anchor@anchor-cyber:~$ man nist-csf-2.0
Anchor Cyber Security
Anchor Cyber Security LLC

NIST CSF 2.0 — Field Reference

The functions, categories, tiers, and profile vocabulary you actually need mid-engagement — plus Anchor's own trust-but-verify audit loop, condensed.

$ csf --glossary

Vocabulary / 6 terms

Function
Top-level bucket of cybersecurity outcomes. There are 6: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER — all run concurrently, none is sequential.
Category
A named group of related outcomes within a Function. 22 total across the Core.
Subcategory
A specific, testable outcome statement. 106 total — the actual unit you rate as Implemented / Partial / Not Implemented.
Informative Ref.
A pointer from a Subcategory to an external control (SP 800-53, ISO 27001, CIS Controls) that would satisfy it.
Profile
A snapshot of which Subcategory outcomes matter and how well they're met, for one specific organization.
Tier
How systematic and risk-informed the org's cybersecurity governance process is — not a per-control maturity score.
$ csf --functions

The Six Functions / 22 categories · 106 subcategories

GV
Govern
Strategy, risk appetite, roles, policy, oversight, and supply chain risk. Informs the other five.
cat 6sub 31
ID
Identify
Know your assets, your risks, and where last time's fixes need following up.
cat 3sub 21
PR
Protect
Access control, training, data security, platform hardening, infra resilience.
cat 5sub 22
DE
Detect
Continuous monitoring and analysis of adverse events as they happen.
cat 2sub 11
RS
Respond
Manage, analyze, report on, and mitigate an incident once it's confirmed.
cat 4sub 13
RC
Recover
Execute and communicate the plan to restore capabilities and services.
cat 2sub 8
$ csf --categories -l

Category Map

CodeCategorySubcats
Govern — GV
GV.OCOrganizational Context5
GV.RMRisk Management Strategy7
GV.RRRoles, Responsibilities, and Authorities4
GV.POPolicy2
GV.OVOversight3
GV.SCCybersecurity Supply Chain Risk Management10
Identify — ID
ID.AMAsset Management7
ID.RARisk Assessment10
ID.IMImprovement4
Protect — PR
PR.AAIdentity Management, Authentication, and Access Control6
PR.ATAwareness and Training2
PR.DSData Security4
PR.PSPlatform Security6
PR.IRTechnology Infrastructure Resilience4
Detect — DE
DE.CMContinuous Monitoring5
DE.AEAdverse Event Analysis6
Respond — RS
RS.MAIncident Management5
RS.ANIncident Analysis4
RS.COIncident Response Reporting and Communication2
RS.MIIncident Mitigation2
Recover — RC
RC.RPIncident Recovery Plan Execution6
RC.COIncident Recovery Communication2
$ csf --tiers

Implementation Tiers / governance maturity, not a per-control score

01PartialAd hoc, reactive. Little org-wide awareness of cyber risk; no formal process.
02Risk InformedManagement approves practices, but they aren't yet organization-wide policy. Application is inconsistent.
03RepeatableFormally approved, written as policy, consistently applied, and updated as the threat landscape changes.
04AdaptiveAdapts from lessons learned and predictive/real-time indicators. Risk management is cultural, not procedural.
$ csf --profile --diff

Current vs. Target Profile

CURRENT

What the organization actually does today, Subcategory by Subcategory — evidence-backed, not aspirational.

TARGET

What should be true given mission, risk appetite, and obligations. Prioritized Low/Med/High — SP 1301 calls prioritization "the defining feature of a Profile."

$ anchor-audit --run

Anchor's Trust-but-Verify Loop / condensed from our internal audit methodology

  1. Independent access.Your own read access to the real systems — never the client's script output alone.
  2. Rebuild the asset inventory.From the live system, not from the org's own description of itself.
  3. Verify each Subcategory rating.Code review AND a live-behavior test — a policy that exists isn't the same as a policy that works.
  4. Independent risk scoring.Score before reading theirs. Reconcile after.
  5. Collect what fieldwork can't produce from a repo.Signed contracts, console configs, insurance policies — get the originals.
  6. Resolve legal exposure empirically.Don't ask if PHI/PII touched an unauthorized system — check.
  7. Delta report, not adoption.Diff your findings against any self-assessment; never just co-sign it.
  8. Re-verify remediation before closing it."Done" gets tested in production, by you, not taken on faith.