NIST CSF and Kudo
How Kudo, through its ISMS, relates to NIST CSF: domain mapping, controls and compliance objectives explained step by step.
The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary framework developed by the National Institute of Standards and Technology to manage and reduce cybersecurity risk in organizations of any size and sector. Version 2.0 (2024) introduces the GOVERN function as the central axis of governance. Kudo maps its functions and subcategories to the framework and the ISMS policies.
NIST CSF 2.0 Structure
6 Functions
GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER — the complete risk management cycle.
106 Subcategories
Distributed across 22 categories within the 6 functions of the CSF framework.
NIST CSF 2.0 Functions and Categories
| Function | Category | Subcategories |
|---|---|---|
| GV — GOVERN | GV.OC — Organizational Context | 5 |
| GV — GOVERN | GV.RM — Risk Management Strategy | 7 |
| GV — GOVERN | GV.RR — Roles, Responsibilities, and Authorities | 4 |
| GV — GOVERN | GV.PO — Policy | 2 |
| GV — GOVERN | GV.OV — Oversight | 3 |
| GV — GOVERN | GV.SC — Cybersecurity Supply Chain Risk Management | 9 |
| ID — IDENTIFY | ID.AM — Asset Management | 8 |
| ID — IDENTIFY | ID.RA — Risk Assessment | 6 |
| ID — IDENTIFY | ID.IM — Improvement | 4 |
| PR — PROTECT | PR.AA — Identity Management, Authentication, and Access Control | 6 |
| PR — PROTECT | PR.AT — Awareness and Training | 2 |
| PR — PROTECT | PR.DS — Data Security | 10 |
| PR — PROTECT | PR.PS — Platform Security | 4 |
| DE — DETECT | DE.CM — Continuous Monitoring | 9 |
| DE — DETECT | DE.AE — Adverse Event Analysis | 8 |
| RS — RESPOND | RS.MA — Incident Management | 5 |
| RS — RESPOND | RS.AN — Incident Analysis | 3 |
| RS — RESPOND | RS.CO — Incident Response Reporting and Communication | 3 |
| RS — RESPOND | RS.MI — Incident Mitigation | 2 |
| RC — RECOVER | RC.RP — Incident Recovery Plan Execution | 4 |
| RC — RECOVER | RC.CO — Incident Recovery Communication | 2 |
| Total | 106 |