Openlane
NIST CSF logo

NIST CSF compliance

Organize your program around the six CSF 2.0 Functions, from Govern to Recover, with each outcome backed by a control, an owner, and current evidence.

No credit card. 30-day free trial.

Six Functions, one connected program

Every Category outcome maps to a control your team operates, with the same control serving ISO 27001, SOC 2, or NIST 800-53 underneath it.

Govern

Record your risk strategy, roles, and policies as controls with owners, so the Govern Function describes decisions your leadership made rather than text copied from the framework.

  • Risk strategy and roles on record (GV.RM, GV.RR)
  • Policies linked to the controls they direct (GV.PO)
  • Supplier risk in the vendor registry (GV.SC)

Identify

Inventory the systems, data, and suppliers in scope, assign each a risk owner, and score the risks in one register.

  • Asset and platform inventory (ID.AM)
  • Risk register scored by impact and likelihood (ID.RA)

Protect

Tie identity, access, training, and data security safeguards to controls with evidence, and run the recurring access reviews and training campaigns that keep them current.

  • Access and identity controls with evidence (PR.AA)
  • Training campaigns with completion tracking (PR.AT)

Detect

Bring scan results and findings from the tools you already run into the same record as the controls that require them, dated and kept.

  • Scan history kept per run (DE.CM)
  • Findings with owners and remediation dates

Respond

Keep incident procedures, communications, and remediation on record, with each response task assigned and tracked to closure.

  • Incident response procedures as policies (RS.MA)
  • Remediation tracked to closure (RS.MI)

Recover

Document recovery plans, test them on a schedule, and keep the evidence that they were exercised where an assessor can find it.

  • Recovery plans linked to their controls (RC.RP)
  • Test evidence with renewal dates
Part of Compliance

Organize the program around the six Functions

Map each CSF 2.0 outcome to an owner, a control, and current evidence.

Request a Framework

No credit card. 30-day free trial.

Frequently asked questions

NIST CSF basics

What is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework (CSF) is voluntary guidance from the National Institute of Standards and Technology for managing and reducing cybersecurity risk. The current version, CSF 2.0, was released in February 2024. It gives organizations a common language for describing outcomes and a structure for prioritizing them, built on existing standards and practices.

Who should use the NIST CSF?

CSF 2.0 is written for organizations of every size and sector, not only critical infrastructure. It suits organizations that want a risk-based structure for their program that can sit above the specific controls they implement from ISO 27001, SOC 2, or NIST 800-53.

What are the six Functions?

CSF 2.0 organizes outcomes into six Functions. Govern sets the strategy, roles, and policies for managing cybersecurity risk. Identify covers understanding your assets and risks. Protect covers the safeguards that manage those risks. Detect covers finding and analyzing possible attacks. Respond covers acting on a detected incident. Recover covers restoring assets and operations afterward.

What are Implementation Tiers?

Tiers describe how rigorously an organization governs and manages cybersecurity risk. Tier 1 is Partial, where practices are ad hoc. Tier 2 is Risk Informed, where practices are approved by management but not organization-wide. Tier 3 is Repeatable, where practices are formal policy. Tier 4 is Adaptive, where the organization adapts practices based on lessons learned and predictive indicators.

Framework components

What are Categories and Subcategories?

CSF 2.0 divides the six Functions into 22 Categories and 106 Subcategories. A Category groups related outcomes, such as Asset Management or Incident Management. A Subcategory is a specific outcome, such as maintaining inventories of the hardware the organization manages.

What is an Organizational Profile?

An Organizational Profile describes your current or target cybersecurity posture in terms of the CSF outcomes. The Current Profile records what you achieve today; the Target Profile records what you intend to achieve given your objectives, risk appetite, and resources. Comparing the two shows the gaps to prioritize.

How does NIST CSF relate to other frameworks?

The CSF complements other frameworks rather than replacing them. Its Informative References map each Subcategory to specific controls in standards such as ISO 27001, NIST 800-53, and the CIS Controls, so you can use the CSF as the organizing structure while implementing controls from the standards you already follow.

What changed in NIST CSF 2.0?

CSF 2.0 added Govern as a sixth Function, widened the audience from critical infrastructure to all organizations, expanded supply chain risk management, and added implementation examples and quick-start guides. Categories and Subcategories were renumbered, so identifiers from CSF 1.1 no longer apply.

Openlane for NIST CSF

How does Openlane help implement NIST CSF?

Openlane lets you build your program around the six CSF 2.0 Functions and map each Category outcome to a control your team operates. Every control carries an owner, an implementation, and evidence, so a gap is visible as a control without proof rather than a line in a spreadsheet.

Can Openlane track CSF implementation progress?

Each CSF outcome maps to a control with an owner, an implementation, and evidence, so progress toward your Target Profile reads as the status of those controls. Stale evidence and open remediations surface on the record rather than in a quarterly spreadsheet.

Does Openlane support CSF alongside other frameworks?

Many organizations use the CSF as the organizing structure and implement controls from ISO 27001, SOC 2, or NIST 800-53 underneath it. Openlane maps one control to every framework it satisfies, so the same implementation answers the CSF Subcategory and the standard's control at once, with unlimited frameworks at no added charge.

© Copyright theopenlane, Inc. All Rights Reserved.

Openlane on Product Hunt
California Consumer Privacy Act (CCPA) Opt-Out IconYour Privacy ChoicesNotice at Collection