NIST Cybersecurity Framework (1.1, legacy)
Kept for programs still reporting against 1.1 during the move to 2.0.
What NIST Cybersecurity Framework (1.1, legacy) is
CSF 1.1, published in April 2018, is the version of the Cybersecurity Framework that most existing security programmes were built on: five functions — Identify, Protect, Detect, Respond, Recover — with categories and subcategories beneath them. It was superseded by CSF 2.0 in February 2024.
It is still here because compliance programmes do not turn over on a publication date. Organisations mid-assessment, mid-audit or mid-contract-term against 1.1 need to keep reporting against 1.1 while they build 2.0, and deleting the older control set to force a migration would break exactly the customers who are being diligent.
If you are starting from nothing, start on 2.0. This page exists so that a search for CSF 1.1 finds an honest answer rather than a page pretending 1.1 is current.
Who it applies to
- Organisations with an in-flight assessment, audit or contractual commitment written against CSF 1.1.
- Teams migrating to CSF 2.0 who need both control sets live at once during the transition.
- Nobody starting a new programme. Use CSF 2.0.
How it is structured in CMDash
CMDash seeds the CSF 1.1 subcategories across the five functions. Subcategory-level, same convention as CSF 2.0.
| Identify (ID) | 29 |
| Protect (PR) | 39 |
| Detect (DE) | 18 |
| Respond (RS) | 16 |
| Recover (RC) | 6 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
Scope: Legacy. New programs should start on CSF 2.0.
The control text
108 of the 108 seeded controls carry the publisher’s own wording, taken from NIST Cybersecurity Framework (CSF) 1.1. It is public-domain content, so CMDash reproduces it rather than paraphrasing — you assess against what the publisher wrote.
What CMDash does for NIST Cybersecurity Framework (1.1, legacy)
- Verbatim CSF 1.1 subcategory text, from the public-domain publication.
- A direct, seeded crosswalk to CSF 2.0 — the largest single framework-to-framework mapping in the catalogue — so evidence collected against 1.1 carries forward instead of being re-gathered.
- CSF 1.1 also acts as a legacy crosswalk hub: most of the older mappings in the catalogue route through it, which is part of why it is retained rather than deleted.
- The same five-function dashboard, control assessment, evidence and POA&M export as any other framework.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to NIST Cybersecurity Framework (1.1, legacy)’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- This is a superseded framework and CMDash labels it as such in the product and here. No new mapping work is being added against it.
- It has no GOVERN function. Governance outcomes live under Identify, which is precisely the shortcoming 2.0 was published to fix.
Common questions
How do we migrate to 2.0 without losing our assessment history?
Run both. CMDash seeds a direct 1.1-to-2.0 crosswalk, so you can enable 2.0 alongside 1.1, let the mapping show which 2.0 subcategories your existing evidence already speaks to, and retire 1.1 when your last contractual reference to it does.
Is 1.1 evidence still valid?
The evidence is; the framing is what changed. Almost every 1.1 subcategory has a 2.0 counterpart, and the genuinely new work in 2.0 is concentrated in GOVERN — supply-chain risk management, oversight and policy — rather than in the technical functions.
Also in Security Programs
Paid plans cap how many frameworks you run at once, never which ones — NIST Cybersecurity Framework (1.1, legacy) is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.