Set direction
Establish context, strategy, roles, policy, oversight and cybersecurity supply-chain risk management.
GV.OC · GV.RM · GV.RR · GV.PO · GV.OV · GV.SCNIST Cybersecurity Framework 2.0
Turn cybersecurity outcomes into owned work.
Connect governance, assets, risks, safeguards, suppliers, vulnerabilities, monitoring, incidents and recovery in one operational record built around the outcomes your organisation prioritises.
The NIST CSF is flexible, outcome-based guidance—not a prescriptive control checklist or a product certification. Scope, priorities and target outcomes remain organisation-specific.
CSF 2.0 CoreGovern at the centre
GOVERNDirect every Function
Identify
Protect
Detect
Respond
Recover
February 2024CSF 2.0 publication date
6 FunctionsGovern, Identify, Protect, Detect, Respond, Recover
4 TiersPartial through Adaptive risk-management characteristics
Any organisationdesigned for any size, sector or maturity
The CSF 2.0 Core
One risk language across the whole organisation.
The Core organises high-level cybersecurity outcomes into six Functions. They are intended to operate together, not as a linear project or a one-time checklist.
Understand exposure
Know assets and risks and use lessons from evaluations, tests and operations to improve.
ID.AM · ID.RA · ID.IMApply safeguards
Manage access, awareness, data security, platform security and infrastructure resilience.
PR.AA · PR.AT · PR.DS · PR.PS · PR.IRFind adverse events
Continuously monitor relevant environments and analyse events for signs of cybersecurity incidents.
DE.CM · DE.AEContain and coordinate
Manage, analyse, communicate and mitigate detected cybersecurity incidents.
RS.MA · RS.AN · RS.CO · RS.MIRestore capability
Execute recovery activities and communicate restoration status with relevant stakeholders.
RC.RP · RC.COHow STORM supports the outcomes
From framework language to connected evidence.
STORM's documented framework catalogue includes NIST CSF and connects assessment work with the operational registers, owners, evidence and actions that support cybersecurity risk decisions.
Direction, policy & oversight
Connect roles, controlled policies, measurable objectives, supplier oversight, risks, incidents and decisions through management-review records.
Policies · ownership · reviewAssets, dependencies & risk
Model services, data, systems, people, locations and suppliers, then assess impact, threats, vulnerabilities and risk with accountable owners.
Cartography · risk assessmentControls & treatment
Select technical, organisational and physical countermeasures, assign mitigation actions and keep supporting policies and procedures controlled.
Risk treatment · documentationExposure & monitoring
Bring threat intelligence, vulnerability findings and supported Microsoft security-configuration checks into dashboards and tracked remediation workflows.
Threat intel · vulnerabilities · monitoringIncident lifecycle
Record affected services and assets, ownership, impact, threats, root cause, reporting context, resolution dates and corrective actions.
Incidents · analysis · actionContinuity & improvement
Maintain BCP and DRP documentation, BIA and recovery targets, and connect incidents and findings to corrective and management actions.
BCP · DRP · lessons learned
Assess the current state
See outcomes, gaps and action—not just a score.
Use NIST assessments within STORM to record implementation status, evidence and gaps. Category reporting and period comparisons help teams understand where the current posture differs from the outcomes they prioritise.
- Framework and category-level assessment views
- Implemented, partially implemented, planned and not implemented status
- Gap action plans and review schedules
Build the risk context
Ground the Profile in real services and dependencies.
Cartography and the risk register connect outcomes to the technology, business services, suppliers and risk decisions they affect, giving owners a shared context for prioritisation.
- Asset, service and supplier relationships
- Likelihood, impact, risk level and treatment strategy
- Owners, reviews, mitigation plans and attachments
Connect Detect to action
Bring changing exposure into the governance loop.
Threat intelligence, technical vulnerability management and supported configuration monitoring give teams operational inputs they can relate to assets, controls, assessments and remediation.
- Public CVE and breach intelligence context
- Nessus and Microsoft Defender vulnerability inputs
- Microsoft Graph-based security configuration checks
Respond, recover, improve
Keep decisions traceable after detection.
Incident records link affected services and assets with responsibility, analysis and corrective action. Treatment and continuity records retain the follow-through needed for recovery and improvement.
- Incident ownership, impact and root-cause records
- Target dates and corrective or preventive actions
- Risk treatment, BCP and DRP documentation
Use the CSF as intendedCurrent & Target Profiles Implementation Tiers Informative References
Profile the destination. Choose the right rigor.
CSF 2.0 gives organisations several connected tools for describing priorities and communicating cybersecurity risk. STORM can hold the related evidence and actions without turning the Framework into a generic checklist.
Describe today and the intended outcome.
Organizational Profiles help compare current and target cybersecurity posture, expose gaps and prioritise an action plan that reflects business needs.
Outcomes · priorities · gapsCharacterise how risk is managed.
Tiers range from Partial to Adaptive and inform Profiles by describing cybersecurity risk governance and management characteristics. They are not maturity scores to maximise blindly.
Partial · Risk Informed · Repeatable · AdaptiveLink outcomes to deeper guidance.
References connect CSF outcomes to standards, practices and controls that may help achieve them. A mapping is context—not proof that an outcome has been achieved.
Crosswalks · practices · controlsConfirm the NIST CSF version, Core content, selected Profile outcomes and mappings configured for your organisation before relying on an assessment or crosswalk.
An outcome-led workflow01 02 03 04 05
Move from context to measured improvement.
Use STORM to retain decisions and evidence through a repeatable cybersecurity risk-management cycle.
Scope
Set organisational context, responsibilities, risk appetite and relevant services.
Govern · business contextProfile
Record current outcomes and select target outcomes based on risk and priorities.
Current · targetPrioritise
Evaluate gaps, risks and dependencies and decide which actions matter first.
Gap · risk · ownerOperate
Implement safeguards, monitor exposure and manage incidents and recovery.
Protect · detect · respond · recoverImprove
Review results, reassess outcomes and track decisions to accountable action.
Evidence · review · improvementPractical questions
Keep guidance, implementation and assurance distinct.
The CSF describes outcomes and a common language. Each organisation decides how to apply it and what evidence demonstrates progress.
Does STORM include built-in NIST CSF support?
Yes. STORM's documented framework catalogue and Compliance Assessment module include NIST CSF support, status tracking, category reporting, gaps, reassessment schedules and reports. Confirm the configured CSF version and mappings for your organisation during implementation.
Is NIST CSF 2.0 a prescriptive control checklist?
No. NIST describes the CSF Core as a taxonomy of high-level cybersecurity outcomes and does not prescribe how those outcomes must be achieved. STORM can organise assessments, controls, evidence, risks and actions around those outcomes.
Can STORM create Current and Target Profiles?
STORM can support the underlying assessment, status, gap, ownership, evidence and action records used to manage a current-to-target journey. The organisation still needs to select and approve the outcomes that form its Current and Target Profiles.
Are the four Tiers maturity levels?
NIST uses Tiers to characterise the rigor of cybersecurity risk governance and management, from Partial to Adaptive. They inform Profiles and should not be treated as universal scores or automatic certification levels.
Does using STORM mean an organisation is NIST CSF certified?
No. The CSF is voluntary risk-management guidance, and NIST does not provide a CSF certification programme for organisations or products. STORM supports implementation records and evidence but cannot certify outcome achievement.
Can one control support multiple frameworks?
STORM documents cross-framework control mapping and traceability between controls, policies, checks, attestations and evidence. Mappings can reduce duplication, but they must be reviewed for scope and do not automatically prove that every mapped requirement or CSF outcome is satisfied.
Bring your target outcomes
Book a STORM demo See NIST CSF through the risks your organisation must actually manage.
Use a focused walkthrough to test STORM against your organisational context, Profiles, risks, suppliers, safeguards, monitoring sources, incidents, recovery workflow and evidence needs.