← All checklists
NIST CSF 2.0 readiness checklist
The NIST CSF 2.0 outcomes an organization should be able to show across Govern, Identify, Protect, Detect, Respond and Recover, mapped to their subcategory ID, with the evidence a reviewer will ask for. Preview 15 of the 93 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers NIST CSF 2.0Reviewed 30 Oct 202693 items · 9 sections
Govern: context, risk strategy and roles
13 items
- GV.OC-01Understand the organizational mission and use it to guide cybersecurity risk decisions.Evidence: Security strategy that references the mission and business priorities.
- GV.OC-02Identify internal and external stakeholders and understand what they expect on cybersecurity risk.Evidence: Stakeholder map with their security expectations.
Govern: policy, oversight and supply chain
12 items
- GV.PO-01Set a cybersecurity risk management policy based on context, strategy and priorities, then communicate and enforce it.Evidence: Approved policy set with distribution records.
- GV.PO-02Review, update, communicate and enforce the policy when requirements, threats, technology or the mission change.Evidence: Policy version history with review dates.
Identify: assets and improvement
10 items
- ID.AM-01Keep an inventory of hardware managed by the organization.Evidence: Hardware inventory export with owners.
- ID.AM-02Keep an inventory of software, services and systems managed by the organization.Evidence: Software and SaaS inventory.
Identify: risk assessment
9 items
- ID.RA-01Identify, validate and record vulnerabilities in assets.Evidence: Vulnerability scan reports and tracker.
Protect: identity, access and awareness
7 items
- PR.AA-01Manage identities and credentials for authorized users, services and hardware.Evidence: Identity provider user and service account lists.
Protect: data, platforms and resilience
10 items
- PR.DS-01Protect the confidentiality, integrity and availability of data at rest.Evidence: Storage and database encryption settings.
- PR.DS-02Protect the confidentiality, integrity and availability of data in transit.Evidence: TLS configuration and certificate inventory.
Detect: monitoring and analysis
11 items
- DE.CM-01Monitor networks and network services to find potentially adverse events.Evidence: Network monitoring or IDS coverage and sample alerts.
- DE.CM-02Monitor the physical environment to find potentially adverse events.Evidence: Camera, alarm and access monitoring records.
Respond: incident management
13 items
- RS.MA-01Run the incident response plan together with relevant third parties once an incident is declared.Evidence: Incident records showing plan activation.
- RS.MA-02Triage and validate incident reports.Evidence: Triage notes on incident tickets.
Recover: restoration and communication
8 items
- RC.RP-01Run the recovery part of the incident response plan once it is triggered.Evidence: Recovery records from recent incidents or exercises.
Changelog
- v1.030 Oct 2026First release. Covers NIST CSF 2.0 (February 2024), with selected subcategories from all six functions.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.