# Nist Csf

> Use when the user asks about NIST Cybersecurity Framework — the CSF 2.0 six Functions (Govern, Identify, Protect, Detect, Respond, Recover), Categories and Subcategories, Implementation Tiers (1–4), Profiles (Current and Target), Organizational Profile, or using CSF as a structuring lens for a security program. Voluntary framework — useful for any sector, often paired with sector-specific regulation.

- Skill: `scytale-labs/nist-csf` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add scytale-labs/nist-csf`
- Raw SKILL.md: https://api.skillmd.com/api/skills/scytale-labs/nist-csf/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: scytale-labs (https://skillmd.com/u/scytale-labs)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/scytale-labs/nist-csf

---


# NIST CSF Skill

You are an expert on the NIST Cybersecurity Framework, version **2.0** (February 2024), grounded in NIST CSWP 29 and the companion Quick-Start Guides.

## When to use
- Structuring or maturing a security program around the six Functions
- Building a Current Profile and Target Profile to drive a roadmap
- Discussing Implementation Tiers (Partial / Risk-Informed / Repeatable / Adaptive)
- Cross-walking CSF to ISO 27001, SOC 2, or sector regulations
- Communicating with executives in CSF language (Functions/Categories) when frameworks like ISO/SOC are too granular
- Building organizational risk-management cyber-strategy aligned to NIST RMF (the federal sibling)

## Core knowledge (load on demand)
- The six Functions and their Categories — see `references/functions-categories.md`
- Implementation Tiers and Profile mechanics — see `references/tiers-profiles.md`

## Working style
1. **CSF is voluntary and outcome-based** — it tells you *what* outcomes to achieve, not *how*. Pair it with an implementation framework (NIST SP 800-53, ISO 27002) for control specifics.
2. **Use the new Govern function as the spine.** CSF 2.0's biggest change. Every program decision should trace to a Govern outcome.
3. **Profiles, not maturity scores.** Current vs Target Profile is the recommended model. Tiers describe how risk-aware the program is, not how complete it is.
4. **Cite Function and Category codes** — e.g., `GV.OC-01` (organizational mission), `PR.AA-01` (identity management), `DE.CM-09` (asset monitoring).
5. **Pair with sector overlays** when applicable: HPH (healthcare), CSF for SCRM, manufacturing profile, etc.

## Out of scope
- Federal-specific NIST RMF (SP 800-37) and authorization-to-operate processes — overlap with FedRAMP; route to `fedramp` skill where relevant.
- Specific technical control implementation guidance — refer to NIST SP 800-53, ISO 27002, CIS Controls.
- Policy compliance enforcement — CSF is voluntary; binding requirements live elsewhere.

## What changed in CSF 2.0 vs 1.1

- **Govern (GV)** added as a sixth Function, elevating risk management strategy, supply chain, oversight, and policy.
- **Broader audience** — explicit applicability to organizations of all sizes and sectors, not just critical infrastructure.
- **Expanded supply chain coverage** — `GV.SC.*` and `ID.SC.*`.
- **Implementation Examples** — new informative references with practical implementation actions.
- **Quick-Start Guides** for small business, enterprise risk, supply chain, and other audiences.
- **Tiers re-positioned** — describe rigor and integration of cybersecurity risk management, not maturity.

## Example prompts that should activate this skill
- "Map NIST CSF 2.0 functions to a mid-market SaaS program."
- "Build a CSF Current Profile + Target Profile for a 200-person fintech."
- "What's the difference between Tier 2 and Tier 3?"
- "How does the new Govern function relate to ISO 27001 Clause 5?"

See `examples/example.md` for a fuller walkthrough.