Map NIST Frameworks and Automate Security Compliance

This skill maps security controls, conducts gap analyses, and builds implementation roadmaps across NIST CSF 2.0, SP 800-53 Rev 5, and the Risk Management Framework. It's organized around the six NIST CSF 2.0 functions - Govern, Identify, Protect, Detect, Respond, and Recover - and provides a control-mapping methodology that links a CSF subcategory (for example, asset inventory under Identify) to its corresponding 800-53 controls and implementation guidance.

Gap analysis uses a four-level maturity model - Partial (ad hoc, reactive), Risk Informed (approved but not enterprise-wide), Repeatable (organization-wide with regular updates), and Adaptive (continuous improvement from lessons learned) - scored 1 through 4, feeding a gap-scoring function that compares current and target maturity per subcategory to prioritize work. Implementation roadmaps follow three phases: Foundation (3-6 months, covering governance context, asset management, access control, and anomaly detection), Enhancement (6-9 months, covering data security, continuous monitoring, analysis, and recovery planning), and Optimization (9-12 months, covering supply chain security, protective technology, containment, and stakeholder communication), each with named focus areas, key controls, and success metrics.

It also covers cross-framework mapping (translating a single NIST CSF control into its ISO 27001, SOC 2, CIS Controls, and COBIT equivalents), quantitative risk scoring using the NIST 800-30 methodology (a 5x5 likelihood-times-impact matrix), a control-implementation documentation template (control statement, implementation guidance, CSF mapping, and an implementation-status checklist), and executive dashboard metrics (overall and per-function maturity scores, high-priority gap count, controls implemented versus planned, and risk-reduction percentage).

def assess_csf_gap(current_state, target_state, subcategory):
    gap_analysis = {
        "subcategory": subcategory,
        "current_maturity": current_state,
        "target_maturity": target_state,
        "gap_score": target_state - current_state,
        "priority": calculate_priority(gap_score, business_impact),
        "effort_estimate": estimate_implementation_effort(gap_score)
    }
    return gap_analysis

Use this skill at the framework and program level - deciding what to implement and in what order - not for writing the technical configuration of an individual control. The worked example (control AC-2, Account Management) illustrates the line: this skill produces the control statement, the CSF mapping, and an implementation-status checklist, but the actual technical steps - defining privileged/non-privileged/guest/emergency account types, deploying automated identity-governance tooling, running quarterly access certification, and logging account creation/modification/deletion events - are what the checklist tracks, not what this skill generates for you.

It is not a fit for hands-on technical implementation of individual controls for that same reason - it maps, scores, and roadmaps controls at the framework level.

Inputs are your current control implementation status and target maturity level per CSF subcategory. Outputs are a control-mapping table (CSF to 800-53 and other frameworks), a gap analysis with priority and effort estimates, a phased 3-6-9-12-month implementation roadmap, quantitative risk scores, a control-implementation documentation template like the AC-2 example (control statement, four-point implementation guidance, CSF mapping, and a status checklist), and an executive dashboard of maturity and compliance metrics.

Security and compliance teams implementing or auditing against NIST cybersecurity frameworks who need concrete control-mapping, gap-scoring, and roadmap templates - following the eight best practices of starting with governance, risk-based prioritization, continuous monitoring, supply chain integration, addressing organizational culture alongside technical controls, and keeping documentation and framework assessments current.