NIST CSF Software
All six functions (Govern, Identify, Protect, Detect, Respond, Recover), mapped across 30+ other frameworks, with live-data evidence collection and maturity-tier tracking. Built on the CSF as the spine of a broader program.
The NIST Cybersecurity Framework is voluntary in origin but load-bearing in practice. Boards ask about it. Cyber insurers build questionnaires around it. Procurement teams reference it. Federal contractors treat it as a baseline. Every other framework — SOC 2, ISO 27001, HIPAA, PCI DSS — has authoritative crosswalks to CSF, which is why CSF is so often the "master" framework in multi-framework programs.
CSF 2.0 (published 2024) adds the Govern function — 27 controls covering organizational context, supply chain risk, and risk management strategy — on top of the original five functions from v1.1. Radius360's catalog supports both.
The decision isn't usually "do we adopt CSF" — it's "how do we run it without treating the framework as a quarterly spreadsheet exercise."
Six functions, one platform, live data.
Govern (27), Identify (21), Protect (32), Detect (18), Respond (20), Recover (9). Each control pre-loaded with description, implementation guidance, and maturity tier tracking. Organized the way CSF intends, not jammed into a generic control list.
Every CSF control maps to the matching controls in SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, FedRAMP. Implementing PR.AC-01 satisfies the corresponding controls in every mapped framework automatically. One control, many audits.
Partial → Risk Informed → Repeatable → Adaptive for every control. Roll-ups per function and program-wide posture score. See at a glance where you're strongest and where you're underinvested.
23 deep integrations pull evidence that maps to specific CSF subcategories. Okta → PR.AC (Access Control), CrowdStrike → DE.CM (Detection Continuous Monitoring), Tenable → ID.RA (Risk Assessment). Quarterly evidence refresh becomes overnight evidence refresh.
Target profile + current profile, side by side, grounded in your actual environment. Gap analysis auto-populates with specific improvement plans. Policies cite your live CSF coverage rather than generic NIST language.
vCISOs running CSF-based maturity assessments across their client portfolio see all clients' CSF posture in one view. Each client's framework, evidence, and maturity scoring lives in its own tenant.
Yes — both versions are in the framework catalog. v2.0 adds the Govern function (27 controls), bringing the total to ~127 controls across Govern, Identify, Protect, Detect, Respond, Recover. You can run either version or migrate between them without losing evidence.
Yes. NIST CSF maps into every other framework in the catalog (SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, FedRAMP). Evidence attached to a CSF control satisfies the mapped controls in every other framework automatically, and vice versa. This is why CSF is often used as the 'spine' framework in multi-framework programs.
Neither — CSF is voluntary but increasingly expected. Regulators, insurers, and procurement teams use CSF-based questionnaires. Federal contractors use it as a baseline. Boards ask about it because it's the most-cited cybersecurity framework. Treating it as optional is increasingly a risk of its own.
Yes — each control tracks implementation state and maturity level (Partial / Risk Informed / Repeatable / Adaptive, the CSF-native maturity tiers). Scoring rolls up to the function level and the overall posture score. AI-generated recommendations highlight the controls with the biggest gap between target and current state.
Most commonly: CISOs and heads of security at companies where CSF is the primary reporting framework to the board; vCISOs building multi-framework programs that use CSF as the baseline; MSSPs offering CSF-based maturity assessments as a service.
Free trial, full CSF 2.0 catalog, no credit card. See how cross-framework mapping compresses the work in a single evening.
Start free trial