Policies & Standards — NIST CSF 2.0

What this set does

NIST CSF 2.0 is an outcomes framework: it tells you what good looks like, not what to write. This set closes that gap. Each subcategory (for example GV.RM-01 or PR.AA-05) has a standard that states the requirement, the responsible role, and the evidence a reviewer would expect.

What's inside

• Policies for Govern, Identify, Protect, Detect, Respond and Recover
• Standards for all 106 CSF 2.0 subcategories
• Organisational profile template (current and target profiles)
• Tier self-assessment workbook
• Roles and responsibilities matrix (RACI)
• Mapping workbook: CSF 2.0 to ISO 27002 and NIST SP 800-53

Who it is for

US-facing organisations, suppliers asked for a CSF profile by a customer, and boards that want a plain-language governance structure.

How the documents are structured

Every document opens with its purpose, scope and owner, then the substantive content, then a control cross-reference showing which framework requirements it satisfies. Standards state requirements in testable language ("must", with the parameter). Procedures follow one format: trigger, roles, steps, frequency, records produced. Placeholders are limited to things only you can know: organisation name (which we fill in), system names, role titles, tool names and timelines. There are no "[insert policy here]" sections.

Tailoring effort

Expect to spend a few hours on a policies-and-standards set and longer on procedures, because procedures describe how your team actually works. The document register in each set lists every file with a suggested owner so you can split the work.

Included in these bundles

• NIST CSF 2.0 Governance Bundle — £1,495

Licence

One purchase covers one organisation for internal use, with unlimited users and unlimited edits. Consultancies and MSPs tailoring documents for clients need the multi-client licence; see the terms or ask us.