NIST CSF 2.0, proven with real evidence.
All 6 functions and 106 subcategories, each with its required evidence. Daily tests check your real stack, and AI drafts the policies. The same evidence counts toward SOC 2 and ISO 27001.
14-day free trial. No credit card.
See the 6 functionsSubcategories with evidence in place
Example106 subcategoriesTests re-run daily
6 / 6
functions covered
Every function, including Govern, which is new in CSF 2.0.
106
subcategories tracked
Every outcome across 22 categories, each tied to a daily test or to a policy or document.
1
evidence base
The same tests, policies and documents count toward SOC 2, ISO 27001, PCI DSS, HIPAA and more.
The 6 functions, each tied to real evidence.
CSF 2.0 groups 106 outcomes under 6 functions. Strac Comply covers every one. It uses daily tests where a system can prove the outcome, and policies and documents where it can't.
- GV31 subcategories
GovernNew in 2.0
Strategy, roles, policy, oversight and supply-chain risk (GV.SC). The evidence comes from your policy approvals and your vendor register.
- ID21 subcategories
Identify
Asset and risk inventory: devices from Jamf, Kandji or the Strac endpoint agent, plus your asset inventory and risk register.
- PR22 subcategories
Protect
Identity, access and data security. Daily tests on Okta, Google Workspace and AWS check MFA, encryption and least privilege.
- DE11 subcategories
Detect
Monitoring and adverse-event detection. GuardDuty, Security Hub and web firewall tests show that your monitoring is on.
- RS13 subcategories
Respond
Incident management, analysis and reporting: an incident response plan and a security incident log with dates.
- RC8 subcategories
Recover
Recovery plans and communications: disaster recovery and business continuity plans, with backup tests alongside.
How it works.
Connect your stack, close the gaps and hand your assessor the evidence. You don't need a consultant's spreadsheet.
- 1
Turn on NIST CSF 2.0
Pick it on its own or beside SOC 2, ISO 27001, PCI DSS, HIPAA and more. All 106 subcategories load with their required evidence.
- 2
Connect and test
Connect AWS, Google Workspace, Okta, GitHub and more. Tests run every day and count toward the subcategories they prove.
- 3
Close the gaps
AI drafts the policies and documents you are missing. Strac Comply lists every open item with its next step.
- 4
Share the evidence
Invite an assessor to their own portal by magic link, or send buyers your Trust portal.
You choose your tier. Strac Comply shows the evidence.
CSF uses 4 Implementation Tiers to describe how mature your risk practices are. You and your leadership choose your target tier. Strac Comply shows the facts behind that choice: which outcomes have their evidence in place today, and what is still open.
- See which of the 106 subcategories have their required evidence in place
- See every open item, with the next step for each
- Tests run every day, so a new gap shows up within a day
- Hand your assessor the evidence behind the tier you claim
- Tier 1
Partial
Ad hoc practices, applied case by case.
- Tier 2
Risk Informed
Risk-aware decisions, but practices vary by team.
- Tier 3
Repeatable
Formal policies applied the same way across the company.
- Tier 4
Adaptive
Practices that learn and improve from what you monitor.
The new Govern function, backed by records, not a template.
CSF 2.0 added Govern (31 subcategories) to make cybersecurity a leadership and supply-chain concern. Most tools answer it with a folder of template policies.
In Strac Comply, AI drafts your policies, and every approval carries a name and a date. Supply-chain risk (GV.SC) sits on your vendor register, where each vendor gets a risk score from a fixed, repeatable method. So “we govern third-party risk” comes with evidence.
See how GV.SC maps to Strac TPRMBeyond the spreadsheet. The evidence comes attached.
A NIST CSF spreadsheet tells you what to do. Strac Comply shows you what you have done, with the evidence attached.
| Capability | A spreadsheet | Strac Comply |
|---|---|---|
| Coverage | A row per subcategory | All 106 subcategories, each with its required evidence |
| The Govern function (GV) | Template policies | AI-drafted policies with recorded approvals |
| Evidence freshness | Screenshots taken once | Tests re-run daily on AWS, Google Workspace and Okta |
| Supply-chain risk (GV.SC) | A static vendor list | Vendor register with risk scores |
| Open items | Found when you re-read the sheet | Listed with the next step for each |
| Cross-framework reuse | Re-entered per framework | One test counts toward CSF, SOC 2 and ISO 27001 |
| Sharing | Email a folder | Auditor portal by magic link |
One test. Three frameworks.
CSF's Protect and Detect outcomes overlap heavily with SOC 2 and ISO 27001. One MFA test counts toward all three at once.
Okta + Google Workspace · MFA enforced
Counts toward
Frequently asked questions
What changed in NIST CSF 2.0 versus 1.1?
The big change is the new Govern function. It has 6 categories and 31 subcategories on strategy, roles, policy, oversight and supply-chain risk.
CSF 2.0 (February 2024) also widened from critical infrastructure to companies of every size. It added Implementation Examples and Quick-Start Guides.
The core is now 6 functions, 22 categories and 106 subcategories. Strac Comply covers the full 2.0 core.
Is NIST CSF mandatory?
No, it is voluntary. But many US enterprise buyers and cyber insurers ask vendors about it.
It is also a common first step toward NIST SP 800-53, CMMC or FedRAMP. Strac Comply keeps your evidence ready for those questions.
What are Implementation Tiers, and does Strac Comply score them?
Tiers describe how mature your cybersecurity risk practices are: Partial (1), Risk Informed (2), Repeatable (3) and Adaptive (4).
Strac Comply does not score your tier. You and your leadership choose it. Strac Comply shows the evidence behind that choice: which subcategories have their evidence in place, and what is still open.
How does NIST CSF map to SOC 2 and ISO 27001?
Closely. CSF’s Protect and Detect outcomes overlap heavily with SOC 2’s Common Criteria and ISO 27001 Annex A. In Strac Comply, a single MFA, logging or encryption test counts toward all 3, so you collect it once.
Do you cover the Govern function’s supply-chain outcomes (GV.SC)?
Yes. GV.SC sits on your vendor register.
Strac finds the apps your team signed into, including AI tools. Each vendor gets a risk score from a fixed, repeatable method. Strac Comply records every manual change and the reason for it.
See where you stand on NIST CSF 2.0.
Connect your systems. See which of the 106 subcategories have their evidence in place, and what to do about the rest.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing · Browse integrations