Toolkit
NIST CSF 2.0 readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any organisation, of any size, sector or country, that wants a shared vocabulary to describe its cybersecurity posture and communicate it to leadership.
Scope
- Not limited to critical infrastructure — explicitly intended for organisations of any kind
- Six functions: Govern, Identify, Protect, Detect, Respond, Recover
- Voluntary and outcome-based — describes what to achieve, not how; no certification exists
Key requirements
- Scope the profile: which business units, systems or services it covers
- Gather context: mission, risk appetite, legal/contractual requirements and relevant threats
- Build a current profile by assessing each relevant subcategory with evidence
- Build a target profile describing the desired outcomes, informed by risk and requirements
- Analyse the gap between current and target, and prioritise by risk, cost and dependency
- Implement an action plan using a control catalogue (SP 800-53, ISO/IEC 27001 Annex A, CIS Controls) mapped to the outcomes
- Report progress to leadership on a regular cycle
Evidence to gather
- Asset inventory and risk register
- Policies and governance charters
- Supplier and third-party risk records
- Access reviews and training records
- Monitoring and detection coverage
- Incident response plans and exercise reports
- Recovery test results
Common gaps
- Treating subcategories as controls rather than outcomes — controls come from a catalogue mapped to them
- Scoring everything toward Tier 4 when the framework doesn't expect every organisation to
- Skipping the target profile, which turns gap analysis into a generic to-do list
- One-off assessments instead of a profile that's revisited as risk changes
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full NIST CSF 2.0 guide, the official text, or a qualified adviser.