New version: NIST Cybersecurity Framework (CSF) 2.0 (v1.6.0-c808a0b30f) – 0 new, 106 changed, 0 removed
- Document: NIST Cybersecurity Framework (CSF) 2.0 (https://raw.githubusercontent.com/usnistgov/oscal-content/v1.6.0/nist.gov/CSF/v2.0/json/NIST_CSF_v2.0_catalog.json)
- Version: v1.6.0-c808a0b30f
- Project: NIST
- Import: #22593, 27.10.2026 22:17, nist
The new version was compared with the existing issues. Changes are only applied once approved in the administration (Importer › Proposed changes).
Taken over directly (additional fields, HTML of an unchanged text): 120 issues.
Review: 0 open, 106 applied, 0 rejected.
Changed sections (106)
- GV.OC-01 The organizational mission is understood and informs cybersecurity risk management – text [applied]
NIST-CSF-v2.0_GV.OC-01 - GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood a… – text [applied]
NIST-CSF-v2.0_GV.OC-02 - GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood… – text [applied]
NIST-CSF-v2.0_GV.OC-03 - GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and comm… – text [applied]
NIST-CSF-v2.0_GV.OC-04 - GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated – text [applied]
NIST-CSF-v2.0_GV.OC-05 - GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction – text [applied]
NIST-CSF-v2.0_GV.OV-01 - GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks – text [applied]
NIST-CSF-v2.0_GV.OV-02 - GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed – text [applied]
NIST-CSF-v2.0_GV.OV-03 - GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is commun… – text [applied]
NIST-CSF-v2.0_GV.PO-01 - GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, techno… – text [applied]
NIST-CSF-v2.0_GV.PO-02 - GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders – text [applied]
NIST-CSF-v2.0_GV.RM-01 - GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained – text [applied]
NIST-CSF-v2.0_GV.RM-02 - GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes – text [applied]
NIST-CSF-v2.0_GV.RM-03 - GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated – text [applied]
NIST-CSF-v2.0_GV.RM-04 - GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parti… – text [applied]
NIST-CSF-v2.0_GV.RM-05 - GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated – text [applied]
NIST-CSF-v2.0_GV.RM-06 - GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions – text [applied]
NIST-CSF-v2.0_GV.RM-07 - GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and conti… – text [applied]
NIST-CSF-v2.0_GV.RR-01 - GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced – text [applied]
NIST-CSF-v2.0_GV.RR-02 - GV.RR-03 Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies – text [applied]
NIST-CSF-v2.0_GV.RR-03 - GV.RR-04 Cybersecurity is included in human resources practices – text [applied]
NIST-CSF-v2.0_GV.RR-04 - GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organiz… – text [applied]
NIST-CSF-v2.0_GV.SC-01 - GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally an… – text [applied]
NIST-CSF-v2.0_GV.SC-02 - GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement… – text [applied]
NIST-CSF-v2.0_GV.SC-03 - GV.SC-04 Suppliers are known and prioritized by criticality – text [applied]
NIST-CSF-v2.0_GV.SC-04 - GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of … – text [applied]
NIST-CSF-v2.0_GV.SC-05 - GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships – text [applied]
NIST-CSF-v2.0_GV.SC-06 - GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, respond… – text [applied]
NIST-CSF-v2.0_GV.SC-07 - GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities – text [applied]
NIST-CSF-v2.0_GV.SC-08 - GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitore… – text [applied]
NIST-CSF-v2.0_GV.SC-09 - GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or servi… – text [applied]
NIST-CSF-v2.0_GV.SC-10 - ID.AM-01 Inventories of hardware managed by the organization are maintained – text [applied]
NIST-CSF-v2.0_ID.AM-01 - ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained – text [applied]
NIST-CSF-v2.0_ID.AM-02 - ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained – text [applied]
NIST-CSF-v2.0_ID.AM-03 - ID.AM-04 Inventories of services provided by suppliers are maintained – text [applied]
NIST-CSF-v2.0_ID.AM-04 - ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission – text [applied]
NIST-CSF-v2.0_ID.AM-05 - ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained – text [applied]
NIST-CSF-v2.0_ID.AM-07 - ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles – text [applied]
NIST-CSF-v2.0_ID.AM-08 - ID.IM-01 Improvements are identified from evaluations – text [applied]
NIST-CSF-v2.0_ID.IM-01 - ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties – text [applied]
NIST-CSF-v2.0_ID.IM-02 - ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities – text [applied]
NIST-CSF-v2.0_ID.IM-03 - ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved – text [applied]
NIST-CSF-v2.0_ID.IM-04 - ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded – text [applied]
NIST-CSF-v2.0_ID.RA-01 - ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources – text [applied]
NIST-CSF-v2.0_ID.RA-02 - ID.RA-03 Internal and external threats to the organization are identified and recorded – text [applied]
NIST-CSF-v2.0_ID.RA-03 - ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded – text [applied]
NIST-CSF-v2.0_ID.RA-04 - ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization – text [applied]
NIST-CSF-v2.0_ID.RA-05 - ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated – text [applied]
NIST-CSF-v2.0_ID.RA-06 - ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked – text [applied]
NIST-CSF-v2.0_ID.RA-07 - ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established – text [applied]
NIST-CSF-v2.0_ID.RA-08 - ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use – text [applied]
NIST-CSF-v2.0_ID.RA-09 - ID.RA-10 Critical suppliers are assessed prior to acquisition – text [applied]
NIST-CSF-v2.0_ID.RA-10 - PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization – text [applied]
NIST-CSF-v2.0_PR.AA-01 - PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions – text [applied]
NIST-CSF-v2.0_PR.AA-02 - PR.AA-03 Users, services, and hardware are authenticated – text [applied]
NIST-CSF-v2.0_PR.AA-03 - PR.AA-04 Identity assertions are protected, conveyed, and verified – text [applied]
NIST-CSF-v2.0_PR.AA-04 - PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principle… – text [applied]
NIST-CSF-v2.0_PR.AA-05 - PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk – text [applied]
NIST-CSF-v2.0_PR.AA-06 - PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity… – text [applied]
NIST-CSF-v2.0_PR.AT-01 - PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant … – text [applied]
NIST-CSF-v2.0_PR.AT-02 - PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected – text [applied]
NIST-CSF-v2.0_PR.DS-01 - PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected – text [applied]
NIST-CSF-v2.0_PR.DS-02 - PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected – text [applied]
NIST-CSF-v2.0_PR.DS-10 - PR.DS-11 Backups of data are created, protected, maintained, and tested – text [applied]
NIST-CSF-v2.0_PR.DS-11 - PR.IR-01 Networks and environments are protected from unauthorized logical access and usage – text [applied]
NIST-CSF-v2.0_PR.IR-01 - PR.IR-02 The organization's technology assets are protected from environmental threats – text [applied]
NIST-CSF-v2.0_PR.IR-02 - PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations – text [applied]
NIST-CSF-v2.0_PR.IR-03 - PR.IR-04 Adequate resource capacity to ensure availability is maintained – text [applied]
NIST-CSF-v2.0_PR.IR-04 - PR.PS-01 Configuration management practices are established and applied – text [applied]
NIST-CSF-v2.0_PR.PS-01 - PR.PS-02 Software is maintained, replaced, and removed commensurate with risk – text [applied]
NIST-CSF-v2.0_PR.PS-02 - PR.PS-03 Hardware is maintained, replaced, and removed commensurate with risk – text [applied]
NIST-CSF-v2.0_PR.PS-03 - PR.PS-04 Log records are generated and made available for continuous monitoring – text [applied]
NIST-CSF-v2.0_PR.PS-04 - PR.PS-05 Installation and execution of unauthorized software are prevented – text [applied]
NIST-CSF-v2.0_PR.PS-05 - PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle – text [applied]
NIST-CSF-v2.0_PR.PS-06 - DE.AE-02 Potentially adverse events are analyzed to better understand associated activities – text [applied]
NIST-CSF-v2.0_DE.AE-02 - DE.AE-03 Information is correlated from multiple sources – text [applied]
NIST-CSF-v2.0_DE.AE-03 - DE.AE-04 The estimated impact and scope of adverse events are understood – text [applied]
NIST-CSF-v2.0_DE.AE-04 - DE.AE-06 Information on adverse events is provided to authorized staff and tools – text [applied]
NIST-CSF-v2.0_DE.AE-06 - DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis – text [applied]
NIST-CSF-v2.0_DE.AE-07 - DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria – text [applied]
NIST-CSF-v2.0_DE.AE-08 - DE.CM-01 Networks and network services are monitored to find potentially adverse events – text [applied]
NIST-CSF-v2.0_DE.CM-01 - DE.CM-02 The physical environment is monitored to find potentially adverse events – text [applied]
NIST-CSF-v2.0_DE.CM-02 - DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events – text [applied]
NIST-CSF-v2.0_DE.CM-03 - DE.CM-06 External service provider activities and services are monitored to find potentially adverse events – text [applied]
NIST-CSF-v2.0_DE.CM-06 - DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events – text [applied]
NIST-CSF-v2.0_DE.CM-09 - RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident – text [applied]
NIST-CSF-v2.0_RS.AN-03 - RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved – text [applied]
NIST-CSF-v2.0_RS.AN-06 - RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved – text [applied]
NIST-CSF-v2.0_RS.AN-07 - RS.AN-08 An incident's magnitude is estimated and validated – text [applied]
NIST-CSF-v2.0_RS.AN-08 - RS.CO-02 Internal and external stakeholders are notified of incidents – text [applied]
NIST-CSF-v2.0_RS.CO-02 - RS.CO-03 Information is shared with designated internal and external stakeholders – text [applied]
NIST-CSF-v2.0_RS.CO-03 - RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared – text [applied]
NIST-CSF-v2.0_RS.MA-01 - RS.MA-02 Incident reports are triaged and validated – text [applied]
NIST-CSF-v2.0_RS.MA-02 - RS.MA-03 Incidents are categorized and prioritized – text [applied]
NIST-CSF-v2.0_RS.MA-03 - RS.MA-04 Incidents are escalated or elevated as needed – text [applied]
NIST-CSF-v2.0_RS.MA-04 - RS.MA-05 The criteria for initiating incident recovery are applied – text [applied]
NIST-CSF-v2.0_RS.MA-05 - RS.MI-01 Incidents are contained – text [applied]
NIST-CSF-v2.0_RS.MI-01 - RS.MI-02 Incidents are eradicated – text [applied]
NIST-CSF-v2.0_RS.MI-02 - RC.CO-03 Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders – text [applied]
NIST-CSF-v2.0_RC.CO-03 - RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging – text [applied]
NIST-CSF-v2.0_RC.CO-04 - RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process – text [applied]
NIST-CSF-v2.0_RC.RP-01 - RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed – text [applied]
NIST-CSF-v2.0_RC.RP-02 - RC.RP-03 The integrity of backups and other restoration assets is verified before using them for restoration – text [applied]
NIST-CSF-v2.0_RC.RP-03 - RC.RP-04 Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms – text [applied]
NIST-CSF-v2.0_RC.RP-04 - RC.RP-05 The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed – text [applied]
NIST-CSF-v2.0_RC.RP-05 - RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed – text [applied]
NIST-CSF-v2.0_RC.RP-06