NIST CSF with ISMS
Overview of NIST CSF mapped to the Kudo ISMS: domains, scope and equivalences between both cybersecurity frameworks.
NIST CSF 2.0 functions and categories organized by their mapping to the Kudo domains and mapped to the ISMS policies.
GV — GOVERN
🛡️ Information Security Policy
GV.OC, GV.RR — Organizational context, roles, responsibilities and authorities in cybersecurity.
⚠️ Risk Management Policy
GV.RM — The organization's cybersecurity risk strategy and tolerance.
📄 Documents and Records Policy
GV.PO — Cybersecurity policies established, communicated and enforced.
⚖️ Compliance Management Policy
GV.OV — Oversight of the cybersecurity risk management strategy and results.
🤝 Vendor Management Policy
GV.SC — Cybersecurity supply chain risk management.
ID — IDENTIFY
📦 Asset Management Policy
ID.AM — Inventory and management of the organization's hardware, software and data assets.
⚠️ Risk Management Policy
ID.RA — Cybersecurity risk assessment of assets, threats and vulnerabilities.
⚖️ Compliance Management Policy
ID.IM — Continuous improvement through lessons learned from cybersecurity activities.
PR — PROTECT
🔑 Access Management Policy
PR.AA — Identity management, authentication and access control for assets and systems.
🎓 Awareness Management Policy
PR.AT — Cybersecurity awareness and training for the organization's staff.
🛡️ Privacy Policy
PR.DS — Security and protection of data at rest, in transit and in use.
🔒 Hardening Policy
PR.PS — Platform security: secure configuration of hardware and software.
DE — DETECT
📊 Logging and Monitoring Policy
DE.CM — Continuous monitoring of assets, networks and people to detect adverse events.
🚨 Incident Management Policy
DE.AE — Analysis of adverse events to determine their impact and characterize incidents.
RS — RESPOND
🚨 Incident Management Policy
RS.MA, RS.AN, RS.MI — Management, analysis and mitigation of cybersecurity incidents.
📢 Communication Procedure and Plan
RS.CO — Reporting and communication of incidents with internal and external parties.
🚨 Crisis Management Policy
RS.CO — Coordination of the response to high-impact incidents.
RC — RECOVER
📋 Business Continuity Plan
RC.RP — Execution of the recovery plan to restore affected systems and operations.
🛟 Business Continuity Policy
RC.RP — Restoration of capabilities and services impacted by cybersecurity incidents.
🚨 Crisis Management Policy
RC.CO — Communication of recovery activities with internal and external parties.