NIST CSF Advisor
Assess and improve cybersecurity posture with the NIST Cybersecurity Framework 2.0 — the six functions, implementation tiers, organizational and community profiles, gap assessments, and framework mappings.
The NIST CSF is the common language boards and regulators use to talk about cyber risk — and CSF 2.0 just added Govern as a sixth function. If you can't show a current and target profile, you can't show you're managing the risk.
Who it's for: security leaders building a cyber-risk program, CISOs reporting posture to leadership, teams adopting or upgrading to CSF 2.0, organizations building current/target profiles, compliance leads mapping CSF to other frameworks
Example
"Assess our cybersecurity posture against NIST CSF 2.0 and build a target profile" → A function-by-function gap assessment, a current vs. target profile, an implementation-tier rating, and a prioritized improvement roadmap
CLAUDE.md Template
New here? 3-minute setup guide → | Already set up? Copy the template below.
# NIST Cybersecurity Framework (CSF) Skill
You are an expert NIST CSF advisor and cybersecurity risk management consultant assisting **security, risk, and compliance teams**. You have deep knowledge of both **NIST CSF 2.0** (February 2024) and **NIST CSF 1.1** (April 2018), and can help with gap assessments, profile creation, implementation planning, tier advancement, and cross-framework mapping.
## How to Respond
Always clarify which version (CSF 1.1, CSF 2.0, or both) is relevant if not stated. Default to **CSF 2.0** if unspecified.
Match your output to the task type:
| Task | Output Format |Get new playbooks like this one
One email a week with new Claude Code workflows. Free, like everything here.
No spam. Unsubscribe anytime.
What This Does
Turns Claude Code into a NIST Cybersecurity Framework advisor covering CSF 2.0 and CSF 1.1. It assesses posture across the six functions (Govern, Identify, Protect, Detect, Respond, Recover), builds organizational and community profiles, rates implementation tiers, runs gap assessments against the CSF core subcategories, explains what CSF 2.0 changes, and maps to NIST SP 800-53, ISO 27001, CIS Controls, and COBIT.
The Problem
The CSF is powerful precisely because it's flexible — which also makes it hard to operationalize. Teams know the six functions but struggle to turn them into a current profile, a defensible target profile, and a prioritized roadmap that leadership can fund. CSF 2.0's new Govern function and updated subcategories add work for organizations already mapped to 1.1.
Quick Start
Step 1: Create Your Workspace
mkdir -p ~/Documents/NIST-CSF
Step 2: Download the Template
mv ~/Downloads/CLAUDE.md ~/Documents/NIST-CSF/
Step 3: Add Context (Optional)
Describe your environment, current controls, risk appetite, and any existing framework work.
Step 4: Run Claude Code
cd ~/Documents/NIST-CSF
claude
Step 5: Start
Say: "Assess our cybersecurity posture against NIST CSF 2.0 and build a target profile."
Example Commands
"Run a gap assessment across the six CSF functions"
"Build a current and target organizational profile"
"Rate our implementation tier and justify it"
"What does CSF 2.0 change versus 1.1?"
"Translate the Govern function into concrete actions for us"
"Map our CSF profile to NIST SP 800-53 and ISO 27001"
"Prioritize a 12-month cybersecurity improvement roadmap"
What You Get
| Output | Contents |
|---|---|
| Gap Assessment | Findings across all six functions |
| Profiles | Current and target organizational profiles |
| Tier Rating | Implementation-tier assessment |
| Roadmap | Prioritized improvements |
| Framework Mapping | Crosswalk to 800-53, ISO 27001, CIS |
Tips
- Use profiles to communicate — current vs. target is how you brief leadership.
- Take Govern seriously — CSF 2.0 elevates governance for a reason.
- Map to your other frameworks — avoid duplicating control work.
Important Disclaimer
This is a cybersecurity planning and assessment tool, not a certification. Have qualified security professionals review profiles and assessments before relying on them.