NIST CSF 2.0 Essentials Compliance

A curated subset of the 30 most critical NIST CSF 2.0 subcategories, extending Starter with deeper coverage across supply chain risk, continuous monitoring, and incident management.

Overview

NIST CSF 2.0 Essentials selects 30 critical subcategories across all six NIST CSF functions.

It extends Starter with supply chain risk, threat intelligence, data integrity, and incident maturity capabilities.

The framework is a MyCISO derivative designed as a practical stepping stone to full NIST CSF implementation.

Implementation takes three to six months after Starter completion, tracked in the MyCISO platform.

Essentials is step two in a progression path toward comprehensive NIST CSF 2.0 adoption.

Key Areas

All 15 subcategories from NIST CSF 2.0 Starter, plus:
GV.SC-01 - Supply chain risk management program is established
GV.SC-03 - Supply chain risks are assessed
ID.AM-02 - Software and services inventories are maintained
ID.RA-02 - Threat intelligence is received and analysed
ID.IM-01 - Improvements from assessments are identified
PR.AA-05 - Access permissions and authorisations are managed
PR.DS-02 - Data in transit is protected
PR.DS-10 - Data integrity is protected
PR.IR-01 - Security functions are isolated from business functions
DE.CM-03 - Personnel activity is monitored
DE.AE-06 - Information on adverse events is provided to authorised parties
RS.MA-02 - Incident reports are triaged and validated
RS.AN-03 - Root cause analysis is performed
RS.MI-01 - Incidents are contained
RC.RP-02 - Recovery actions are selected, scoped, and prioritised

Who It's For

Organisations that completed NIST CSF Starter and want broader coverage
Mid-market companies preparing for full NIST CSF implementation
Organisations with supply chain risk management requirements
Companies in regulated industries that reference NIST CSF
Security teams building a phased NIST CSF implementation roadmap

Core Requirements

Policies and Governance: Establish a supply chain risk management program (GV.SC-01) with policies for assessing supplier security (GV.SC-03). Extend access management policies to cover permissions and authorisation management (PR.AA-05).
Risk Management: Expand asset management to include software and services (ID.AM-02). Incorporate threat intelligence (ID.RA-02) into risk assessment processes. Establish a continuous improvement cycle (ID.IM-01) that feeds assessment findings back into the security program.
Security Controls: Add data-in-transit protection (PR.DS-02), data integrity controls (PR.DS-10), and security function isolation (PR.IR-01). Implement granular access permission management (PR.AA-05). Extend monitoring to include personnel activity (DE.CM-03).
Incident Response: Mature incident management to include triage and validation (RS.MA-02), root cause analysis (RS.AN-03), and containment procedures (RS.MI-01). Ensure adverse event information is shared with authorised parties (DE.AE-06).
Evidence and Reporting: Evidence requirements expand to include supply chain assessments, threat intelligence reviews, access permission audits, data protection configurations, and detailed incident response records including root cause analysis reports.

Implementation Steps

Assess expanded scope - Assess your maturity against the 15 additional Essentials subcategories. Existing Starter scores carry forward automatically in the MyCISO platform.
Supply chain program - Establish a supply chain risk management program. Identify critical suppliers, define security requirements, and conduct initial assessments.
Enhanced protection - Implement data-in-transit encryption, data integrity controls, access permission management, and security function isolation.
Monitoring maturity - Extend monitoring to cover personnel activity and establish procedures for sharing adverse event information with authorised stakeholders.
Incident management maturity - Implement structured incident triage, root cause analysis, and containment procedures. Document and test these processes.
Continuous improvement - Establish a formal improvement cycle that uses assessment findings, incident lessons, and threat intelligence to drive security program evolution.

Frequently Asked Questions

Do I need to complete Starter first?: Recommended but not required. If your organisation already has foundational security practices, you can assess directly against Essentials. The platform will identify all gaps regardless of your starting point.
How does this compare to CIS Controls IG2?: Both cover a similar breadth of security practices. NIST CSF Essentials follows the six-function structure and is outcome-focused, while CIS Controls IG2 provides more prescriptive, action-oriented safeguards. They complement each other well.
Is this sufficient for regulatory compliance?: Essentials covers the majority of subcategories referenced in regulatory guidance that cites NIST CSF. However, specific regulatory requirements may mandate additional subcategories. Check your regulatory obligations.
What comes after Essentials?: Full NIST CSF 2.0 implementation, covering all 100+ subcategories. The practices and processes established in Essentials provide a strong foundation for this expansion.

Why It Matters

Essentials addresses the areas most commonly identified as gaps in NIST CSF assessments: supply chain risk, continuous monitoring, and structured incident management. These are the capabilities that differentiate a reactive security program from a proactive one.
The 30 subcategories in Essentials cover the vast majority of topics that appear in customer security questionnaires and regulatory assessments referencing NIST CSF.
Organisations that complete Essentials have a solid foundation for full NIST CSF implementation, with established processes, documentation, and evidence collection practices that transfer directly.

Common Challenges

Building a supply chain risk management program that is practical rather than bureaucratic
Integrating threat intelligence into decision-making when the organisation lacks dedicated threat analysis capability
Balancing personnel activity monitoring with privacy expectations and legal requirements
Performing meaningful root cause analysis on incidents when forensic capabilities are limited
Maintaining the discipline of continuous improvement when competing priorities demand attention