Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →tradecatlabs/csf-mapping
Map your security posture against the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover). Produce a gap analysis, current/target tier assessment, and roadmap in the governance language that boards, auditors, and CISOs actually use.
Passed 20 of 25 test cases with the skill, and 16 of 25 without it.
and 2 more in the full report
4 fixed16 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
We need to evaluate our fintech startup's AWS production environment against the NIST CSF 2.0 standard for an upcoming board meeting. Can you generate a complete governance markdown report? Please include the assessment boundary, a high-level executive summary, a comparative table of implementation maturity tiers for all six core functions, a detailed subcategory tracking matrix listing our present capabilities, supporting evidence, gaps, and assigned accountability, plus a prioritized roadmap divided into 30-day, 90-day, and annual targets.
| Checked | Without skill | With skill |
|---|---|---|
| Includes all six core NIST CSF 2.0 functions in the function summary. | Passed | Passed |
| Includes the Tier column in the subcategory matrix. | Missed | Passed |
| Appends evidence cross-references at the end of the report. | Missed | Passed |
The instructions your model reads when the skill loads.
Translate your security posture into the language every CISO, board, auditor, and insurer already speaks. Distinct from the audit skills (which find specific issues); this skill assesses your program against a recognized framework and produces governance-ready output.
NIST CSF 2.0 is the framework that, as of 2024, replaced CSF 1.1. It added a sixth function — Govern — recognizing that the others can't work without governance backing.
The six functions:
| Function | What it covers |
|---|---|
| Govern (GV) | Cybersecurity strategy, roles, policies, oversight, supply chain risk |
| Identify (ID) | Asset inventory, business environment, risk assessment, supply chain |
| Protect (PR) | Access control, awareness, data security, baseline configurations, maintenance, protective tech |
| Detect (DE) | Continuous monitoring, anomaly detection, adverse event analysis |
| Respond (RS) | Incident management, analysis, mitigation, reporting, comms |
| Recover (RC) | Recovery planning, improvements, communications |
Each function contains Categories (e.g., PR.AA — Identity Management, Authentication, and Access Control), and each category contains Subcategories (e.g., PR.AA-01 — Identities and credentials for authorized users, services, and hardware are managed).
This skill maps your reality to those Subcategories.
Cross-references: every audit skill in this repo (they produce evidence that becomes the "current state" entries here), iam-audit (most of PR.AA), siem-detection (most of DE), incident-triage (most of RS), threat-modeling (informs ID.RA risk assessment), breach-patterns (informs ID.IM improvements from lessons learned).
CSF assessments are scope-bounded. Decide which of these you're assessing:
Write down what's in and what's out. Most CSF assessments fail at scope drift.
CSF 2.0 introduced Organizational Profiles — instead of "score every Subcategory equally," you tailor based on what matters.
test cases passed, vs 16 / 25 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.