NIST CSF 2.0 Complete Program

NIST CSF 2.0 is the common language boards, examiners and insurers now use to ask about cybersecurity. Version 2.0 added GOVERN, and most organizations discover their largest gaps there.

This is the whole program. Sixteen policies of 8 to 10 pages, each governance only and tool neutral, with its own NIST CSF 2.0 alignment table, and sixteen companion procedures of 12 to 16 pages that turn each policy into step-by-step technical execution, with configuration tables, placeholders for your tools and screenshots, records, metrics and troubleshooting. The program documents assessors ask for: Security Exception Request, Evidence Collection Procedure, Cybersecurity Risk Management Strategy, and more. A program edition workbook that adds ten program metrics, a quarterly maturity history and a 90-day plan to the three-pillar assessment, roadmap and evidence register.

The worked example is a fully populated program for a fictional organization one quarter in, with honest scores, a roadmap with an overdue initiative, gaps in evidence and a walkthrough explaining what every flag means, so you can see what good looks like before you start.

What is included

1. Program Guide, Implementation Guide and Framework Reference (PDF).

2. Sixteen full policies (8 to 10 pages each) with document control, approval, RACI, numbered statements, organization-defined parameters, metrics and framework alignment (Word).

3. Sixteen companion procedures (12 to 16 pages each) with step-by-step technical instructions, configuration tables, screenshot placeholders, records and evidence, metrics and troubleshooting (Word).

4. Ten program documents: charter, plans, registers and report templates (Word).

5. NIST-CSF-2-Program-Workbook.xlsx, program edition, with metrics, maturity history and the 90-day plan.

6. Example Completed Program: populated workbook and walkthrough (Excel and PDF).

Who it is for

Security managers, IT directors, vCISOs, compliance leads and executives at organizations of roughly 25 to 1,000 people who need to measure and report their cybersecurity program against NIST CSF 2.0, whether for a board, an examiner, an insurer or customers.

Formats

16 policies, 16 procedures, 10 program documents.

About the framework text

Includes the official NIST subcategory text and Implementation Examples, which are public domain.

License

License. Your purchase grants one organization a perpetual, non-exclusive license to use, copy, and modify these materials for its own internal security program, including sharing completed questionnaires and contract exhibits with its own vendors. You may not resell, sublicense, or redistribute the templates themselves, in original or modified form, as a product. Consultants and managed service providers who want to use the materials across multiple client organizations need a practitioner license; contact cyberauctoritas.com.

Disclaimer

This material is provided for general information and internal program building. It is not legal advice and does not certify compliance with any law, regulation, or framework. Contract language must be reviewed by qualified counsel before use. Adapt every document to your organization, your risk tolerance, and your obligations.