NIST CSF Controls with ISMS

Control-by-control mapping between NIST CSF and the Kudo ISMS, with the complete structure ready for audits and evidence.

Table of the 106 NIST CSF 2.0 subcategories organized by function and category, mapped to the Kudo ISMS policies.

GV — GOVERN

GV.OC — Organizational Context

Code	ISMS Policy
GV.OC-01	Information Security Policy
GV.OC-02	Information Security Policy
GV.OC-03	Compliance Management Policy
GV.OC-04	Risk Management Policy
GV.OC-05	Risk Management Policy

GV.RM — Risk Management Strategy

Code	ISMS Policy
GV.RM-01	Risk Management Policy
GV.RM-02	Risk Management Policy
GV.RM-03	Risk Management Policy
GV.RM-04	Risk Management Policy
GV.RM-05	Risk Management Policy
GV.RM-06	Risk Management Policy
GV.RM-07	Risk Management Policy

GV.RR — Roles, Responsibilities, and Authorities

Code	ISMS Policy
GV.RR-01	Information Security Policy
GV.RR-02	Information Security Policy
GV.RR-03	Information Security Policy
GV.RR-04	Documents and Records Policy

GV.PO — Policy

Code	ISMS Policy
GV.PO-01	Documents and Records Policy
GV.PO-02	Documents and Records Policy

GV.OV — Oversight

Code	ISMS Policy
GV.OV-01	Compliance Management Policy
GV.OV-02	Compliance Management Policy
GV.OV-03	Compliance Management Policy

GV.SC — Cybersecurity Supply Chain Risk Management

Code	ISMS Policy
GV.SC-01	Vendor Management Policy
GV.SC-02	Vendor Management Policy
GV.SC-03	Vendor Management Policy
GV.SC-04	Vendor Management Policy
GV.SC-05	Vendor Management Policy
GV.SC-06	Vendor Management Policy
GV.SC-07	Vendor Management Policy
GV.SC-08	Vendor Management Policy
GV.SC-09	Vendor Management Policy

ID — IDENTIFY

ID.AM — Asset Management

Code	ISMS Policy
ID.AM-01	Asset Management Policy
ID.AM-02	Asset Management Policy
ID.AM-03	Asset Management Policy
ID.AM-04	Asset Management Policy
ID.AM-05	Asset Management Policy
ID.AM-06	Asset Management Policy
ID.AM-07	Asset Management Policy
ID.AM-08	Documents and Records Policy

ID.RA — Risk Assessment

Code	ISMS Policy
ID.RA-01	Risk Management Policy
ID.RA-02	Risk Management Policy
ID.RA-03	Risk Management Policy
ID.RA-04	Risk Management Policy
ID.RA-05	Risk Management Policy
ID.RA-06	Risk Management Policy

ID.IM — Improvement

Code	ISMS Policy
ID.IM-01	Compliance Management Policy
ID.IM-02	Compliance Management Policy
ID.IM-03	Compliance Management Policy
ID.IM-04	Incident Management Policy

PR — PROTECT

PR.AA — Identity Management, Authentication, and Access Control

Code	ISMS Policy
PR.AA-01	Access Management Policy
PR.AA-02	Access Management Policy
PR.AA-03	Access Management Policy
PR.AA-04	Access Management Policy
PR.AA-05	Access Management Policy
PR.AA-06	Access Management Policy

PR.AT — Awareness and Training

Code	ISMS Policy
PR.AT-01	Awareness Management Policy
PR.AT-02	Human Resources Security Policy

PR.DS — Data Security

Code	ISMS Policy
PR.DS-01	Privacy Policy
PR.DS-02	Communications Security Policy
PR.DS-03	Asset Management Policy
PR.DS-04	IT Security Policy
PR.DS-05	Privacy Policy
PR.DS-06	Secure Development Policy
PR.DS-07	Privacy Policy
PR.DS-08	Privacy Policy
PR.DS-09	Privacy Policy
PR.DS-10	Privacy Policy

PR.PS — Platform Security

Code	ISMS Policy
PR.PS-01	Hardening Policy
PR.PS-02	Hardening Policy
PR.PS-03	Change and Configuration Management Policy
PR.PS-04	Logging and Monitoring Policy

DE — DETECT

DE.CM — Continuous Monitoring

Code	ISMS Policy
DE.CM-01	Logging and Monitoring Policy
DE.CM-02	Logging and Monitoring Policy
DE.CM-03	Logging and Monitoring Policy
DE.CM-04	Hardening Policy
DE.CM-05	Logging and Monitoring Policy
DE.CM-06	Vendor Management Policy
DE.CM-07	Logging and Monitoring Policy
DE.CM-08	Hardening Policy
DE.CM-09	Logging and Monitoring Policy

DE.AE — Adverse Event Analysis

Code	ISMS Policy
DE.AE-01	Incident Management Policy
DE.AE-02	Incident Management Policy
DE.AE-03	Logging and Monitoring Policy
DE.AE-04	Incident Management Policy
DE.AE-05	Incident Management Policy
DE.AE-06	Incident Management Policy
DE.AE-07	Incident Management Policy
DE.AE-08	Incident Management Policy

RS — RESPOND

RS.MA — Incident Management

Code	ISMS Policy
RS.MA-01	Incident Management Policy
RS.MA-02	Incident Management Policy
RS.MA-03	Incident Management Policy
RS.MA-04	Incident Management Policy
RS.MA-05	Incident Management Policy

RS.AN — Incident Analysis

Code	ISMS Policy
RS.AN-01	Incident Management Policy
RS.AN-02	Incident Management Policy
RS.AN-03	Incident Management Policy

RS.CO — Incident Response Reporting and Communication

Code	ISMS Policy
RS.CO-01	Communication Procedure and Plan
RS.CO-02	Communication Procedure and Plan
RS.CO-03	Crisis Management Policy

RS.MI — Incident Mitigation

Code	ISMS Policy
RS.MI-01	Incident Management Policy
RS.MI-02	Incident Management Policy

RC — RECOVER

RC.RP — Incident Recovery Plan Execution

Code	ISMS Policy
RC.RP-01	Business Continuity Plan
RC.RP-02	Business Continuity Policy
RC.RP-03	Backup and Recovery Policies
RC.RP-04	Backup and Recovery Policies

RC.CO — Incident Recovery Communication

Code	ISMS Policy
RC.CO-01	Crisis Management Policy
RC.CO-02	Communication Procedure and Plan

NIST CSF Controls with ISMS

GV — GOVERNCopy Anchor Link

GV.OC — Organizational ContextCopy Anchor Link

GV.RM — Risk Management StrategyCopy Anchor Link

GV.RR — Roles, Responsibilities, and AuthoritiesCopy Anchor Link

GV.PO — PolicyCopy Anchor Link

GV.OV — OversightCopy Anchor Link

GV.SC — Cybersecurity Supply Chain Risk ManagementCopy Anchor Link

ID — IDENTIFYCopy Anchor Link

ID.AM — Asset ManagementCopy Anchor Link

ID.RA — Risk AssessmentCopy Anchor Link

ID.IM — ImprovementCopy Anchor Link

PR — PROTECTCopy Anchor Link

PR.AA — Identity Management, Authentication, and Access ControlCopy Anchor Link

PR.AT — Awareness and TrainingCopy Anchor Link

PR.DS — Data SecurityCopy Anchor Link

PR.PS — Platform SecurityCopy Anchor Link

DE — DETECTCopy Anchor Link

DE.CM — Continuous MonitoringCopy Anchor Link

DE.AE — Adverse Event AnalysisCopy Anchor Link

RS — RESPONDCopy Anchor Link

RS.MA — Incident ManagementCopy Anchor Link

RS.AN — Incident AnalysisCopy Anchor Link

RS.CO — Incident Response Reporting and CommunicationCopy Anchor Link

RS.MI — Incident MitigationCopy Anchor Link

RC — RECOVERCopy Anchor Link

RC.RP — Incident Recovery Plan ExecutionCopy Anchor Link

RC.CO — Incident Recovery CommunicationCopy Anchor Link

On this page