csf-mapping

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

CSF Mapping — NIST Cybersecurity Framework 2.0 Posture Assessment

CSF 映射——NIST Cybersecurity Framework 2.0 态势评估

Translate your security posture into the language every CISO, board, auditor, and insurer already speaks. Distinct from the audit skills (which find specific issues); this skill assesses your program against a recognized framework and produces governance-ready output.

NIST CSF 2.0 is the framework that, as of 2024, replaced CSF 1.1. It added a sixth function — Govern — recognizing that the others can't work without governance backing.

The six functions:

Function	What it covers
Govern (GV)	Cybersecurity strategy, roles, policies, oversight, supply chain risk
Identify (ID)	Asset inventory, business environment, risk assessment, supply chain
Protect (PR)	Access control, awareness, data security, baseline configurations, maintenance, protective tech
Detect (DE)	Continuous monitoring, anomaly detection, adverse event analysis
Respond (RS)	Incident management, analysis, mitigation, reporting, comms
Recover (RC)	Recovery planning, improvements, communications

Each function contains Categories (e.g.,

PR.AA

— Identity Management, Authentication, and Access Control), and each category contains Subcategories (e.g.,

PR.AA-01

— Identities and credentials for authorized users, services, and hardware are managed).

This skill maps your reality to those Subcategories.

Cross-references: every audit skill in this repo (they produce evidence that becomes the "current state" entries here),

iam-audit

(most of PR.AA),

siem-detection

(most of DE),

incident-triage

(most of RS),

threat-modeling

(informs ID.RA risk assessment),

breach-patterns

(informs ID.IM improvements from lessons learned).

将你的安全态势转换为每位 CISO、董事会、审计师和保险方都已掌握的语言。与 audit skills（用于发现具体问题）不同；本 skill 评估你的安全体系是否符合公认框架，并生成可直接用于治理的交付物。

NIST CSF 2.0 是自 2024 年起取代 CSF 1.1 的框架。它新增了第六个功能——Govern——这表明如果缺乏治理支持，其他功能都无法正常发挥作用。

六个功能：

功能	覆盖内容
Govern (GV)	网络安全战略、角色、策略、监督、供应链风险
Identify (ID)	资产清单、业务环境、风险评估、供应链
Protect (PR)	访问控制、安全意识、数据安全、基线配置、维护、防护技术
Detect (DE)	持续监控、异常检测、不利事件分析
Respond (RS)	事件管理、分析、缓解、报告、沟通
Recover (RC)	恢复规划、改进、沟通

每个功能都包含 Categories（例如

PR.AA

— Identity Management, Authentication, and Access Control），每个 Category 又包含 Subcategories（例如

PR.AA-01

— Identities and credentials for authorized users, services, and hardware are managed）。

本 skill 会将实际情况映射到这些 Subcategories。

交叉引用：本仓库中的每个 audit skill 都会生成证据，这些证据将作为此处的「当前状态」条目；其中

iam-audit

覆盖 PR.AA 的大部分内容，

siem-detection

覆盖 DE 的大部分内容，

incident-triage

覆盖 RS 的大部分内容，

threat-modeling

为 ID.RA 风险评估提供输入，

breach-patterns

为 ID.IM 中基于经验教训的改进提供输入。

Authorization

授权范围

Map the user's own organization, or a client that engaged them, from evidence they provide or point you to. This skill reads policies, configs and audit output; it doesn't probe systems. Keep the evidence inside the assessment, and don't infer another organization's posture from public data.

仅映射用户所属组织，或用户受聘为其提供服务的客户；依据用户提供的证据或用户指定的证据进行映射。本 skill 会读取策略、配置和审计输出；不会探测系统。将证据保留在评估范围内，不要依据公开数据推断其他组织的态势。

Methodology

方法论

Step 1 — Establish scope

第 1 步——确定范围

CSF assessments are scope-bounded. Decide which of these you're assessing:

Whole organization — every system, every business unit
One product / service — for vendor due-diligence questionnaires (SIG, CAIQ)
One environment — production cloud only, or PCI-in-scope only
Regulatory scope — HIPAA-covered systems, FedRAMP boundary, etc.

Write down what's in and what's out. Most CSF assessments fail at scope drift.

CSF 评估具有明确的范围边界。确定你要评估以下哪一种：

整个组织——所有系统、所有业务单元
单一产品/服务——用于供应商尽职调查问卷（SIG、CAIQ）
单一环境——仅生产云，或仅 PCI 范围内的系统
监管范围——HIPAA 涵盖的系统、FedRAMP 边界等

明确记录哪些内容纳入、哪些内容排除。大多数 CSF 评估都因范围蔓延而失败。

Step 2 — Choose your CSF profile

第 2 步——选择 CSF Profile

CSF 2.0 introduced Organizational Profiles — instead of "score every Subcategory equally," you tailor based on what matters.

Current Profile — where you actually are
Target Profile — where you want to be (informed by business goals, regulatory requirements, risk appetite)
Community Profile — pre-built profile for your sector (manufacturing, healthcare, financial services — published by NIST and others)

For a first-pass assessment, start with a Community Profile if one exists for your sector, then tailor.

CSF 2.0 引入了 Organizational Profiles。它允许你根据实际情况调整评估重点，而不是对所有 Subcategories 一视同仁地评分。

Current Profile——你当前的实际状态
Target Profile——你期望达到的状态，由业务目标、监管要求和风险偏好共同决定
Community Profile——针对特定行业预建的 Profile（制造业、医疗保健、金融服务等），由 NIST 等机构发布

首次评估时，如果所在行业已有可用的 Community Profile，应先从它开始，再根据实际情况调整。

Step 3 — Assess each Subcategory

第 3 步——评估每个 Subcategory

For each Subcategory in scope:

Field	What to record
ID	e.g., `PR.AA-05`
Subcategory text	Verbatim from NIST or paraphrased
Current state	What you actually do today (evidence, not aspiration)
Evidence	Document / system / process that proves the current state
Tier	Partial / Risk-Informed / Repeatable / Adaptive (1-4)
Target tier	What you're aiming for
Gap	The delta
Plan	What closes the gap
Owner	Who's accountable
Timeline	When

针对范围内的每个 Subcategory，记录以下信息：

字段	记录内容
ID	例如 `PR.AA-05`
子类别文本	NIST 原文或释义
当前状态	你目前实际采用的做法（依据证据，而非愿景）
证据	证明当前状态的文件、系统或流程
层级	Partial / Risk-Informed / Repeatable / Adaptive（1-4）
目标层级	你希望达到的层级
差距	当前状态与目标状态之间的差异
计划	缩小差距的具体措施
负责人	承担最终责任的人
时间	完成时间

CSF Implementation Tiers

Tier	Name	Characteristic
1	Partial	Ad-hoc, reactive, undocumented; awareness is informal
2	Risk-Informed	Risk management is approved but not org-wide; processes are repeatable for some teams
3	Repeatable	Documented org-wide policies; consistent processes; risk-informed budgeting
4	Adaptive	Continuous improvement; quantitative risk; learning from incidents (yours and peers'); cybersecurity culture

Tier 4 is rare and expensive. Most mature SaaS orgs target Tier 3 across most subcategories. Set targets based on what the business actually needs, not what looks good.

层级	名称	特征
1	Partial	临时、被动、无文档；安全意识停留在非正式层面
2	Risk-Informed	风险管理已获批准，但尚未覆盖整个组织；部分团队的流程具有可重复性
3	Repeatable	已形成全组织文档化策略；流程保持一致；预算决策以风险为依据
4	Adaptive	持续改进；量化风险；从自身及同行的事件中学习；形成网络安全文化

Tier 4 很少出现且成本高昂。大多数成熟的 SaaS 组织会针对大多数 Subcategories 将 Tier 3 作为目标。应根据业务的实际需要设定目标，而不是选择看起来更好的等级。

Step 4 — Identify gaps and prioritize

第 4 步——识别差距并确定优先级

For each gap, ask:

Impact if exploited / not addressed (regulatory, reputational, financial)
Likelihood given current threat landscape and your specific exposure
Cost to close (engineering hours, tooling, headcount)
Dependencies on other gaps closing first

Prioritize by Risk × Cost-to-close — not just by risk. Some critical-risk items take a year and three vendors; some quick wins reduce real risk in a sprint.

针对每个差距，询问：

如果遭到利用或问题未解决，会产生什么影响（监管、声誉、财务）
结合当前威胁环境和具体暴露情况，发生的可能性有多大
缩小差距的成本是多少（工程工时、工具、人员）
是否依赖其他差距先被关闭

按风险 × 关闭成本排序，而不只是按风险排序。有些高风险事项需要一年时间和三家供应商才能解决；另一些快速见效项则能在一个 sprint 内显著降低实际风险。

Step 5 — Build the roadmap

第 5 步——制定路线图

CSF roadmaps usually run in quarters with annual targets. A useful structure:

Next 30 days — immediate gaps (quick wins, low-cost high-risk items)
Next 90 days — medium effort, named owners, defined success criteria
Next 12 months — strategic gaps requiring budget approval, tooling decisions, headcount
Annual review — full reassessment; profile refresh; tier movement

Each item on the roadmap names: the Subcategory it closes, the owner, the budget, the success metric, the review date.

CSF 路线图通常以季度推进，并设定年度目标。一个实用结构如下：

未来 30 天——需要立即处理的差距（快速见效项、低成本高风险事项）
未来 90 天——工作量中等的事项，明确负责人并定义成功标准
未来 12 个月—需要预算审批、工具选型和人员配置的战略差距
年度审查——全面重新评估；刷新 Profile；调整层级

路线图中的每个事项都应注明：它所关闭的 Subcategory、负责人、预算、成功指标和审查日期。

Subcategory cross-references to skills in this repo

Subcategory 与本仓库各 skill 的交叉引用

A useful shortcut — these are the audit skills that produce evidence for which CSF Subcategories.

CSF Subcategory	Audit skill	Type of evidence
`GV.SC` (Supply Chain Risk)	`dependency-audit`	CVE inventory, vendor list, supply chain risk register
`ID.AM` (Asset Management)	`cloud-audit` , `container-audit` , `recon`	Asset inventory output
`ID.RA` (Risk Assessment)	`threat-modeling` , `breach-patterns`	Threat models, breach-pattern coverage doc
`ID.IM` (Improvement from past incidents)	`incident-triage` post-mortems, `breach-patterns`	Post-incident reviews, lessons-learned applied
`PR.AA` (Identity & Access Control)	`iam-audit`	IAM audit reports, role inventory
`PR.DS` (Data Security)	`crypto-audit` , `secrets-audit`	Crypto posture, secrets management posture
`PR.PS` (Platform Security)	`container-audit` , `cloud-audit`	K8s hardening, cloud posture
`PR.IR` (Infrastructure Resilience)	`container-audit` , `cloud-audit`	Network policy, segmentation, backup posture
`DE.CM` (Continuous Monitoring)	`siem-detection` , `soc-operations`	SIEM coverage, ATT&CK Navigator export
`DE.AE` (Anomaly & Event Analysis)	`siem-detection` , `threat-hunting`	Detection rule inventory, hunt findings
`RS.MA` (Incident Management)	`incident-triage` , `soc-operations`	IR plan, runbooks, recent incident reports
`RS.AN` (Analysis)	`disk-forensics` , `incident-triage`	Forensic analysis outputs
`RS.MI` (Mitigation)	`finding-triage` , `incident-triage`	Triage decisions, mitigation tracking
`RC.RP` (Recovery Plan)	(not directly covered — separate BCP/DR work)	BCP / DR plans, tested recovery

For Subcategories without direct skill coverage, the gap is usually "we have technical depth but not the program-level artifact." E.g.,

RC.RP-01

(Recovery plan is executed during or after an incident) needs an actual documented and tested BCP/DR plan — running incident-triage doesn't automatically produce one.

一种便捷方法是使用这些 audit skills，它们会为特定 CSF Subcategories 生成证据。

CSF Subcategory	Audit skill	证据类型
`GV.SC` （Supply Chain Risk）	`dependency-audit`	CVE 清单、供应商列表、供应链风险登记册
`ID.AM` （Asset Management）	`cloud-audit` 、 `container-audit` 、 `recon`	资产清单输出
`ID.RA` （Risk Assessment）	`threat-modeling` 、 `breach-patterns`	威胁模型、breach-pattern 覆盖文档
`ID.IM` （Improvement from past incidents）	`incident-triage` 复盘报告、 `breach-patterns`	事件后复盘、应用经验教训
`PR.AA` （Identity & Access Control）	`iam-audit`	IAM 审计报告、角色清单
`PR.DS` （Data Security）	`crypto-audit` 、 `secrets-audit`	加密态势、secrets 管理态势
`PR.PS` （Platform Security）	`container-audit` 、 `cloud-audit`	K8s 加固、云安全态势
`PR.IR` （Infrastructure Resilience）	`container-audit` 、 `cloud-audit`	Network policy、分段、备份态势
`DE.CM` （Continuous Monitoring）	`siem-detection` 、 `soc-operations`	SIEM 覆盖范围、ATT&CK Navigator 导出
`DE.AE` （Anomaly & Event Analysis）	`siem-detection` 、 `threat-hunting`	检测规则清单、狩猎发现
`RS.MA` （Incident Management）	`incident-triage` 、 `soc-operations`	IR 计划、runbooks、近期事件报告
`RS.AN` （Analysis）	`disk-forensics` 、 `incident-triage`	取证分析输出
`RS.MI` （Mitigation）	`finding-triage` 、 `incident-triage`	分诊决策、缓解跟踪
`RC.RP` （Recovery Plan）	（未直接覆盖——属于单独的 BCP/DR 工作）	BCP/DR 计划、经过测试的恢复能力

对于没有直接 skill 覆盖的 Subcategories，差距通常在于「已有技术深度，但缺少项目层面的交付物」。例如，

RC.RP-01

（Recovery plan is executed during or after an incident）需要一份有文档记录且经过测试的 BCP/DR 计划；运行

incident-triage

并不会自动生成该计划。

High-impact gaps most orgs have

大多数组织常见的高影响差距

Patterns I see repeatedly in CSF assessments. Not universal, but starting points:

GV.OC-04 (Critical objectives, capabilities, and services are identified and communicated) — Most orgs can't name their crown-jewel systems consistently across security, IT, and engineering
GV.SC (Supply Chain Risk Management category) — Either no vendor risk program at all, or one that exists on paper but doesn't actually gate procurement
ID.AM-08 (Systems, hardware, software, services, and data are managed throughout their life cycles) — Asset inventory is "the SaaS vendor's list" plus "what we remember"
ID.IM-04 (Incident response plans are exercised) — Plan exists, last tested three years ago
PR.AA-05 (Access permissions and authorizations are managed, incorporating the principles of least privilege) — Quarterly access review exists in policy, not in practice
PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected) — Encryption at rest "yes," but key management is "ask AWS"
DE.AE-08 (Incidents are declared when adverse events meet defined criteria) — Criteria not actually defined; "we'll know when we see it"
RS.CO-02 (Internal and external stakeholders are notified of incidents) — Notification matrix is in someone's head
RC.RP-01 (Recovery plan is executed) — Documented, never tested

以下是我在 CSF 评估中反复看到的模式。它们并非适用于所有组织，但可以作为起点：

GV.OC-04（Critical objectives, capabilities, and services are identified and communicated）——大多数组织无法在安全、IT 和工程团队之间对核心系统形成统一认识
GV.SC（Supply Chain Risk Management category）——要么完全没有供应商风险项目，要么虽有书面项目，却未将其真正用于采购准入决策
ID.AM-08（Systems, hardware, software, services, and data are managed throughout their life cycles）——资产清单实际上只是「SaaS 供应商提供的列表」加上「凭记忆补充的内容」
ID.IM-04（Incident response plans are exercised）——计划确实存在，但上一次测试已是三年前
PR.AA-05（Access permissions and authorizations are managed, incorporating the principles of least privilege）——策略中规定每季度进行访问审查，但实践中并未执行
PR.DS-01（The confidentiality, integrity, and availability of data-at-rest are protected）——静态加密「有」，但密钥管理方式仍是「问 AWS」
DE.AE-08（Incidents are declared when adverse events meet defined criteria）——实际上并未定义相关标准，仍然依靠「看到时自然就知道了」
RS.CO-02（Internal and external stakeholders are notified of incidents）——事件通知矩阵只存在于某个人的脑海里
RC.RP-01（Recovery plan is executed）——计划有文档记录，但从未经过测试

Output Format

输出格式

markdown

undefined

markdown

undefined

NIST CSF 2.0 Posture Assessment

NIST CSF 2.0 态势评估

Organization: [name]

组织：[名称]

Scope: [what's in / out]

范围：[纳入/排除的内容]

Date: [date]

日期：[日期]

Assessor: [name]

评估人：[姓名]

Executive summary

执行摘要

[2-3 paragraphs in plain English — overall posture, top 3 risks, top 3 wins, recommended 90-day priorities]

[用通俗语言写 2-3 段——整体态势、前三大风险、前三大成果、建议的 90 天优先事项]

Profile

Tier summary across functions

各功能的层级汇总

Function	Current tier	Target tier
GV	2	3
ID	2	3
PR	3	3
DE	2	3
RS	3	3
RC	1	2

功能	当前层级	目标层级
GV	2	3
ID	2	3
PR	3	3
DE	2	3
RS	3	3
RC	1	2

Per-Subcategory detail

子类别明细

Subcategory	Current state	Evidence	Tier	Target	Gap	Owner	Timeline

Subcategory	当前状态	证据	层级	目标	差距	负责人	时间

Prioritized roadmap

优先排序路线图

Next 30 days

未来 30 天

[Item, owner, success metric]

[事项、负责人、成功指标]

Next 90 days

未来 90 天

[Item, owner, success metric]

[事项、负责人、成功指标]

Next 12 months

未来 12 个月

[Item, owner, success metric]

[事项、负责人、成功指标]

Cross-references

交叉引用

[Links to evidence — audit reports, IR plans, IAM reports, etc.]

undefined

[证据链接——审计报告、IR 计划、IAM 报告等]

undefined

Translating to board language

转换为董事会语言

Boards don't want Subcategory IDs. They want answers to three questions:

Where are we exposed? (Top 3-5 material risks)
What are we doing about it? (Specific investments, named owners, dates)
How will we know we're better? (Quantitative metrics, target dates)

Use the CSF assessment as the backing detail. The board view is a one-page heatmap and three slides of priorities. The assessment goes in the appendix.

董事会不需要 Subcategory 编号。他们需要以下三个问题的答案：

我们的风险敞口在哪里？（最重要的 3-5 项风险）
我们正在采取什么措施？（具体投入、明确负责人和时间安排）
我们如何知道自己有所改善？（量化指标和目标日期）

将 CSF 评估作为支撑细节。面向董事会的视图应是一页热力图和三页重点事项幻灯片，完整评估放入附录。

Boundaries

边界

This skill produces governance artifacts and roadmaps — not exploitation
CSF assessments are not audits in the regulatory sense (SOC 2 audit, FedRAMP assessment, ISO 27001 certification audit are all separate processes); CSF mapping informs those but doesn't replace them
For audited environments (PCI, HIPAA, FedRAMP), the auditor's specific framework is authoritative; CSF mapping is a useful complement
Refuse to inflate tier ratings without evidence — Tier 3 means "evidence of documented org-wide processes," not "we hope to do this someday"
Where the assessment surfaces a finding that needs immediate action (active incident, exposed system), hand off to
```
incident-triage
```
or the relevant audit skill

本 skill 生成治理交付物和路线图，不用于漏洞利用
CSF 评估不属于监管意义上的审计（SOC 2 审计、FedRAMP 评估、ISO 27001 认证审计都是独立流程）；CSF 映射可以为这些审计提供信息，但不能取代它们
对于受审计约束的环境（PCI、HIPAA、FedRAMP），应以审计方指定的框架为准；CSF 映射是有价值的补充
没有证据时，不得虚高层级评级——Tier 3 意味着「有证据表明已形成全组织文档化流程」，而不是「希望未来能够做到」
如果评估发现需要立即处理的事项（正在发生的事件、暴露的系统），应移交给
```
incident-triage
```
或相关 audit skill

References

参考资料

NIST Cybersecurity Framework 2.0 (
```
nist.gov/cyberframework
```
)
NIST CSF 2.0 Quick Start Guides
NIST CSF Community Profiles (sector-specific starting points)
NIST SP 800-53 (controls catalog — provides specific controls that map to CSF Subcategories)
ISO 27001:2022 (alternative ISMS framework — frequently mapped against CSF for organizations doing both)
CIS Critical Security Controls v8 (alternative prioritized framework — strong overlap with CSF)
Cybersecurity Maturity Model Certification (CMMC) — for DoD contractors; uses CSF + NIST 800-171
"Cybersecurity Risk Management: Mastering the Fundamentals Using the NIST Cybersecurity Framework" — Cynthia Brumfield

NIST Cybersecurity Framework 2.0（
```
nist.gov/cyberframework
```
）
NIST CSF 2.0 快速入门指南
NIST CSF Community Profiles（特定行业的起点）
NIST SP 800-53（控制目录——提供可映射到 CSF Subcategories 的具体控制项）
ISO 27001:2022（备选 ISMS 框架——同时实施两套框架的组织经常将其与 CSF 映射）
CIS Critical Security Controls v8（备选的优先级控制框架——与 CSF 高度重叠）
Cybersecurity Maturity Model Certification（CMMC）——适用于 DoD 承包商；采用 CSF + NIST 800-171
《Cybersecurity Risk Management: Mastering the Fundamentals Using the NIST Cybersecurity Framework》（《网络安全风险管理：掌握 NIST Cybersecurity Framework 基础》）——Cynthia Brumfield