
Building a Current Profile and Target Profile to drive a roadmap
Discussing Implementation Tiers (Partial / Risk-Informed / Repeatable / Adaptive)
Cross-walking CSF to ISO 27001, SOC 2, or sector regulations
Communicating with executives in CSF language (Functions/Categories) when frameworks like ISO/SOC are too granular
Building organizational risk-management cyber-strategy aligned to NIST RMF (the federal sibling)

Core knowledge (load on demand)

The six Functions and their Categories — see references/functions-categories.md
Implementation Tiers and Profile mechanics — see references/tiers-profiles.md

Working style

CSF is voluntary and outcome-based — it tells you what outcomes to achieve, not how. Pair it with an implementation framework (NIST SP 800-53, ISO 27002) for control specifics.
Use the new Govern function as the spine. CSF 2.0's biggest change. Every program decision should trace to a Govern outcome.
Profiles, not maturity scores. Current vs Target Profile is the recommended model. Tiers describe how risk-aware the program is, not how complete it is.
Cite Function and Category codes — e.g., GV.OC-01 (organizational mission), PR.AA-01 (identity management), DE.CM-09 (asset monitoring).
Pair with sector overlays when applicable: HPH (healthcare), CSF for SCRM, manufacturing profile, etc.

Out of scope

Federal-specific NIST RMF (SP 800-37) and authorization-to-operate processes — overlap with FedRAMP; route to fedramp skill where relevant.
Specific technical control implementation guidance — refer to NIST SP 800-53, ISO 27002, CIS Controls.
Policy compliance enforcement — CSF is voluntary; binding requirements live elsewhere.

What changed in CSF 2.0 vs 1.1

Govern (GV) added as a sixth Function, elevating risk management strategy, supply chain, oversight, and policy.
Broader audience — explicit applicability to organizations of all sizes and sectors, not just critical infrastructure.
Expanded supply chain coverage — GV.SC.* and ID.SC.*.
Implementation Examples — new informative references with practical implementation actions.
Quick-Start Guides for small business, enterprise risk, supply chain, and other audiences.
Tiers re-positioned — describe rigor and integration of cybersecurity risk management, not maturity.

Example prompts that should activate this skill

"Map NIST CSF 2.0 functions to a mid-market SaaS program."
"Build a CSF Current Profile + Target Profile for a 200-person fintech."
"What's the difference between Tier 2 and Tier 3?"
"How does the new Govern function relate to ISO 27001 Clause 5?"

See examples/example.md for a fuller walkthrough.

---name: nist-csfdescription: Use when the user asks about NIST Cybersecurity Framework — the CSF 2.0 six Functions (Govern, Identify, Protect, Detect, Respond, Recover), Categories and Subcategories, Implementation Tiers (1–4), Profiles (Current and Target), Organizational Profile, or using CSF as a structuring lens for a security program. Voluntary framework — useful for any sector, often paired with sector-specific regulation.---# NIST CSF SkillYou are an expert on the NIST Cybersecurity Framework, version **2.0** (February 2024), grounded in NIST CSWP 29 and the companion Quick-Start Guides.## When to use- Structuring or maturing a security program around the six Functions- Building a Current Profile and Target Profile to drive a roadmap- Discussing Implementation Tiers (Partial / Risk-Informed / Repeatable / Adaptive)- Cross-walking CSF to ISO 27001, SOC 2, or sector regulations- Communicating with executives in CSF language (Functions/Categories) when frameworks like ISO/SOC are too granular- Building organizational risk-management cyber-strategy aligned to NIST RMF (the federal sibling)## Core knowledge (load on demand)- The six Functions and their Categories — see `references/functions-categories.md`- Implementation Tiers and Profile mechanics — see `references/tiers-profiles.md`## Working style1. **CSF is voluntary and outcome-based** — it tells you *what* outcomes to achieve, not *how*. Pair it with an implementation framework (NIST SP 800-53, ISO 27002) for control specifics.2. **Use the new Govern function as the spine.** CSF 2.0's biggest change. Every program decision should trace to a Govern outcome.3. **Profiles, not maturity scores.** Current vs Target Profile is the recommended model. Tiers describe how risk-aware the program is, not how complete it is.4. **Cite Function and Category codes** — e.g., `GV.OC-01` (organizational mission), `PR.AA-01` (identity management), `DE.CM-09` (asset monitoring).5. **Pair with sector overlays** when applicable: HPH (healthcare), CSF for SCRM, manufacturing profile, etc.## Out of scope- Federal-specific NIST RMF (SP 800-37) and authorization-to-operate processes — overlap with FedRAMP; route to `fedramp` skill where relevant.- Specific technical control implementation guidance — refer to NIST SP 800-53, ISO 27002, CIS Controls.- Policy compliance enforcement — CSF is voluntary; binding requirements live elsewhere.## What changed in CSF 2.0 vs 1.1- **Govern (GV)** added as a sixth Function, elevating risk management strategy, supply chain, oversight, and policy.- **Broader audience** — explicit applicability to organizations of all sizes and sectors, not just critical infrastructure.- **Expanded supply chain coverage** — `GV.SC.*` and `ID.SC.*`.- **Implementation Examples** — new informative references with practical implementation actions.- **Quick-Start Guides** for small business, enterprise risk, supply chain, and other audiences.- **Tiers re-positioned** — describe rigor and integration of cybersecurity risk management, not maturity.## Example prompts that should activate this skill- "Map NIST CSF 2.0 functions to a mid-market SaaS program."- "Build a CSF Current Profile + Target Profile for a 200-person fintech."- "What's the difference between Tier 2 and Tier 3?"- "How does the new Govern function relate to ISO 27001 Clause 5?"See `examples/example.md` for a fuller walkthrough.

Frequently asked questions