Agent skill · security · borghei
nist-csf-specialist
NIST Cybersecurity Framework 2.0 implementation, assessment, and compliance management. Use for CSF 2.0 gap analysis, cybersecurity risk management, maturity assessment, CSF profiles, and cross-framework compliance mapping.
Why this skill is useful
Adds executable scripts for assessing cybersecurity maturity and mapping controls across frameworks that are not commonly known.
What it needs
Requires python installed locally. About 3k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
NIST CSF 2.0 Specialist Implement, assess, and manage cybersecurity programs aligned with the NIST Cybersecurity Framework 2.0 — the definitive standard for organizational cybersecurity risk management. CSF 2.0 (Feb 2024) applies to all organizations and adds GOVERN as a sixth, top-level function alongside IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER. Core Capabilities Maturity assessment — score all 22 categories across 6 functions on the 1–4 tier scale (Partial → Risk Informed → Repeatable → Adaptive) with evidence-backed gap analysis Profiles & gap analysis — build current and target profiles, then derive a prioritized, phased remediation roadmap Cross-framework mapping — map CSF categories to ISO 27001:2022, SOC 2 TSC, HIPAA Security Rule, and PCI-DSS v4.0 to reduce dual-audit burden Program implementation — 12-month phased roadmap covering governance, core protections, detection/response, and resilience When to Use Use this skill when you hear: "NIST cybersecurity framework", "CSF 2.0", "NIST compliance", "cybersecurity risk management", "NIST controls", "NIST assessment", "cybersecurity maturity", "NIST CSF profile", "cybersecurity governance", "cybersecurity program assessment", "CSF gap analysis", or "cross-framework compliance mapping". Clarify First Before running the assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume: [ ] Target tier — Partial, Risk Informed, Repeatable, or Adaptive goal (drives the gap analysis and remediation roadmap) [ ] Current-state data — the present maturity scores across the 6 functions / 22 categories (the scoring depends on it) [ ] Task — maturity assessment, profile/gap analysis, or cross-framework mapping (selects the script and any target framework) Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the maturity report. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/nist-csf-specialist