GRCLibrary.ai

Crosswalk

NIST CSF 2.0

Frameworks and control catalogues.

Where the corpus maps to NIST CSF 2.0: Cybersecurity Framework.

Canonical citation

Standard ID
NIST CSF
Current version
2.0
Publication date
2024-02
Topic
Cybersecurity Framework
Upstream check location
https://www.nist.gov/cyberframework (opens in a new tab)
Last verified (UTC)
2026-06-30

Mapped control areas, 14

Control areas from the reverse crosswalk

From the Reverse Framework Control Crosswalk Matrix, which answers: given a control identifier or family, which documents address it.

CSF function and categoryLibrary documentsAlignment type
GOVERN GV.OC Organizational ContextGovernance Library Charter, Enterprise Governance and Risk Management PolicyArchitectural recommendation
GOVERN GV.RM Risk Management StrategyEnterprise Risk Management Standard, Risk Appetite Statement Template, Quantitative Risk Analysis GuidelineArchitectural recommendation
GOVERN GV.RR Roles, Responsibilities, and AuthoritiesRole Authority RegisterEvidence category
GOVERN GV.PO PolicyInformation Security Policy, Privacy and Data Governance Policy, Enterprise Governance and Risk Management PolicyArchitectural recommendation
GOVERN GV.SC Cybersecurity Supply Chain Risk ManagementThird-Party and Supply Chain Risk Standard, Supplier and Cloud Governance Framework, Supplier Security and Privacy Assurance StandardArchitectural recommendation
IDENTIFY ID.AM Asset ManagementAsset Inventory Register, AI System Register TemplateEvidence category
IDENTIFY ID.RA Risk AssessmentRisk Assessment Methodology Procedure, Risk Register Procedure, Key Risk Indicator CatalogueArchitectural recommendation
PROTECT PR.AA Identity Management, Authentication, and Access ControlIdentity and Access Management Policy, Authentication and Password Management Standard, Privileged Access Management StandardArchitectural recommendation
PROTECT PR.DS Data SecurityData Classification and Handling Standard, Data Loss Prevention Standard, Encryption and Key Management PolicyArchitectural recommendation
PROTECT PR.IR Technology Infrastructure ResilienceProduction Security Requirements, Cloud Security Configuration Baseline, Network Security and Segmentation StandardArchitectural recommendation
DETECT DE.CM Continuous MonitoringLogging and Monitoring Standard, Security Monitoring and Alert Management Procedure, Threat Intelligence and SIEM Operations ProcedureArchitectural recommendation
RESPOND RS.MA Incident ManagementSecurity Incident Response Procedure, Cross-Domain Incident Coordination ProcedureArchitectural recommendation
RESPOND RS.CO Incident Response Reporting and CommunicationCrisis Communication Plan, Security Incident Reporting and Escalation ProcedureArchitectural recommendation
RECOVER RC.RP Incident Recovery Plan ExecutionIT Disaster Recovery Plan, Backup and Recovery Procedure, Continuity and Recovery Testing ProcedureArchitectural recommendation

Coverage, 12 domains

Coverage by domain

From the GRC Library Compliance Alignment Matrix; the main crosswalk table's document counts land here.

Governance, 17 documents

Risk, 13 documents

Compliance, 30 documents

Security, 36 documents

Operations, 26 documents

Supply chain, 17 documents

Resilience, 21 documents

Privacy, 49 documents

Architecture, 8 documents

Dev security, 17 documents

AI, 39 documents

Crypto, 2 documents

Corpus citations, 45

Documents naming it in their framework alignment

Generated from each document's framework alignment list in the taxonomy, through the committed alias map.

Note

What this mapping is

From the GRC Library Compliance Alignment Matrix: citations are indicative, not exhaustive (the representative-citation convention), and no entry constitutes a certification, attestation, or legal opinion.

From the Reverse Framework Control Crosswalk Matrix: coverage is partial, and external control identifiers and clause numbers are referenced for navigation only; the library does not reproduce third-party control text.

From the Cross-Framework Alignment Matrix: the alignment is not an official mapping, certification claim, legal opinion, or reproduction of third-party framework content.

The standards, laws, frameworks, and programmes in the canonical citations register, mapped here or not, are listed with their current editions on the Standards & frameworks page, generated from that register.