NIST Cybersecurity Framework 2.0

Very few organizations in the region are required to adopt the CSF. Its value here is different: it is an unusually good translation layer.

A GCC organization typically runs a national control set, an international management-system standard, and a sector framework. Those three describe the same underlying practice in three vocabularies. Because the CSF is outcome-based rather than control-based, it maps cleanly onto all of them, which makes it a useful spine for reasoning about coverage across the set.

It is also the vocabulary an international board, a group parent or a cyber insurer is most likely to already speak, which makes it a practical way to report a Gulf programme upward without re-explaining the local framework each time.

NIST CSF 2.0 is planned for the TrustPoint library and is not available yet.

Once it is available, it will be assessed like any other framework in the platform: requirement by requirement, with evidence from the managed store, gaps carried onto a roadmap and results readable through the audience report templates or the OData feed.

Because Govern is now an explicit function, the Governance module carries more of the CSF than it did under version 1.1. The org tree, the perimeters, the policy lifecycle and the attestation records are the evidence for a meaningful part of that function.

The CSF is often used as a common vocabulary across ISO/IEC 27001, NCA ECC, CBO CS&RF and PCI DSS. TrustPoint does not yet include mapping sets between NIST CSF and those frameworks.

When mapping sets exist, each relationship is recorded (equal, subset, superset, intersecting or related) and suggestions are surfaced for review rather than applied silently. An outcome-based framework maps to a control-based one imperfectly by nature, and pretending otherwise is how a mapping saving turns into an audit finding.