NIST CSF 2.0 in the cloud, outcome by outcome.
CSF 2.0 has 106 outcomes across six functions, from Govern to Recover. NxSCORE shows which ones your cloud evidences, and what your programme has to show for the rest.
You will recognise this if
- Your board asked for a CSF profile, and the cloud evidence is a CNAPP export.
- The new Govern function has no owner, and nobody is sure what counts as evidence for it.
- Your current profile was built against CSF 1.1, and the categories have moved.
- Each business unit scores itself, and the cloud estate is scored twice or not at all.
What a CNAPP covers, and what it leaves.
The product team reviewed one widely used CNAPP’s AWS policies against every requirement in NIST CSF 2.0, and kept only the policies that really evidence it. Each requirement is counted once.
- A CNAPP policy counts towards it16
The CNAPP has a policy that tests what the requirement asks. NxSCORE checks it too, and counts each failing resource once.
- Only NxSCORE checks cover it21
A setting can be tested, but the CNAPP has no policy for it, or one that tests something else.
- Only evidence can show it69
Policies, reviews, records and systems outside the cloud. A person has to show it was done.
CSF covers the whole organisation, not only the cloud. Cloud checks count towards an outcome for the cloud estate; the rest of the estate, and the programme itself, need evidence.
Four requirements, and what each one takes.
For every requirement NxSCORE says how it can be met, and why checks are not enough where they are not.
| Requirement | Covered by | What it takes |
|---|---|---|
| ID.AM-02 Software, services and systems inventory maintained | CNAPP policy and NxSCORE checks | Checks show the cloud inventory is recorded; SaaS, on-premise and end-user software need the inventory itself. |
| DE.CM-03 Personnel activity and technology use monitored | CNAPP policy and NxSCORE checks | Checks show cloud activity is logged and alarmed; records show someone reviews it. |
| PR.PS-05 Unauthorised software installation and execution prevented | NxSCORE checks only | Checks see the cloud controls; execution control inside instances and on endpoints needs evidence. |
| GV.SC-06 Due diligence performed before engaging suppliers | Evidence only | Due diligence records for recently engaged suppliers. |
Every requirement in one record. Now, proved once.
How NxSCORE keeps NIST CSF current.
The daily assessment settles what checks can settle. Your team and your analyst handle the rest, and the record shows who did what.
- 01
A status for every requirement, with the reason.
Each requirement shows how it is met, the checks behind it and whether each ran, the CNAPP policies that count towards it, and its failing resources, with a resource failing in both tools counted once.
Requirement statusSix states- Met
The checks pass, and any evidence it needs is accepted
- Met by compensating control
Met another way, reviewed by your analyst
- Failing
A check fails on at least one resource
- Evidence needed
No accepted evidence, or it has lapsed
- In review
Evidence waiting for your analyst
- Not assessed
The checks behind it could not run
- 02
Evidence prepared by your team, accepted by someone else.
Your team writes up the evidence and attaches the files. Your NxSCORE analyst accepts it, returns it with a reason, or rejects it, and whoever returned it cannot accept the resubmission. Accepted evidence counts to the end of the quarter, plus 30 days, and the daily assessment says when it falls due.
Evidence, one requirementCounted- PreparedYour team writes it up and attaches the files.
- ReviewedYour analyst accepts it, returns it with a reason, or rejects it.
- CountedTo the end of the quarter, plus 30 days.
- Due againThe daily assessment says when, and asks for it fresh.
- 03
Upload once, counted everywhere it applies.
One artifact often answers several frameworks. An approved information security policy counts for ISO 27001 A.5.1, PCI DSS 12.1.1 and NIST CSF GV.PO-01. Before accepting, the analyst sees every requirement the upload will meet.
NxSCORE keeps 2.0, and 1.1 with all 108 of its subcategories. Evidence carries to the same outcome in the other version.
Information security policy, approvedOne uploadRequirement Status ISO 27001 A.5.1 Met PCI DSS 12.1.1 Met NIST CSF GV.PO-01 Met - 04
The fixes that clear the most, first.
Every failing check behind a requirement is ranked by how many requirements it is the only failure in, and how many more it contributes to. The fix kit is written for your engineers to run; NxSCORE’s access stays read-only.
Fix these first, NIST CSF 2.0ExampleFailing check Alone holds back Contributes to CloudTrail log file validation off in 3 accounts Clears 9 14 Root account used in the last 90 days Clears 6 11 Security groups open to the internet on admin ports Clears 4 17 - 05
An evidence pack your assessor can read.
NIST CSF 2.0 downloads as one Excel workbook, laid out requirement by requirement with the evidence beside it. Its first sheet says plainly that it is not a report on compliance: that comes from your independent assessor or auditor.
Evidence pack, NIST CSF 2.0Excel, three sheetsSummary Requirements by status, as of the latest assessment Requirements Status, how each is met, failing resources, checks and CNAPP policies Evidence and compensating Status, when last accepted, when due again, and the files
Questions about NIST CSF in the cloud.
How much of NIST CSF 2.0 can be checked automatically?
In the product team’s review, 4 of the 106 outcomes are settled by checks alone and 33 more by checks plus evidence. The other 69, including most of Govern, are met with evidence.
Does NxSCORE support NIST CSF 1.1 as well as 2.0?
Yes. Both are kept, and evidence accepted for an outcome carries to the same outcome in the other version, so a move from 1.1 to 2.0 does not start again.
Can one piece of evidence count for NIST CSF and other frameworks?
Yes. An approved information security policy counts for NIST CSF GV.PO-01, ISO 27001 A.5.1 and PCI DSS 12.1.1 at once, until it falls due.
See your cloud’s part of the CSF profile.
Connect one cloud account and choose NIST CSF 2.0. After the first assessment, your analyst takes you through each outcome’s status, what the cloud already evidences, and what your programme needs to show.