NIST CSF 2.0

The six functions

Govern (GV)

New in 2.0. Organizational context, risk management strategy, roles and responsibilities, policy, oversight, and supply-chain risk management.

Identify (ID)

Asset management, risk assessment, and improvement. In RAIC this draws heavily on the AI Systems register and AI Discovery.

Protect (PR)

Identity management and access control, awareness and training, data security, platform security, and technology resilience.

Detect (DE)

Continuous monitoring and adverse event analysis, fed by Operation Monitoring and discovery signals.

Respond (RS)

Incident management, analysis, response reporting, and mitigation.

Recover (RC)

Incident recovery plan execution and recovery communication.

Categories and subcategories

Each function breaks into categories, and each category into subcategories — the actual unit of scoring. RAIC ships the full 2.0 subcategory set. You score each subcategory on implementation tier, attach the controls that deliver it, and attach evidence to those controls. Subcategory scores roll up to category, category to function, and function to an overall CSF posture percentage.

Scoring model

• Not implemented — no control mapped, or mapped controls are untested and unevidenced.
• Partially implemented — a control exists but coverage is incomplete or evidence is stale.
• Largely implemented — control operates with current evidence, minor gaps remain.
• Fully implemented — control operates, evidence is current, and the review cadence is being met.
• Not applicable — requires a written justification, exactly as with an ISO Statement of Applicability.

Crosswalks

The canonical control register maps into CSF 2.0 subcategories, CIS Controls v8 safeguards, ISO/IEC 42001 Annex A, and SOC 2 Trust Services criteria at the same time. Score a control once and its coverage appears in every framework it satisfies. Crosswalk tables are shared reference data maintained by Rhindon and updated with the frameworks.

Gap reporting

• Function-level radar showing posture across all six functions at a glance.
• Subcategory gap list ordered by weakest score, with the owning control and its owner.
• Target-profile comparison: set a desired tier per function and report the delta.
• CSV export with MM/DD/YYYY HH:MM dates and a RhindonCyber_ filename prefix, plus a branded DOCX assessment report.
• CSF posture feeds the Cyber Governance Maturity Index on the AI Maturity dashboard.

Getting started

Enable Cybersecurity Mode, import or adopt the platform control statements for CIS v8, then work Govern and Identify first — they establish the context every other function depends on. Most organizations reach a usable baseline in one pass by mapping existing controls rather than writing new ones.