NIST CSF

The NIST Cybersecurity Framework organizes cybersecurity outcomes into Functions, Categories and Subcategories. Pentr's YAML declares it as name NIST Cybersecurity Framework, version 2.0. Its controls are CSF 2.0 Categories, such as PR.AA and DE.CM, not Subcategories.

Controls¶

The Categories the YAML declares, and the tables that reach each one. The Reached by column is explained on Frameworks.

Control	Name	Reached by
GV.PO	Policy	none
ID.AM	Asset Management	ATT&CK
ID.RA	Risk Assessment	ATT&CK, keywords
PR.AA	Identity Management, Authentication, and Access Control	ATT&CK, WSTG, keywords
PR.DS	Data Security	ATT&CK, WSTG, keywords
PR.PS	Platform Security	ATT&CK, WSTG, keywords
PR.IR	Technology Infrastructure Resilience	ATT&CK, keywords
DE.CM	Continuous Monitoring	none
RS.MA	Incident Management	none

GV.PO, DE.CM and RS.MA read none: no table lists them, so each is reported not_tested on every run.

ATT&CK technique mappings¶

Each ATT&CK technique id in the framework's table and the Categories it maps to. A finding tagged with one of these ids maps to every Category in its row.

Technique	Controls
T1190	PR.PS, ID.RA
T1078	PR.AA
T1059	PR.PS
T1068	PR.AA
T1110	PR.AA
T1003	PR.AA, PR.DS
T1046	ID.AM, PR.IR
T1018	ID.AM
T1021	PR.AA
T1083	PR.AA

WSTG mappings¶

Each WSTG id in the framework's table and the Categories it maps to. A finding tagged with one of these ids maps to every Category in its row.

WSTG id	Controls
WSTG-INPV-05	PR.PS
WSTG-INPV-01	PR.PS
WSTG-INPV-02	PR.PS
WSTG-ATHN-04	PR.AA
WSTG-ATHN-01	PR.DS
WSTG-IDNT-04	PR.AA
WSTG-CRYP-01	PR.DS
WSTG-CONF-01	PR.PS
WSTG-CONF-02	PR.PS
WSTG-ATHZ-01	PR.AA
WSTG-SESS-02	PR.AA
WSTG-ERRH-01	PR.PS

What Pentr does not attest to¶

• tested means at least one finding mapped to the Category. It does not mean the Category was assessed, met or failed. A mapping made by the keyword step can attach a Category the finding does not bear on; see Frameworks.
• not_tested means no finding mapped to the Category. It does not mean the Category passed, and it says nothing about whether the Category is in place.
• The mapping tables are Pentr's, written for the application. They are not published by NIST.
• A Category that the YAML does not declare has no row in the report.
• A Pentr report does not establish a CSF Profile or Tier, and it is not an audit opinion.

The product page for this framework is NIST CSF.