NIST CSF 2.0, scored on a real maturity scale.
CSF is a maturity model. TruOps records maturity for every category and function, so you can see where you are, where you want to be, and what closes the gap.
NIST CSF 2.0 profile
Current vs target, by function, on the four Implementation Tiers: 1 Partial, 2 Risk informed, 3 Repeatable, 4 Adaptive
The same work also counts toward
Mapped coverage, with partial overlaps shown
Each mapping is labeled exact, partial, or inferred, with a source.
The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover, broken into categories and subcategories. It's voluntary and outcome-based. Organizations use profiles to describe their current and target states, and tiers to describe how rigorous their risk management is.
- Published by
- U.S. National Institute of Standards and Technology
- Current version
- CSF 2.0 (February 2024)
- Functions
- Govern · Identify · Protect · Detect · Respond · Recover
- Structure
- 22 categories, 106 subcategories
What changed in 2.0
CSF 2.0 added the Govern function, which covers cybersecurity strategy, roles, policy, oversight, and supply chain risk management, and broadened the framework's scope from critical infrastructure to organizations of any size or sector. It also added implementation examples and quick-start guides.
The challenge
CSF is a maturity model. Reduce it to implemented or not and you lose the number leadership can act on: how mature each category is.
- A one-time workshop produced a score nobody can reproduce.
- Govern was added in 2.0 and nobody has rescored.
- The same work gets redone for ISO or SOC 2 because the CSF assessment stands alone.
What you're probably using today
Almost nobody starts NIST CSF 2.0 from scratch. You already have a program somewhere, and TruOps picks up from there.
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| SOC 2 automation tools | Great for getting certified, with automated tests, a big framework library, and often a trust center. Maturity scoring, custom frameworks, and deeper risk or vendor work can fall outside what they cover. | Keep your automated checks. Use any framework as your anchor, map the rest with partial overlaps clearly marked, and run vendor and risk work in the same place. Start with the policies and reports you already have. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
| A consultant's maturity workbook | Accurate the week of the workshop, with no owners, no evidence, and no trend. | Upload it. TruOps records maturity for each requirement, charts it by function, and keeps it tied to evidence as your controls change. |
Profiles and tiers
A current profile describes the outcomes you achieve today, and a target profile describes where you want to be. Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorous your cybersecurity risk governance and management are. Many organizations also score each subcategory on a maturity scale to prioritize work.
How TruOps helps with NIST CSF 2.0
Pick NIST CSF 2.0 as your anchor, or map it to the framework you already run. TruOps keeps NIST CSF 2.0's own structure, down to the individual requirement, and shows coverage per requirement as satisfied, partial, or open, with the evidence behind each.
Upload what you have (prior reports, policies, spreadsheets) and TruOps pre-fills your NIST CSF 2.0 assessment with cited answers. Connected tools keep technical controls current on the schedule you set, and failed checks become findings with a recommended fix.
Upload a completed NIST CSF maturity assessment and TruOps records maturity for each requirement, keeping the full scale intact, then charts it by function and category.
How TruOps helps
- Anchor or map
- Use NIST CSF as your anchor or map it to another framework, and your work counts once.
- Pre-filled assessment
- Your NIST CSF assessment opens with the answers your evidence supports already filled, each cited.
- Accurate coverage
- Partial coverage is clearly marked, with the remaining requirements listed.
- Continuous monitoring
- Technical controls checked against your tools, from hourly to quarterly.
- Findings with fixes
- Failed checks become grouped findings with a recommended action.
- Audit-ready snapshots
- Results saved as of their date, with the evidence trail attached.
Questions
What are the six functions of NIST CSF 2.0?
Govern, Identify, Protect, Detect, Respond, and Recover.
Is NIST CSF mandatory?
No. It's voluntary guidance, though some regulators, contracts, and insurers reference it.
Can TruOps score NIST CSF maturity?
Yes. Posture is recorded on each framework's own scale, including maturity from 0 to 5, and you can chart it by function and category.
How is NIST CSF different from NIST 800-53?
CSF describes outcomes, and SP 800-53 is a detailed catalog of controls. CSF subcategories are commonly mapped to 800-53 controls.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Does TruOps replace our auditor, QSA, or certification body?
No. Only a licensed auditor, QSA, C3PAO, or accredited certification body can issue the opinion. TruOps keeps your evidence current, sourced, and dated so fieldwork goes quickly.
Related
Scoring how capable a program is, beyond pass or fail.
→FrameworksNIST SP 800-53The federal control catalog behind FISMA and FedRAMP.
→Use casesBoard reportingAnswers leadership can act on, with sources.
→PlatformReporting & dashboardsDescribe a chart in plain language and click into any number to see its source.
→IndustriesEnergy & utilitiesCritical infrastructure, OT environments, and resilience.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.