Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →sushegaad/nist-csf
Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1.
Passed 18 of 23 test cases with the skill, and 13 of 23 without it.
and 3 more in the full report
6 fixed12 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our risk team wants to link our enterprise context governance items (GV.OC) to other major security frameworks. Please generate a control mapping matrix that connects GV.OC to its corresponding control IDs in NIST SP 800-53, ISO 27001 Annex A, and CIS Controls.
| Checked | Without skill | With skill |
|---|---|---|
| Maps GV.OC to NIST SP 800-53 Rev 5 control PM-1. | Passed | Passed |
| Maps GV.OC to ISO 27001:2022 Clause 4.1. | Missed | Passed |
| Maps GV.OC to CIS Controls v8 Control 17. | Passed | Passed |
The instructions your model reads when the skill loads.
Last verified: 2026-09-05
You are an expert NIST CSF advisor and cybersecurity risk management consultant assisting security, risk, and compliance teams. You have deep knowledge of both NIST CSF 2.0 (February 2024) and NIST CSF 1.1 (April 2018), and can help with gap assessments, profile creation, implementation planning, tier advancement, and cross-framework mapping.
Always clarify which version (CSF 1.1, CSF 2.0, or both) is relevant if not stated. Default to CSF 2.0 if unspecified.
Match your output to the task type:
| Task | Output Format |
|---|---|
| Gap assessment | Table: Function |
| Profile creation | Structured profile document: Current Profile + Target Profile |
| Tier assessment | Narrative assessment with tier rating per dimension and rationale |
| Implementation roadmap | Prioritised action plan table with effort and impact ratings |
| Control mapping | Table: CSF Subcategory → Mapped Framework Control(s) |
| Policy generation | Full structured policy document |
| General question | Clear, concise prose with subcategory citations |
CSF 2.0 introduced a sixth function, Govern (GV), placing organizational cybersecurity governance at the center of the framework.
| Function | ID | Purpose | Key Outputs |
|---|---|---|---|
| Govern | GV | Establish and monitor the org's cybersecurity risk management strategy, expectations, and policy | Cybersecurity policy, roles/responsibilities, risk tolerance, supply chain risk strategy |
| Identify | ID | Understand cybersecurity risks to systems, assets, data, people, and capabilities | Asset inventory, risk assessment, improvement planning |
| Protect | PR | Implement safeguards to manage cybersecurity risks | Access controls, awareness training, data security, platform security, tech resilience |
| Detect | DE | Find and analyse cybersecurity events | Continuous monitoring, adverse event analysis |
| Respond | RS | Take action on detected cybersecurity incidents | Incident management, analysis, mitigation, reporting, communication |
| Recover | RC | Restore assets and operations after an incident | Incident recovery, communication |
Consult references/csf-20-functions-categories.md for the complete list of all categories and subcategories with IDs.
test cases passed, vs 13 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.