The NIST Cybersecurity Framework 2.0 describes outcomes, not controls. This index links a guide for each outcome, with what good looks like, how to implement it and the evidence to collect. CSF is voluntary and there is no CSF certification.
Key takeaways
- 106 guides, one for each entry in the source.
- CSF is guidance, so never claim to be "NIST compliant".
- For a quick look at your own dependencies, use the free scan at gold.safeguard.sh/scan.
All guides
- NIST CSF 2.0 DE.AE-02: Analyze Potentially Adverse Events
- NIST CSF 2.0 DE.AE-03: Correlate Information From Many Sources
- NIST CSF 2.0 DE.AE-04: Understand Event Impact and Scope
- NIST CSF 2.0 DE.AE-06: Share Event Information With Responders
- NIST CSF 2.0 DE.AE-07: Add Threat Intel and Context to Analysis
- NIST CSF 2.0 DE.AE-08: Declare Incidents Against Criteria
- NIST CSF 2.0 DE.CM-01: Monitor Networks and Services
- NIST CSF 2.0 DE.CM-02: Monitor the Physical Environment
- NIST CSF 2.0 DE.CM-03: Monitor Personnel Activity
- NIST CSF 2.0 DE.CM-06: Monitor External Service Providers
- NIST CSF 2.0 DE.CM-09: Monitor Hardware, Software and Runtime
- NIST CSF 2.0 GV.OC-01: Mission Informs Cyber Risk
- NIST CSF 2.0 GV.OC-02: Know Stakeholder Expectations
- NIST CSF 2.0 GV.OC-03: Track Legal and Contract Duties
- NIST CSF 2.0 GV.OC-04: Know Your Critical Services
- NIST CSF 2.0 GV.OC-05: Map What You Depend On
- NIST CSF 2.0 GV.OV-01: Review Strategy Outcomes
- NIST CSF 2.0 GV.OV-02: Adjust Strategy to Fit
- NIST CSF 2.0 GV.OV-03: Measure Risk Performance
- NIST CSF 2.0 GV.PO-01: Establish Risk Policy
- NIST CSF 2.0 GV.PO-02: Keep Risk Policy Current
- NIST CSF 2.0 GV.RM-01: Set Risk Objectives
- NIST CSF 2.0 GV.RM-02: Risk Appetite and Tolerance
- NIST CSF 2.0 GV.RM-03: Join Enterprise Risk Management
- NIST CSF 2.0 GV.RM-04: Set Risk Response Direction
- NIST CSF 2.0 GV.RM-05: Open Lines for Cyber Risk
- NIST CSF 2.0 GV.RM-06: Use One Method to Score Risk
- NIST CSF 2.0 GV.RM-07: Count Strategic Opportunities
- NIST CSF 2.0 GV.RR-01: Leaders Own Cyber Risk
- NIST CSF 2.0 GV.RR-02: Define Cyber Roles
- NIST CSF 2.0 GV.RR-03: Fund Cyber Risk Work
- NIST CSF 2.0 GV.RR-04: Build Security Into HR
- NIST CSF 2.0 GV.SC-01: Build a Supply Chain Risk Program
- NIST CSF 2.0 GV.SC-02: Assign Supply Chain Risk Roles
- NIST CSF 2.0 GV.SC-03: Integrate Supply Chain Risk
- NIST CSF 2.0 GV.SC-04: Know and Rank Your Suppliers
- NIST CSF 2.0 GV.SC-05: Put Security Terms in Contracts
- NIST CSF 2.0 GV.SC-06: Vet Suppliers Before You Sign
- NIST CSF 2.0 GV.SC-07: Supplier Risk Across the Relationship
- NIST CSF 2.0 GV.SC-08: Suppliers in Incident Response
- NIST CSF 2.0 GV.SC-09: Supply Chain Security in Your Risk Program
- NIST CSF 2.0 GV.SC-10: Plan for the End of a Supplier Deal
- NIST CSF 2.0 ID.AM-01: Keep a Hardware Inventory
- NIST CSF 2.0 ID.AM-02: Inventory Software, Services and Systems
- NIST CSF 2.0 ID.AM-03: Map Authorized Network Flows
- NIST CSF 2.0 ID.AM-04: Inventory Supplier Services
- NIST CSF 2.0 ID.AM-05: Prioritize Assets by Criticality
- NIST CSF 2.0 ID.AM-07: Inventory Data and Its Metadata
- NIST CSF 2.0 ID.AM-08: Manage Assets Through Their Life Cycle
- NIST CSF 2.0 ID.IM-01: Find Improvements From Evaluations
- NIST CSF 2.0 ID.IM-02: Improve From Tests and Exercises
- NIST CSF 2.0 ID.IM-03: Improve From Daily Operations
- NIST CSF 2.0 ID.IM-04: Keep Incident and Security Plans Current
- NIST CSF 2.0 ID.RA-01: Identify, Validate and Record Vulnerabilities
- NIST CSF 2.0 ID.RA-02: Receive Cyber Threat Intelligence
- NIST CSF 2.0 ID.RA-03: Identify and Record Threats
- NIST CSF 2.0 ID.RA-04: Record Impact and Likelihood
- NIST CSF 2.0 ID.RA-05: Use Risk Inputs to Prioritize
- NIST CSF 2.0 ID.RA-06: Plan and Track Risk Responses
- NIST CSF 2.0 ID.RA-07: Manage Changes and Exceptions
- NIST CSF 2.0 ID.RA-08: Handle Vulnerability Disclosures
- NIST CSF 2.0 ID.RA-09: Assess Authenticity and Integrity
- NIST CSF 2.0 ID.RA-10: Assess Critical Suppliers First
- NIST CSF 2.0 PR.AA-01: Manage Identities and Credentials
- NIST CSF 2.0 PR.AA-02: Proof and Bind Identities
- NIST CSF 2.0 PR.AA-03: Authenticate Users, Services, Hardware
- NIST CSF 2.0 PR.AA-04: Protect Identity Assertions
- NIST CSF 2.0 PR.AA-05: Least Privilege and Access Review
- NIST CSF 2.0 PR.AA-06: Manage Physical Access
- NIST CSF 2.0 PR.AT-01: Awareness and Training for All Personnel
- NIST CSF 2.0 PR.AT-02: Role-Based Security Training
- NIST CSF 2.0 PR.DS-01: Protect Data-at-Rest
- NIST CSF 2.0 PR.DS-02: Protect Data-in-Transit
- NIST CSF 2.0 PR.DS-10: Protecting Data in Use
- NIST CSF 2.0 PR.DS-11: Backups Created, Protected, Tested
- NIST CSF 2.0 PR.IR-01: Protect Networks From Unauthorized Access
- NIST CSF 2.0 PR.IR-02: Protect Assets From Environmental Threats
- NIST CSF 2.0 PR.IR-03: Build Resilience Into Systems
- NIST CSF 2.0 PR.IR-04: Keep Enough Capacity for Availability
- NIST CSF 2.0 PR.PS-01: Configuration Management Practices
- NIST CSF 2.0 PR.PS-02: Maintain and Retire Software by Risk
- NIST CSF 2.0 PR.PS-03: Maintain and Retire Hardware by Risk
- NIST CSF 2.0 PR.PS-04: Generate Logs for Continuous Monitoring
- NIST CSF 2.0 PR.PS-05: Prevent Unauthorized Software
- NIST CSF 2.0 PR.PS-06: Secure Software Development Practices
- NIST CSF 2.0 RC.CO-03: Communicate Recovery Progress
- NIST CSF 2.0 RC.CO-04: Public Updates on Incident Recovery
- NIST CSF 2.0 RC.RP-01: Execute the Recovery Plan
- NIST CSF 2.0 RC.RP-02: Select, Scope and Prioritize Recovery Actions
- NIST CSF 2.0 RC.RP-03: Verify Backup Integrity Before Restoring
- NIST CSF 2.0 RC.RP-04: Set Post Incident Operating Norms
- NIST CSF 2.0 RC.RP-05: Verify Restored Assets and Confirm Normal
- NIST CSF 2.0 RC.RP-06: Declare the End of Incident Recovery
- NIST CSF 2.0 RS.AN-03: Incident Analysis and Root Cause
- NIST CSF 2.0 RS.AN-06: Record Investigation Actions
- NIST CSF 2.0 RS.AN-07: Preserve Incident Data
- NIST CSF 2.0 RS.AN-08: Estimate Incident Magnitude
- NIST CSF 2.0 RS.CO-02: Notify Stakeholders of Incidents
- NIST CSF 2.0 RS.CO-03: Share Incident Information
- NIST CSF 2.0 RS.MA-01: Execute the Incident Response Plan
- NIST CSF 2.0 RS.MA-02: Triage and Validate Incident Reports
- NIST CSF 2.0 RS.MA-03: Categorize and Prioritize Incidents
- NIST CSF 2.0 RS.MA-04: Escalate Incidents When Needed
- NIST CSF 2.0 RS.MA-05: Criteria for Starting Recovery
- NIST CSF 2.0 RS.MI-01: Contain Incidents
- NIST CSF 2.0 RS.MI-02: Eradicate Incidents
Frequently asked questions
Are these official documents?
No. They are explanatory guides written by Safeguard from the public source. Check the original for the authoritative text.
Who are they for?
Developers, security engineers and compliance leads who need to understand and show each item.
Last reviewed: 19 October 2026.
