NIST CSF 2.0 Compliance Checker

Govern is unassigned. The newest Function is the one most often left without an owner — organisational context, risk management strategy, roles and responsibilities, policy, oversight, and cybersecurity supply chain risk management. If no named person owns GV, the answer to every governance subcategory is aspirational.

Asset inventory is partial, so Identify is overstated. You cannot protect what you have not enumerated. Cloud accounts, SaaS, shadow IT, third-party integrations, and medical devices on the clinical network are the usual omissions — and medical devices are the ones with the longest patch latency.

Detect is thin relative to Protect. Most organisations invest heavily in preventive controls and then have no continuous monitoring, no baseline of normal, and no defined adverse-event analysis process. Dwell time in healthcare breaches is measured in weeks for exactly this reason.

Recover has never been exercised. Backups exist; restoration has not been timed. A recovery plan that has not been tested against a realistic ransomware scenario is an assumption, not a capability — and recovery time is the variable that decides whether an incident becomes a patient-safety event.

Supply chain risk management stops at the contract. GV.SC expects tiering of suppliers by criticality, security requirements written into agreements, and ongoing monitoring. Signing a BAA and filing it is not supply chain risk management.

Tiers are confused with maturity scores. Implementation Tiers 1 to 4 describe how rigorously cybersecurity risk governance is applied, not a grade. Reporting 'we are Tier 3' without a Current and Target Profile behind it tells a board nothing actionable.

Assign an owner for the Govern Function this week. It is the cheapest gap on the list to close and the one that unblocks the rest, because policy and risk-strategy decisions gate the other five Functions.

Build a Current Profile and a Target Profile. CSF is designed to be used as a gap between where you are and where you intend to be, prioritised by your own risk appetite — not as a score to maximise uniformly.

Complete the asset inventory before trusting any Identify score. Include cloud, SaaS, third parties and networked clinical devices. Most Identify gaps are inventory gaps wearing a different label.

Map your existing HIPAA Security Rule work onto CSF subcategories. The overlap is substantial, and the mapping usually reveals that you have more evidence than your score suggests — plus a small number of genuine blind spots.

Run a recovery exercise with a real time target. Restore a production-representative system from backup, measure how long it takes, and document what failed. That number is the single most useful output of this whole assessment.