NIST Cybersecurity Framework 2.0 control library

Every control CMDash tracks for NIST Cybersecurity Framework 2.0, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.

106 controls6 families61 mapped to other frameworks106 with authoritative text

Families

Govern (GV) · 31 Identify (ID) · 21 Protect (PR) · 22 Detect (DE) · 11 Respond (RS) · 13 Recover (RC) · 8

Govern (GV) · 31

GV.OC-01	The organizational mission is understood and informs cybersecurity risk management Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
GV.OC-02	Internal and external stakeholders are understood, and their needs and expectations are considered Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
GV.OC-03	Legal, regulatory, and contractual requirements are understood and managed Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
GV.OC-04	Critical objectives, capabilities, and services that stakeholders depend on are communicated Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
GV.OC-05	Outcomes, capabilities, and services that the organization depends on are communicated Maps to NIST Cybersecurity Framework (1.1, legacy)
GV.RM-01	Risk management objectives are established and agreed to by organizational stakeholders Maps to NIST Cybersecurity Framework (1.1, legacy)
GV.RM-02	Risk appetite and risk tolerance statements are established, communicated, and maintained Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
GV.RM-03	Cybersecurity risk management activities and outcomes are included in enterprise risk management Maps to NIST Cybersecurity Framework (1.1, legacy)
GV.RM-04	Strategic direction that describes appropriate risk response options is established
GV.RM-05	Lines of communication across the organization are established for cybersecurity risks
GV.RM-06	A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established Maps to NIST Cybersecurity Framework (1.1, legacy)
GV.RM-07	Strategic opportunities (positive risks) are identified and included in risk discussions
GV.RR-01	Organizational leadership is responsible and accountable for cybersecurity risk Maps to NIST AI Risk Management Framework 1.0, SOC 2 Type II
GV.RR-02	Roles, responsibilities, and authorities related to cybersecurity risk management are established Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy) +1 more
GV.RR-03	Adequate resources are allocated commensurate with cybersecurity risk strategy
GV.RR-04	Cybersecurity is included in human resources practices Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy)
GV.PO-01	Policy for managing cybersecurity risks is established based on organizational context Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy) +1 more
GV.PO-02	Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced
GV.OV-01	Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Maps to NIST AI Risk Management Framework 1.0
GV.OV-02	The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
GV.OV-03	Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments Maps to SOC 2 Type II
GV.SC-01	A cybersecurity supply chain risk management program is established Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
GV.SC-02	Cybersecurity roles and responsibilities for suppliers, customers, and partners are established
GV.SC-03	Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management
GV.SC-04	Suppliers are known and prioritized by criticality Maps to NIST Cybersecurity Framework (1.1, legacy)
GV.SC-05	Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
GV.SC-06	Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
GV.SC-07	The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
GV.SC-08	Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
GV.SC-09	Supply chain security practices are integrated into cybersecurity and enterprise risk management programs
GV.SC-10	Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement

Identify (ID) · 21

ID.AM-01	Inventories of hardware managed by the organization are maintained Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy)
ID.AM-02	Inventories of software, services, and systems managed by the organization are maintained Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
ID.AM-03	Representations of the organization's authorized network communication and internal and external network data flows are maintained Maps to NIST Cybersecurity Framework (1.1, legacy)
ID.AM-04	Inventories of services provided by suppliers are maintained Maps to NIST Cybersecurity Framework (1.1, legacy)
ID.AM-05	Assets are prioritized based on classification, criticality, resources, and impact on the mission Maps to NIST Cybersecurity Framework (1.1, legacy)
ID.AM-07	Inventories of data and corresponding metadata for designated data types are maintained Maps to ISO/IEC 27001:2022
ID.AM-08	Systems, hardware, software, services, and data are managed throughout their life cycles Maps to NIST AI Risk Management Framework 1.0
ID.RA-01	Vulnerabilities in assets are identified, validated, and recorded Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
ID.RA-02	Cyber threat intelligence is received from information sharing forums and sources Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy)
ID.RA-03	Internal and external threats to the organization are identified and recorded Maps to NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
ID.RA-04	Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
ID.RA-05	Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
ID.RA-06	Risk responses are chosen, prioritized, planned, tracked, and communicated Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
ID.RA-07	Changes and exceptions are managed, assessed for risk impact, recorded, and tracked Maps to SOC 2 Type II
ID.RA-08	Processes for receiving, analyzing, and responding to vulnerability disclosures are established
ID.RA-09	The authenticity and integrity of hardware and software are assessed prior to acquisition and use
ID.RA-10	Critical suppliers are assessed prior to acquisition
ID.IM-01	Improvements are identified from evaluations
ID.IM-02	Improvements are identified from security tests and exercises, including those done in coordination with suppliers and third parties
ID.IM-03	Improvements are identified from execution of operational processes, procedures, and activities
ID.IM-04	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy)

Protect (PR) · 22

PR.AA-01	Identities and credentials for authorized users, services, and hardware are managed by the organization Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
PR.AA-02	Identities are proofed and bound to credentials based on the context of interactions Maps to NIST Cybersecurity Framework (1.1, legacy)
PR.AA-03	Users, services, and hardware are authenticated Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
PR.AA-04	Identity assertions are protected, conveyed, and verified
PR.AA-05	Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
PR.AA-06	Physical access to assets is managed, monitored, and enforced commensurate with risk Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy)
PR.AT-01	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
PR.AT-02	Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind Maps to NIST Cybersecurity Framework (1.1, legacy)
PR.DS-01	The confidentiality, integrity, and availability of data-at-rest are protected Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
PR.DS-02	The confidentiality, integrity, and availability of data-in-transit are protected Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
PR.DS-10	The confidentiality, integrity, and availability of data-in-use are protected
PR.DS-11	Backups of data are created, protected, maintained, and tested Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy)
PR.PS-01	Configuration management practices are established and applied Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
PR.PS-02	Software is maintained, replaced, and removed commensurate with risk
PR.PS-03	Hardware is maintained, replaced, and removed commensurate with risk
PR.PS-04	Log records are generated and made available for continuous monitoring Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy)
PR.PS-05	Installation and execution of unauthorized software are prevented Maps to NIST Cybersecurity Framework (1.1, legacy)
PR.PS-06	Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy)
PR.IR-01	Networks and environments are protected from unauthorized logical access and usage Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
PR.IR-02	The organization's technology assets are protected from environmental threats
PR.IR-03	Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
PR.IR-04	Adequate resource capacity to ensure availability is maintained

Detect (DE) · 11

DE.CM-01	Networks and network services are monitored to find potentially adverse events Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
DE.CM-02	The physical environment is monitored to find potentially adverse events Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy)
DE.CM-03	Personnel activity and technology usage are monitored to find potentially adverse events
DE.CM-06	External service provider activities and services are monitored to find potentially adverse events
DE.CM-09	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Maps to ISO/IEC 27001:2022, NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
DE.AE-02	Potentially adverse events are analyzed to better understand associated activities Maps to NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
DE.AE-03	Information is correlated from multiple sources Maps to NIST Cybersecurity Framework (1.1, legacy)
DE.AE-04	The estimated impact and scope of adverse events are understood
DE.AE-06	Information on adverse events is provided to authorized staff and tools
DE.AE-07	Cyber threat intelligence and other contextual information are integrated into the analysis
DE.AE-08	Incidents are declared when adverse events meet the defined incident criteria

Respond (RS) · 13

RS.MA-01	The incident response plan is executed in coordination with relevant third parties once an incident is declared Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
RS.MA-02	Incident reports are triaged and validated
RS.MA-03	Incidents are categorized and prioritized
RS.MA-04	Incidents are escalated or elevated as needed
RS.MA-05	The criteria for initiating incident recovery are applied
RS.AN-03	Analysis is performed to establish what has taken place during an incident and the root cause of the incident Maps to NIST Cybersecurity Framework (1.1, legacy)
RS.AN-06	Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
RS.AN-07	Incident data and metadata are collected, and their integrity and provenance are preserved
RS.AN-08	An incident's magnitude is estimated and validated
RS.CO-02	Internal and external stakeholders are notified of incidents Maps to NIST AI Risk Management Framework 1.0, NIST Cybersecurity Framework (1.1, legacy)
RS.CO-03	Information is shared with designated internal and external stakeholders
RS.MI-01	Incidents are contained Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
RS.MI-02	Incidents are eradicated

Recover (RC) · 8

RC.RP-01	The recovery portion of the incident response plan is executed once initiated from the incident response process Maps to NIST Cybersecurity Framework (1.1, legacy), SOC 2 Type II
RC.RP-02	Recovery actions are selected, scoped, prioritized, and performed
RC.RP-03	The integrity of backups and other restoration assets is verified before using them for restoration
RC.RP-04	Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms
RC.RP-05	The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed
RC.RP-06	The end of incident recovery is declared based on criteria, and incident-related documentation is completed
RC.CO-03	Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders Maps to NIST Cybersecurity Framework (1.1, legacy)
RC.CO-04	Public updates on incident recovery are shared using approved methods and messaging

Where this comes from

Control identifiers, families and titles are the rows CMDash’s own seed data writes for NIST Cybersecurity Framework 2.0 2.0, published from a build-time export rather than read from any customer’s workspace. Control text is quoted verbatim from NIST Cybersecurity Framework (CSF) 2.0, which is in the public domain. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.

Track these controls in CMDash

Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.

Start free trial About NIST Cybersecurity Framework 2.0