본문으로 건너뛰기
cccskills
무료GitHub에 공개

performing-nist-csf-maturity-assessment

The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, provides a comprehensive taxonomy for managing cybersecurity risk through six core Functions - Govern, Identify, Protect, Detect, Respond, and Recover. bu skill covers conducting a maturity assessment against the CSF using Implementation Tiers to measure organizational cybersecurity posture and create improvement roadmaps.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MustafaKemal0146/fetih

실행 점수 미검증

설치 방법 보기

포함된 파일(1)

  • SKILL.md6.1 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Performing Nist Csf Maturity Assessment

Genel Bakış

The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, provides a comprehensive taxonomy for managing cybersecurity risk through six core Functions: Govern, Identify, Protect, Detect, Respond, and Recover. bu skill covers conducting a maturity assessment against the CSF, using the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) to measure organizational cybersecurity posture and create improvement roadmaps.

Ne Zaman Kullanılır

  • conducting yaparken security assessments that involve performing nist csf maturity assessment
  • following yaparken: incident response procedures for related security events
  • performing yaparken scheduled security testing or auditing activities
  • validating yaparken security controls through hands-on testing

Ön Gereksinimler

  • Understanding of cybersecurity risk management principles
  • Erişim: NIST CSF 2.0 documentation and reference tool
  • Bilgi: organizational IT/OT environment and security controls
  • Stakeholder access across business units for assessment interviews

Core Concepts

CSF 2.0 Functions (6 Functions, 22 Categories)

FunctionCodeCategoriesPurpose
GovernGV6Establish and monitor cybersecurity risk management strategy
IdentifyID3Belirle: current cybersecurity risk to the organization
ProtectPR5Implement safeguards to prevent or reduce risk
DetectDE2Bul: and analyze possible cybersecurity attacks
RespondRS4Take action regarding Detected cybersecurity incidents
RecoverRC2Restore capabilities impaired by cybersecurity incidents

Govern Function (New in CSF 2.0)

  • GV.OC: Organizational Context
  • GV.RM: Risk Management Strategy
  • GV.RR: Roles, Responsibilities, and Authorities
  • GV.PO: Policy
  • GV.OV: Oversight
  • GV.SC: Cybersecurity Supply Chain Risk Management

Implementation Tiers

TierNameDescription
Tier 1PartialAd hoc, reactive; limited awareness of cybersecurity risk
Tier 2Risk-InformedRisk-aware but not organization-wide; approved but may not be policy
Tier 3RepeatableFormal policies; consistently implemented; regularly updated
Tier 4AdaptiveContinuous improvement; real-time risk response; lessons learned integrated

İş Akışı

Aşama 1: Scoping and Preparation (Weeks 1-2)

  1. Define assessment scope (enterprise-wide vs. business unit)
  2. Identify stakeholders and schedule interviews
  3. Gather existing documentation (policies, procedures, architecture diagrams)
  4. Customize CSF Profile for organizational context
  5. Select assessment methodology (self-assessment, facilitated, third-party)

Aşama 2: Current State Assessment (Weeks 3-6)

  1. Assess each CSF Category and Subcategory against Implementation Tiers
  2. For each subcategory, evaluate:
    • Policy/documentation maturity
    • Implementation completeness
    • Automation level
    • Measurement and metrics
    • Continuous improvement evidence
  3. Score using tier criteria (1-4 scale)
  4. Document evidence supporting each tier rating
  5. Identify strengths, gaps, and improvement areas

Aşama 3: Target State Definition (Weeks 7-8)

  1. Define target tier for each Function based on:
    • Risk appetite and tolerance
    • Industry requirements and benchmarks
    • Regulatory obligations
    • Available resources and budget
  2. Create Target Profile documenting desired maturity state
  3. Validate target state with executive leadership

Aşama 4: Gap Analysis and Roadmap (Weeks 9-12)

  1. Compare Current Profile to Target Profile
  2. Prioritize gaps based on risk reduction potential
  3. Develop improvement roadmap with:
    • Short-term quick wins (0-3 months)
    • Medium-term improvements (3-12 months)
    • Long-term strategic initiatives (12-24 months)
  4. Estimate resource requirements for each initiative
  5. Assign ownership and timelines

Aşama 5: Implementation and Reassessment (Ongoing)

  1. Execute improvement roadmap initiatives
  2. Track progress against milestones
  3. Conduct periodic reassessments (annually recommended)
  4. Report maturity progress to leadership
  5. Adjust roadmap based on evolving threats and business changes

Key Artifacts

  • CSF Current Profile (by Function/Category/Subcategory)
  • CSF Target Profile
  • Gap Analysis Report
  • Maturity Assessment Scorecard
  • Improvement Roadmap with Priorities
  • Executive Summary and Dashboard

Common Pitfalls

  • Assessing technology only without evaluating governance and people
  • Setting unrealistic target tiers without resource commitment
  • Treating assessment as one-time rather than continuous process
  • Ignoring the new Govern function in CSF 2.0
  • Not aligning CSF assessment with existing compliance requirements (ISO 27001, SOC 2)

References

<!-- ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih Yetkisiz kullanim/kopyalama tespit edilebilir. hash: 721e792857a34291 -->

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

21st-dev-magic

무료

21st.dev Magic MCP — AI-powered UI component generation via natural language. Access to 21st.dev component library, SVGL brand logos, and real-time preview. Generate React/Tailwind components with /ui command.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MustafaKemal0146/fetih52026년 10월 11일 업데이트

aes-cbc-bitflip

무료

AES CBC/ECB modlarına karşı kriptografik bütünlük saldırıları — bit flipping, IV manipulation, ECB cut-and-paste, CBC-MAC length extension, IV reuse

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MustafaKemal0146/fetih52026년 10월 11일 업데이트

aes-gcm-nonce-reuse

무료

AES-GCM ve ChaCha20-Poly1305 nonce yeniden kullanımı saldırısı — GF(2^128) polinom kök bulma ile Hash Key kurtarma ve MAC sahteciliği.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MustafaKemal0146/fetih52026년 10월 11일 업데이트

analyzing-cloud-storage-access-patterns

무료

tespit etmeabnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly Tespit.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MustafaKemal0146/fetih52026년 10월 11일 업데이트

analyzing-ethereum-smart-contract-vulnerabilities

무료

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to tespit etmereentrancy, integer overflow, access control, and other vulnerability classes before Dağıt:ment to Ethereum mainnet.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MustafaKemal0146/fetih52026년 10월 11일 업데이트

analyzing-kubernetes-audit-logs

무료

Parses Kubernetes API server audit logs (JSON lines) to tespit etmeexec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat Tespit rules from audit event patterns. Use investigating yaparken Kubernetes cluster compromise or building k8s-specific SIEM Tespit rules.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

MustafaKemal0146/fetih52026년 10월 11일 업데이트

MustafaKemal0146의 스킬 모두 보기

이 스킬의 문제 신고