NIST CSF 2.0, run as
continuous outcomes.
All 6 functions and 106 subcategories mapped to live tests against your real stack. Track your Implementation Tier from Current to Target Profile, and reuse the same evidence for SOC 2 and ISO 27001.
The 6 functions, each tied to real evidence
CSF 2.0 organizes 106 outcomes under 6 functions. Strac maps every one — automatable outcomes run as continuous tests, the rest as pre-mapped policy and document evidence.
GovernNew in 2.0
Strategy, roles, policy, oversight, and supply-chain risk (GV.SC) — mapped to your policy approvals and a live vendor register.
Identify
Asset, data, and risk inventory — driven by continuous discovery across AWS, endpoints (Jamf), and SaaS, not a one-time questionnaire.
Protect
Identity, access, and data security — MFA, encryption, and least-privilege validated by daily tests on Okta, Google Workspace, and AWS.
Detect
Continuous monitoring and adverse-event detection — CloudTrail and audit-log coverage proven, not assumed.
Respond
Incident management, analysis, and reporting — playbooks with evidence capture and third-party coordination (RS.MA).
Recover
Recovery plan execution and communications — DR/BCP documentation and AWS Backup posture tied to RC.RP.
How it works
From a Target Profile to a board-ready tier report — without the consultant spreadsheet.
Set your Target Profile
Pick your target tier per function based on your risk tolerance, sector, and regulatory obligations.
Connect & test
Connect AWS, Google Workspace, Okta, GitHub, and more. Continuous tests map to CSF subcategories automatically.
Track Current Profile
Your Current Profile and per-function tier are scored from live evidence — gaps surface as they happen.
Report the maturity
Export a tier heatmap and a CSF binder for the board, an assessor, or your cyber-insurance renewal.
Track your tier from Partial to Adaptive.
CSF isn't a checkbox standard — it's a maturity model. Strac scores your Current Profile against your Target across all four Implementation Tiers, per function, from live evidence. That is the view a board and a cyber-insurer actually ask for — and the one a flat control checklist can't give them.
- Set a Target Profile and per-function target tier
- Current Profile scored continuously from real test + policy evidence
- Gap-to-target surfaced per function, not buried in a 106-row sheet
- Export a tier heatmap for the board and your cyber-insurance renewal
Ad-hoc, inconsistent practices in pockets across the organization.
Risk-aware decisions, but practices vary by team and aren’t enterprise-wide.
Formalized policies and controls applied consistently, with stable governance.
Continuous monitoring and learning; automation drives proactive improvement.
The headline change in CSF 2.0
The new Govern function is real evidence here — not a policy PDF.
CSF 2.0 added Govern (31 subcategories) to make cybersecurity a board-level and supply-chain concern. Most tools answer it with a template policy library. Strac maps GV to live artifacts: roles and oversight to your org + policy approvals, and supply-chain risk (GV.SC) to a continuously-scored vendor register — so “we govern third-party risk” is provable, not just asserted.
See how GV.SC maps to Strac TPRMBeyond the framework tab
For Vanta and Drata, NIST CSF is one more checklist bolted onto a SOC 2 dashboard. Strac runs it as the maturity model it actually is.
Frequently asked
What changed in NIST CSF 2.0 versus 1.1?
The headline change is the new Govern function (6 categories, 31 subcategories) elevating cybersecurity to enterprise governance and supply-chain risk. CSF 2.0 (February 2024) also broadened from critical infrastructure to organizations of every size and sector, added Implementation Examples and Quick-Start Guides, and is now structured as 6 functions / 22 categories / 106 subcategories. Strac maps the full 2.0 core.
Is NIST CSF mandatory?
No — CSF is voluntary. But it has become the de facto baseline for U.S. enterprise security and a stepping stone toward FedRAMP, CMMC, and NIST SP 800-53. Enterprise customers and cyber-insurers increasingly ask vendors to attest against it, and Strac gives you the continuous evidence to answer in days.
What are Implementation Tiers, and do we pick one?
Tiers describe how mature and consistent your cybersecurity risk practices are: Partial (1), Risk Informed (2), Repeatable (3), Adaptive (4). You set a Target Profile and per-function target tier; Strac scores your Current Profile from live evidence and shows the gap — the maturity view boards and insurers actually want.
How does NIST CSF map to SOC 2 and ISO 27001?
Closely. CSF’s Protect and Detect subcategories overlap heavily with SOC 2’s Common Criteria and ISO 27001 Annex A. Strac maintains the cross-framework mapping so a single MFA, logging, or encryption test counts toward all three — one evidence base, no duplicate work.
Do you cover the Govern function’s supply-chain outcomes (GV.SC)?
Yes. GV.SC maps to Strac TPRM — third-party discovery (including shadow AI), a deterministic vendor risk engine, and continuous monitoring — so your supply-chain governance is backed by live evidence, not a spreadsheet.
Know your tier. Prove your outcomes.
See your NIST CSF 2.0 Current Profile scored from real evidence — and a clear path to your Target tier.