Comparison
NIST CSF 2.0 vs CPS 234
NIST Cybersecurity Framework 2.0 · APRA CPS 234 Information Security · data 2026-10-27
Requirement-level comparison of NIST Cybersecurity Framework 2.0 and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 24 APRA CPS 234 Information Security requirements, 23 map to something in NIST CSF 2.0, 0 are only loosely related, and 1 have no mapping in our data.
CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.
Likely new work: CPS 234 requirements with no mapping to NIST CSF 2.0 (1)
| CPS 234 | Requirement | Match | NIST CSF 2.0 | Evidence |
|---|---|---|---|---|
| Testing control effectiveness · 1 | ||||
| Para 29 | Escalate deficiencies that can't be fixed quickly | No mapping in our data | — | No mapping to NIST CSF 2.0 in our data. |
Mapped (23)
| CPS 234 | Requirement | Match | NIST CSF 2.0 | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 2 | ||||
| Para 13 | Board ultimately responsible for information security | Editorial | GV.RM-01GV.RM-02GV.RM-03+4 | Same topic: Risk Management (editorial pick) |
| Para 14 | Define information security roles and responsibilities | Editorial | GV.RR-01GV.RR-02GV.RR-03 | Same topic: Roles & Responsibilities (editorial pick) |
| Information security capability · 3 | ||||
| Para 15 | Maintain a capability commensurate with threats | Editorial | GV.RM-01GV.RM-02GV.RM-03+1 | Same topic: Risk Management (editorial pick) |
| Para 16 | Assess third parties' information security capability | Editorial | DE.CM-06GV.SC-01GV.SC-03+7 | Same topic: Vendor Risk Mgmt, Supply Chain Risk (editorial pick) |
| Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | DE.AE-07ID.RA-01ID.RA-02+5 | Same topic: Threat Intelligence, Vulnerability Mgmt (editorial pick) |
| Policy framework · 2 | ||||
| Para 18 | Maintain an information security policy framework | Editorial | GV.PO-01GV.PO-02 | Same topic: Governance Policy (editorial pick) |
| Para 19 | Policies direct everyone with security obligations | Editorial | GV.PO-01GV.PO-02 | Same topic: Governance Policy (editorial pick) |
| Information asset identification and classification · 1 | ||||
| Para 20 | Classify information assets by criticality and sensitivity | Editorial | ID.AM-01ID.AM-02ID.AM-04+3 | Same topic: Asset Management (editorial pick) |
| Implementation of controls · 2 | ||||
| Para 21 | Timely controls commensurate with risk and asset life-cycle | Editorial | ID.RA-03ID.RA-04ID.RA-05+4 | Same topic: Risk Assessment (editorial pick) |
| Para 22 | Evaluate the design of third parties' controls | Editorial | DE.CM-06GV.SC-01GV.SC-03+7 | Same topic: Vendor Risk Mgmt, Supply Chain Risk (editorial pick) |
| Incident management · 4 | ||||
| Para 23 | Detect and respond to incidents in a timely manner | Editorial | DE.AE-02DE.CM-01ID.IM-04+4 | Same topic: Intrusion Detection, Incident Response (editorial pick) |
| Para 24 | Maintain information security response plans | Editorial | ID.IM-04RS.MA-01RS.MA-02+2 | Same topic: Incident Response (editorial pick) |
| Para 25 | Response plans cover all stages and escalation | Editorial | ID.IM-03ID.IM-04RC.RP-06+5 | Same topic: Lessons Learned, Incident Response (editorial pick) |
| Para 26 | Review and test response plans annually | Editorial | ID.IM-04RS.MA-01RS.MA-02+2 | Same topic: Incident Response (editorial pick) |
| Testing control effectiveness · 4 | ||||
| Para 27 | Systematic testing programme for control effectiveness | Editorial | GV.RM-01GV.RM-02GV.RM-03+3 | Same topic: Risk Management (editorial pick) |
| Para 28 | Check third parties' control testing is adequate | Editorial | DE.CM-06GV.SC-04GV.SC-06+2 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Para 30 | Testing by skilled, functionally independent specialists | Editorial | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 31 | Review the testing programme at least annually | Editorial | GV.RM-01GV.RM-02GV.RM-03+1 | Same topic: Risk Management (editorial pick) |
| Internal audit · 3 | ||||
| Para 32 | Internal audit reviews control design and effectiveness | Editorial | GV.OC-03GV.OV-03 | Same topic: Compliance (editorial pick) |
| Para 33 | Assurance provided by appropriately skilled personnel | Editorial | GV.OC-03GV.OV-03 | Same topic: Compliance (editorial pick) |
| Para 34 | Internal audit assesses third-party assurance relied on | Editorial | DE.CM-06GV.OC-03GV.OV-03+4 | Same topic: Vendor Risk Mgmt, Compliance (editorial pick) |
| APRA notification · 2 | ||||
| Para 35 | Notify APRA of material incidents within 72 hours | Editorial | RS.CO-02 | Same topic: Reporting (editorial pick) |
| Para 36 | Notify APRA of material control weaknesses within 10 business days | Editorial | RS.CO-02 | Same topic: Reporting (editorial pick) |
Of 106 NIST Cybersecurity Framework 2.0 requirements, 49 map to something in CPS 234, 0 are only loosely related, and 57 have no mapping in our data.
Likely new work: NIST CSF 2.0 requirements with no mapping to CPS 234 (57)
| NIST CSF 2.0 | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Detect (DE) · 7 | ||||
| DE.AE-03 | Information is correlated from multiple sources | No mapping in our data | — | No mapping to CPS 234 in our data. |
| DE.AE-04 | The estimated impact and scope of adverse events are understood | No mapping in our data | — | No mapping to CPS 234 in our data. |
| DE.AE-06 | Information on adverse events is provided to authorized staff and tools | No mapping in our data | — | No mapping to CPS 234 in our data. |
| DE.AE-08 | Incidents are declared when adverse events meet the defined incident criteria | No mapping in our data | — | No mapping to CPS 234 in our data. |
| DE.CM-02 | The physical environment is monitored to find potentially adverse events | No mapping in our data | — | No mapping to CPS 234 in our data. |
| DE.CM-03 | Personnel activity and technology usage are monitored to find potentially adverse events | No mapping in our data | — | No mapping to CPS 234 in our data. |
| DE.CM-09 | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Govern (GV) · 13 | ||||
| GV.OC-01 | The organizational mission is understood and informs cybersecurity risk management | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.OC-02 | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.OC-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.OC-05 | Outcomes, capabilities, and services that the organization depends on are understood and communicated | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.OV-01 | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.OV-02 | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.RM-04 | Strategic direction that describes appropriate risk response options is established and communicated | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.RM-05 | Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.RM-07 | Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.RR-04 | Cybersecurity is included in human resources practices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.SC-02 | Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.SC-08 | Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | No mapping in our data | — | No mapping to CPS 234 in our data. |
| GV.SC-10 | Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Identify (ID) · 4 | ||||
| ID.AM-03 | Representations of the organization's authorized network communication and internal and external network data flows are maintained | No mapping in our data | — | No mapping to CPS 234 in our data. |
| ID.IM-01 | Improvements are identified from evaluations | No mapping in our data | — | No mapping to CPS 234 in our data. |
| ID.IM-02 | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | No mapping in our data | — | No mapping to CPS 234 in our data. |
| ID.RA-07 | Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Protect (PR) · 19 | ||||
| PR.AA-01 | Identities and credentials for authorized users, services, and hardware are managed by the organization | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.AA-02 | Identities are proofed and bound to credentials based on the context of interactions | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.AA-03 | Users, services, and hardware are authenticated | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.AA-04 | Identity assertions are protected, conveyed, and verified | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.AA-05 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.AA-06 | Physical access to assets is managed, monitored, and enforced commensurate with risk | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.AT-01 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.AT-02 | Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.DS-11 | Backups of data are created, protected, maintained, and tested | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.IR-01 | Networks and environments are protected from unauthorized logical access and usage | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.IR-02 | The organization's technology assets are protected from environmental threats | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.IR-03 | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.IR-04 | Adequate resource capacity to ensure availability is maintained | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.PS-01 | Configuration management practices are established and applied | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.PS-03 | Hardware is maintained, replaced, and removed commensurate with risk | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.PS-04 | Log records are generated and made available for continuous monitoring | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.PS-05 | Installation and execution of unauthorized software are prevented | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Recover (RC) · 7 | ||||
| RC.CO-03 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RC.CO-04 | Public updates on incident recovery are shared using approved methods and messaging | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RC.RP-01 | The recovery portion of the incident response plan is executed once initiated from the incident response process | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RC.RP-02 | Recovery actions are selected, scoped, prioritized, and performed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RC.RP-03 | The integrity of backups and other restoration assets is verified before using them for restoration | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RC.RP-04 | Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RC.RP-05 | The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Respond (RS) · 7 | ||||
| RS.AN-03 | Analysis is performed to establish what has taken place during an incident and the root cause of the incident | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RS.AN-06 | Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RS.AN-07 | Incident data and metadata are collected, and their integrity and provenance are preserved | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RS.AN-08 | An incident's magnitude is estimated and validated | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RS.MA-05 | The criteria for initiating incident recovery are applied | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RS.MI-01 | Incidents are contained | No mapping in our data | — | No mapping to CPS 234 in our data. |
| RS.MI-02 | Incidents are eradicated | No mapping in our data | — | No mapping to CPS 234 in our data. |
Mapped (49)
| NIST CSF 2.0 | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Detect (DE) · 4 | ||||
| DE.AE-02 | Potentially adverse events are analyzed to better understand associated activities | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
| DE.AE-07 | Cyber threat intelligence and other contextual information are integrated into the analysis | Editorial | Para 17 | Same topic: Threat Intelligence (editorial pick) |
| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
| DE.CM-06 | External service provider activities and services are monitored to find potentially adverse events | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Govern (GV) · 18 | ||||
| GV.OC-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | Editorial | Para 32Para 33Para 34 | Same topic: Compliance (editorial pick) |
| GV.OV-03 | Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Editorial | Para 32Para 33Para 34 | Same topic: Compliance (editorial pick) |
| GV.PO-01 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | Editorial | Para 18Para 19 | Same topic: Governance Policy (editorial pick) |
| GV.PO-02 | Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Editorial | Para 18Para 19 | Same topic: Governance Policy (editorial pick) |
| GV.RM-01 | Risk management objectives are established and agreed to by organizational stakeholders | Editorial | Para 13Para 15Para 27+1 | Same topic: Risk Management (editorial pick) |
| GV.RM-02 | Risk appetite and risk tolerance statements are established, communicated, and maintained | Editorial | Para 13Para 15Para 27+1 | Same topic: Risk Management (editorial pick) |
| GV.RM-03 | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | Editorial | Para 13Para 15Para 27+1 | Same topic: Risk Management (editorial pick) |
| GV.RM-06 | A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | Editorial | Para 13Para 15Para 27+1 | Same topic: Risk Management (editorial pick) |
| GV.RR-01 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
| GV.RR-02 | Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
| GV.RR-03 | Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
| GV.SC-01 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | Editorial | Para 16Para 22 | Same topic: Supply Chain Risk (editorial pick) |
| GV.SC-03 | Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | Editorial | Para 16Para 22 | Same topic: Supply Chain Risk (editorial pick) |
| GV.SC-04 | Suppliers are known and prioritized by criticality | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| GV.SC-05 | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | Editorial | Para 16Para 22 | Same topic: Supply Chain Risk (editorial pick) |
| GV.SC-06 | Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| GV.SC-07 | The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| GV.SC-09 | Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | Editorial | Para 16Para 22 | Same topic: Supply Chain Risk (editorial pick) |
| Identify (ID) · 17 | ||||
| ID.AM-01 | Inventories of hardware managed by the organization are maintained | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| ID.AM-02 | Inventories of software, services, and systems managed by the organization are maintained | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| ID.AM-04 | Inventories of services provided by suppliers are maintained | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| ID.AM-05 | Assets are prioritized based on classification, criticality, resources, and impact on the mission | Editorial | Para 20 | Same topic: Data Classification (editorial pick) |
| ID.AM-07 | Inventories of data and corresponding metadata for designated data types are maintained | Editorial | Para 20 | Same topic: Data Classification (editorial pick) |
| ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| ID.IM-03 | Improvements are identified from execution of operational processes, procedures, and activities | Editorial | Para 25 | Same topic: Lessons Learned (editorial pick) |
| ID.IM-04 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| ID.RA-02 | Cyber threat intelligence is received from information sharing forums and sources | Editorial | Para 17 | Same topic: Threat Intelligence (editorial pick) |
| ID.RA-03 | Internal and external threats to the organization are identified and recorded | Editorial | Para 17Para 21 | Same topic: Risk Assessment, Threat Intelligence (editorial pick) |
| ID.RA-04 | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | Editorial | Para 17Para 21 | Same topic: Risk Assessment (editorial pick) |
| ID.RA-05 | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | Editorial | Para 17Para 21 | Same topic: Risk Assessment (editorial pick) |
| ID.RA-06 | Risk responses are chosen, prioritized, planned, tracked, and communicated | Editorial | Para 17Para 21 | Same topic: Risk Assessment (editorial pick) |
| ID.RA-08 | Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | Editorial | Para 16Para 22 | Same topic: Supply Chain Risk (editorial pick) |
| ID.RA-10 | Critical suppliers are assessed prior to acquisition | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Protect (PR) · 3 | ||||
| PR.DS-01 | The confidentiality, integrity, and availability of data-at-rest are protected | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| PR.DS-02 | The confidentiality, integrity, and availability of data-in-transit are protected | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| PR.DS-10 | The confidentiality, integrity, and availability of data-in-use are protected | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| Recover (RC) · 1 | ||||
| RC.RP-06 | The end of incident recovery is declared based on criteria, and incident-related documentation is completed | Editorial | Para 25 | Same topic: Lessons Learned (editorial pick) |
| Respond (RS) · 6 | ||||
| RS.CO-02 | Internal and external stakeholders are notified of incidents | Editorial | Para 35Para 36 | Same topic: Reporting (editorial pick) |
| RS.CO-03 | Information is shared with designated internal and external stakeholders | Editorial | Para 25 | Same topic: Communication (editorial pick) |
| RS.MA-01 | The incident response plan is executed in coordination with relevant third parties once an incident is declared | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| RS.MA-02 | Incident reports are triaged and validated | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| RS.MA-03 | Incidents are categorized and prioritized | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| RS.MA-04 | Incidents are escalated or elevated as needed | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
By topic
Both cover (17):
Governance PolicyRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtThreat IntelligenceData ProtectionIntrusion DetectionIncident ResponseCommunicationReportingLessons LearnedVendor Risk Mgmt
Only NIST CSF 2.0 (33):
Awareness & TrainingBusiness EnvironmentAccess ControlMulti-Factor AuthEncryptionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityWeb SecurityZero TrustMobile SecurityCloud SecurityDNS SecurityWAFDLPCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCForensicsMitigationRecovery PlanningBusiness ContinuityComms & RestoreDisaster RecoveryAPI SecurityInsider ThreatPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.