Run NIST CSF 2.0 and your maturity assessment in one place.
NIST CSF 2.0 sorts cybersecurity outcomes into six functions. Install it in Alvor's Compliance module to work every subcategory as a control, and run your maturity assessment in Security Management against current and target scores.
NIST CSF overview
The framework behind cybersecurity strategy
6
Core functions
106
Subcategories in CSF 2.0
4
Implementation tiers
The NIST Cybersecurity Framework provides a common language for understanding, managing, and expressing cybersecurity risk. Version 2.0 added the Govern function, emphasizing organizational context and governance. CSF 2.0 is voluntary guidance that organizations use to describe a current and a target profile and to plan the work between them across six functions.
Domain coverage
Six functions, one security posture
NIST CSF 2.0 organizes cybersecurity outcomes into six high-level functions that span the full lifecycle of cybersecurity risk management.
Govern (GV)
Establish and monitor the organization's cybersecurity risk management strategy, expectations, and policy. The new function in CSF 2.0 that ties everything to business context.
Identify (ID)
Understand your organizational context, assets, risks, and supply chain to manage cybersecurity risk. Covers asset management, risk assessment, and improvement.
Protect (PR)
Implement safeguards to manage cybersecurity risk. Covers identity management, access control, awareness training, data security, and platform security.
Detect (DE)
Find and analyze anomalies, indicators of compromise, and adverse events. Covers continuous monitoring and adverse event analysis.
Respond (RS)
Take action regarding a detected cybersecurity incident. Covers incident management, analysis, response reporting, and mitigation.
Recover (RC)
Restore capabilities and services impaired by a cybersecurity incident. Covers incident recovery plan execution and communication.
Common challenges
Where CSF maturity work goes stale, and how Alvor helps
The problem
Running maturity assessments with spreadsheet questionnaires that go stale the day they're completed
How Alvor helps
Score each control's current and target level in a slide-per-control wizard with evidence attached, snapshot the result, and compare it with the last assessment when you run the next one.
The problem
No clear connection between NIST CSF subcategories and the actual controls and policies your team operates
How Alvor helps
In Compliance, each CSF subcategory carries an owner, evidence and the policies linked to it. In Security Management, the maturity assessment scores each category, and the gap analysis shows where you fall short.
The problem
Board asks for a cybersecurity maturity update and you spend two weeks pulling data from five different tools
How Alvor helps
The board pack PDF comes from one button on the dashboard: programs and progress, maturity current against target, the top gaps and KPI status.
The problem
NIST CSF overlaps with SOC 2 and ISO 27001 but you're tracking all three in separate systems
How Alvor helps
Install ISO 27001 beside CSF 2.0 and NIST's crosswalk between them appears, typed Related. Evidence uploaded once links to the controls on both sides, and each control is still assessed on its own evidence.
What you get
NIST CSF implementation, structured
Every CSF 2.0 subcategory, installed
Install NIST CSF 2.0 and every subcategory, including the new Govern function, becomes a control with an owner, an applicability decision and evidence.
Checks that set control status
Bind configuration checks on AWS, Okta, Entra ID, GitHub or GitLab to a control. They run hourly, every four hours, daily or weekly, and their findings set the control's status.
Current and target scores
Import the NIST CSF 2.0 workbook you supply, score each control's current and target level, and assign it. The gap analysis shows the gap by category, the weakest controls and the recommendations collected from the assessment.
Crosswalks from NIST's references
Install ISO 27001, NIST SP 800-53, NIST SP 800-171, CIS Controls or PCI DSS beside CSF 2.0 and crosswalks from NIST's informative references appear, typed Related. Map any other framework by hand.
A dated posture history
Compliance records a posture snapshot for every active framework each day, so the CSF trend is drawn from dated records. Maturity scores come from the assessments you run, and each can be snapshotted and compared with the last.
The board pack
One button on the Security Management dashboard produces a branded PDF: programs and their progress, maturity current against target, the top gaps and KPI status. Per-assessment PDFs add radar charts, the gap analysis and version history.
Other frameworks
Alvor maps controls across all major security and privacy frameworks with cross-framework intelligence.
Frequently asked
Common questions about NIST CSF
How teams use the NIST Cybersecurity Framework to structure programs, report to boards, and align with other frameworks.
NIST CSF 2.0 defines six core functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC). Govern was added in the 2024 release to tie cybersecurity to organizational risk management, strategy, and policy. Each function is broken into categories and subcategories: 106 subcategories in total.
Get started
See how Alvor works for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.