Comparison

NIST CSF 2.0 vs Cyber Essentials

NIST Cybersecurity Framework 2.0 · UK Cyber Essentials (NCSC) · data 2026-10-27

Requirement-level comparison of NIST Cybersecurity Framework 2.0 and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.

Have NIST CSF 2.0 → need Cyber Essentials

5 reqs

5 mapped · · 0 no mapping Open in gap view →

Of 5 UK Cyber Essentials (NCSC) requirements, 5 map to something in NIST CSF 2.0, 0 are only loosely related, and 0 have no mapping in our data.

Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.

Mapped (5)

Cyber Essentials	Requirement	Match	NIST CSF 2.0	Evidence
Technical controls · 5
CE 1	Firewalls	Editorial	ID.AM-03 PR.IR-01	Same topic: Firewall / Net Seg (editorial pick)
CE 2	Secure Configuration	Editorial	PR.AA-05 PR.PS-01	Same topic: Mobile Security, Secure Config (editorial pick)
CE 3	Security Update Management	Editorial	ID.AM-01 ID.AM-02 ID.AM-04+4	Same topic: Asset Management (editorial pick)
CE 4	User Access Control	Editorial	ID.AM-04 PR.AA-01 PR.AA-03+3	Same topic: Cloud Security, Access Control, Multi-Factor Auth (editorial pick)
CE 5	Malware protection	Editorial	DE.CM-09 PR.PS-05	Same topic: Endpoint Protection (editorial pick)

Have Cyber Essentials → need NIST CSF 2.0

106 reqs

15 mapped · · 91 no mapping Open in gap view →

Of 106 NIST Cybersecurity Framework 2.0 requirements, 15 map to something in Cyber Essentials, 0 are only loosely related, and 91 have no mapping in our data.

Likely new work: NIST CSF 2.0 requirements with no mapping to Cyber Essentials (91)

NIST CSF 2.0	Requirement	Match	Cyber Essentials	Evidence
Detect (DE) · 10
DE.AE-02	Potentially adverse events are analyzed to better understand associated activities	No mapping in our data	—	No mapping to Cyber Essentials in our data.
DE.AE-03	Information is correlated from multiple sources	No mapping in our data	—	No mapping to Cyber Essentials in our data.
DE.AE-04	The estimated impact and scope of adverse events are understood	No mapping in our data	—	No mapping to Cyber Essentials in our data.
DE.AE-06	Information on adverse events is provided to authorized staff and tools	No mapping in our data	—	No mapping to Cyber Essentials in our data.
DE.AE-07	Cyber threat intelligence and other contextual information are integrated into the analysis	No mapping in our data	—	No mapping to Cyber Essentials in our data.
DE.AE-08	Incidents are declared when adverse events meet the defined incident criteria	No mapping in our data	—	No mapping to Cyber Essentials in our data.
DE.CM-01	Networks and network services are monitored to find potentially adverse events	No mapping in our data	—	No mapping to Cyber Essentials in our data.
DE.CM-02	The physical environment is monitored to find potentially adverse events	No mapping in our data	—	No mapping to Cyber Essentials in our data.
DE.CM-03	Personnel activity and technology usage are monitored to find potentially adverse events	No mapping in our data	—	No mapping to Cyber Essentials in our data.
DE.CM-06	External service provider activities and services are monitored to find potentially adverse events	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Govern (GV) · 31
GV.OC-01	The organizational mission is understood and informs cybersecurity risk management	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.OC-02	Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.OC-03	Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.OC-04	Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.OC-05	Outcomes, capabilities, and services that the organization depends on are understood and communicated	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.OV-01	Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.OV-02	The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.OV-03	Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.PO-01	Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.PO-02	Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RM-01	Risk management objectives are established and agreed to by organizational stakeholders	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RM-02	Risk appetite and risk tolerance statements are established, communicated, and maintained	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RM-03	Cybersecurity risk management activities and outcomes are included in enterprise risk management processes	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RM-04	Strategic direction that describes appropriate risk response options is established and communicated	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RM-05	Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RM-06	A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RM-07	Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RR-01	Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RR-02	Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RR-03	Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.RR-04	Cybersecurity is included in human resources practices	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-01	A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-02	Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-03	Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-04	Suppliers are known and prioritized by criticality	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-05	Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-06	Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-07	The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-08	Relevant suppliers and other third parties are included in incident planning, response, and recovery activities	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-09	Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle	No mapping in our data	—	No mapping to Cyber Essentials in our data.
GV.SC-10	Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Identify (ID) · 14
ID.AM-05	Assets are prioritized based on classification, criticality, resources, and impact on the mission	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.AM-07	Inventories of data and corresponding metadata for designated data types are maintained	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.IM-01	Improvements are identified from evaluations	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.IM-02	Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.IM-03	Improvements are identified from execution of operational processes, procedures, and activities	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.IM-04	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.RA-02	Cyber threat intelligence is received from information sharing forums and sources	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.RA-03	Internal and external threats to the organization are identified and recorded	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.RA-04	Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.RA-05	Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.RA-06	Risk responses are chosen, prioritized, planned, tracked, and communicated	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.RA-07	Changes and exceptions are managed, assessed for risk impact, recorded, and tracked	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.RA-09	The authenticity and integrity of hardware and software are assessed prior to acquisition and use	No mapping in our data	—	No mapping to Cyber Essentials in our data.
ID.RA-10	Critical suppliers are assessed prior to acquisition	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Protect (PR) · 15
PR.AA-02	Identities are proofed and bound to credentials based on the context of interactions	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.AA-04	Identity assertions are protected, conveyed, and verified	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.AA-06	Physical access to assets is managed, monitored, and enforced commensurate with risk	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.AT-01	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.AT-02	Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.DS-01	The confidentiality, integrity, and availability of data-at-rest are protected	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.DS-02	The confidentiality, integrity, and availability of data-in-transit are protected	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.DS-10	The confidentiality, integrity, and availability of data-in-use are protected	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.DS-11	Backups of data are created, protected, maintained, and tested	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.IR-02	The organization's technology assets are protected from environmental threats	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.IR-03	Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.IR-04	Adequate resource capacity to ensure availability is maintained	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.PS-03	Hardware is maintained, replaced, and removed commensurate with risk	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.PS-04	Log records are generated and made available for continuous monitoring	No mapping in our data	—	No mapping to Cyber Essentials in our data.
PR.PS-06	Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Recover (RC) · 8
RC.CO-03	Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RC.CO-04	Public updates on incident recovery are shared using approved methods and messaging	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RC.RP-01	The recovery portion of the incident response plan is executed once initiated from the incident response process	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RC.RP-02	Recovery actions are selected, scoped, prioritized, and performed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RC.RP-03	The integrity of backups and other restoration assets is verified before using them for restoration	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RC.RP-04	Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RC.RP-05	The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RC.RP-06	The end of incident recovery is declared based on criteria, and incident-related documentation is completed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
Respond (RS) · 13
RS.AN-03	Analysis is performed to establish what has taken place during an incident and the root cause of the incident	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.AN-06	Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.AN-07	Incident data and metadata are collected, and their integrity and provenance are preserved	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.AN-08	An incident's magnitude is estimated and validated	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.CO-02	Internal and external stakeholders are notified of incidents	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.CO-03	Information is shared with designated internal and external stakeholders	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.MA-01	The incident response plan is executed in coordination with relevant third parties once an incident is declared	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.MA-02	Incident reports are triaged and validated	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.MA-03	Incidents are categorized and prioritized	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.MA-04	Incidents are escalated or elevated as needed	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.MA-05	The criteria for initiating incident recovery are applied	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.MI-01	Incidents are contained	No mapping in our data	—	No mapping to Cyber Essentials in our data.
RS.MI-02	Incidents are eradicated	No mapping in our data	—	No mapping to Cyber Essentials in our data.

Mapped (15)

NIST CSF 2.0	Requirement	Match	Cyber Essentials	Evidence
Detect (DE) · 1
DE.CM-09	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events	Editorial	CE 5	Same topic: Endpoint Protection (editorial pick)
Identify (ID) · 7
ID.AM-01	Inventories of hardware managed by the organization are maintained	Editorial	CE 3	Same topic: Asset Management (editorial pick)
ID.AM-02	Inventories of software, services, and systems managed by the organization are maintained	Editorial	CE 3	Same topic: Asset Management (editorial pick)
ID.AM-03	Representations of the organization's authorized network communication and internal and external network data flows are maintained	Editorial	CE 1	Same topic: Firewall / Net Seg (editorial pick)
ID.AM-04	Inventories of services provided by suppliers are maintained	Editorial	CE 3 CE 4	Same topic: Asset Management, Cloud Security (editorial pick)
ID.AM-08	Systems, hardware, software, services, and data are managed throughout their life cycles	Editorial	CE 3	Same topic: Asset Management (editorial pick)
ID.RA-01	Vulnerabilities in assets are identified, validated, and recorded	Editorial	CE 3	Same topic: Vulnerability Mgmt (editorial pick)
ID.RA-08	Processes for receiving, analyzing, and responding to vulnerability disclosures are established	Editorial	CE 3	Same topic: Vulnerability Mgmt (editorial pick)
Protect (PR) · 7
PR.AA-01	Identities and credentials for authorized users, services, and hardware are managed by the organization	Editorial	CE 4	Same topic: Access Control (editorial pick)
PR.AA-03	Users, services, and hardware are authenticated	Editorial	CE 4	Same topic: Multi-Factor Auth (editorial pick)
PR.AA-05	Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Editorial	CE 2 CE 4	Same topic: Mobile Security, Access Control, Privileged Access (editorial pick)
PR.IR-01	Networks and environments are protected from unauthorized logical access and usage	Editorial	CE 1 CE 4	Same topic: Firewall / Net Seg, Cloud Security (editorial pick)
PR.PS-01	Configuration management practices are established and applied	Editorial	CE 2 CE 4	Same topic: Secure Config, Mobile Security, Cloud Security (editorial pick)
PR.PS-02	Software is maintained, replaced, and removed commensurate with risk	Editorial	CE 3	Same topic: Patch Management (editorial pick)
PR.PS-05	Installation and execution of unauthorized software are prevented	Editorial	CE 5	Same topic: Endpoint Protection (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.

NIST CSF 2.0 vs Cyber Essentials

Have NIST CSF 2.0 → need Cyber Essentials

Have Cyber Essentials → need NIST CSF 2.0

By topic