We use NIST CSF as our model but get certified on ISO 27001.
Fix: Adopt both in Comply. One measure counts for each requirement it meets, so the ISO 27001 work shows on NIST CSF too.
See the mappingNIST CSF
NIST CSF software
NIST CSF is your map. Acuna GRC shows where you stand on it.
Acuna GRC puts NIST CSF next to the other frameworks you run, rates how mature you are on each part and gives every gap an owner. The work you do for ISO 27001 counts again.
1 · PICK YOUR FRAMEWORKS4 adopted
✓ISO/IEC 27001:2022Adopted
✓NIS2 DirectiveAdoptAdopted
✓FINMA Circular 2023/1Adopted
✓NIST CSF 2.0Adopted
2 · CLOSE THE GAPSApply selected
Orphan requirements4112Aiko proposes
✓Backup and disaster recoveryLinked
✓ICT readiness for continuityLinked
3 · FOLLOW THE ROADMAPISO 27001
SupportLeft to do: 94
✓Context and leadershipDone
✓Planning and riskDone
What NIST CSF asks
What is NIST CSF? A map of cybersecurity outcomes.
The NIST Cybersecurity Framework is a voluntary set of cybersecurity outcomes from the US National Institute of Standards and Technology. You use it to say where you stand today, where you want to be and what closes the gap.
Six functions
In CSF 2.0, Govern, Identify, Protect, Detect, Respond and Recover group the outcomes, from strategy and oversight to recovery.
Profiles
A current profile says where you stand on each outcome; a target profile says where you want to be.
Tiers
Tiers describe how rigorous your cybersecurity risk governance and management practices are.
Does this sound like you?
Why does NIST CSF stay on a slide? It lives apart from the real work.
Most teams use NIST CSF as their model and run the actual controls for another framework. The time goes into keeping the two in step and rebuilding the maturity scores each year.
Our maturity scores live in a slide.
Fix: Rate each NIST CSF item on maturity in an evaluation, frozen on the day it is answered and reviewed item by item.
See the maturity ratingNobody owns the gaps.
Fix: Give each requirement, measure and control an owner, and watch health roll up from the controls.
See owners and healthHow Acuna GRC covers it
What does NIST CSF software need to do? Map it, rate it, run it.
Acuna GRC runs NIST CSF in Comply, Evaluations, Implement and Assure: Comply maps it to your other frameworks, Evaluations rates your maturity, Implement gives every gap an owner and Assure keeps the proof.
01 · Comply
Can we map NIST CSF to ISO 27001 and NIS2?
Yes. Adopt NIST CSF in Comply next to ISO 27001 and NIS2. Common Measures are mapped across frameworks, so one measure counts for each requirement it meets, and Mapping lists the NIST CSF requirements with no measure yet.
See Comply →02 · Evaluations
How do we rate our maturity?
Run an evaluation on the NIST CSF requirements and rate each item on maturity, compliance or both. The item list is frozen at launch, every answer is reviewed, and the gap report shows how much meets its target, domain by domain. Apply as baseline writes the validated answers into live compliance and maturity.
See Evaluations →03 · Implement
How do we give every gap an owner?
Each requirement and measure in Implement has an owner, a person or a role, and each control that checks it has a schedule. Health rolls up from controls to measures to requirements, and the weakest link sets the score, so a gap cannot hide.
See Implement →04 · Assure
How do we keep the proof?
Records show each control ran, KPIs follow your targets over time, and reports generated from templates export as PDF or Excel for management.
See Assure →Aiko at your pace
Can AI map NIST CSF to our existing measures? Aiko proposes. You confirm.
In Mapping, Run AI ranks the best measures from your own library for each NIST CSF requirement with no measure, each with a confidence score and a reason. Nothing is linked until you apply it.
1Aiko proposes
Run AI · from your libraryVulnerability assessments and testingFINMA Circular 2023/1 · No measure linked✓Vulnerability scanningCovers scanning and fixing weak spots.94✓Annual penetration testCovers outside testing, not scanning.612You confirm
You tick what is rightApply selected✓Linked, with its reasonOrphan requirements41403You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
Bulk runs for the rest
Ask Aiko which controls have no measure, and it plans every missing link on its own page. Nothing is linked until you click Apply.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Can experts assess where we stand on NIST CSF? Yes, with a gap assessment.
Our experts run a NIST CSF gap assessment with your team in Acuna GRC, then help you plan the measures that are missing.
Cybersecurity governance expert
Jean-Emmanuel Rodriguez
Gap analysis and framework implementation
GRC Consulting team leader
Bénédicte Sévin
GRC project leadership.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with youGap assessments
Guidance, reviews and audit preparation with your team.
Done for you
Our experts run it. You review.
Gap assessment, done with you
- Rate where you stand on NIST CSF
- Find what your ISO 27001 work already covers
- Plan the gaps with owners
Integrations
Can Acuna GRC collect evidence from our tools? Yes, with 100+ connectors.
Connectors pull security data from your identity, device, cloud, backup and training tools on a schedule, so control values stay current without a manual step.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra ID
Okta
Google Workspace
Intune
Jamf Pro
CrowdStrike
Defender
AWS
Azure
Google Cloud
Microsoft 365
GitHub
Acronis
KnowBe4
Jira- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Which parts of Acuna GRC run NIST CSF? The core, with Evaluations for maturity.
NIST CSF runs in the core workspaces, with Evaluations to rate your maturity. Add TPRM and Vulnerability management as you need them.
Acuna GRC core
Add-on modules
Across the platform
NIST CSF connects to
- ComplyAdopt NIST CSF, reuse your measures
- EvaluationsMaturity rated and reviewed
- ImplementOwners, controls and health
- AssureRecords, KPIs and reports
- OperateRisks and treatment plans
- TPRM (Supplier Shield)Supplier questionnaires and grades
- Vulnerability managementVulnerabilities followed to a fix
- AikoRanks the missing links
FAQ
What else do buyers ask about NIST CSF software?
Is NIST CSF only for US companies?
No. It is voluntary and used by organizations of every size and country, often as a reference model next to ISO 27001.
Can we get certified on NIST CSF?
There is no NIST CSF certificate. Many teams use it as their model and get certified on ISO 27001; Acuna GRC runs both from one measure library. ISO 27001 compliance software
How does one measure count for several frameworks?
Each reference measure is mapped to the requirements it meets in every framework you adopt, so linking it once covers them all. What is cross-framework control mapping?
Where is our data hosted?
In Switzerland, the EU or the US, as you choose.
Using NIST CSF? Start with one step.
Tell us the frameworks you run next to it. We show you NIST CSF in Acuna GRC, and how our experts can assess where you stand.
Hosted in Switzerland, the EU or the US