CLAIMBOUND / SOURCE-PUBLICATION EVIDENCE
Cybersecurity
Every card identifies what it proves, what it does not prove, its exact quote, locator, source hash, and local rerun command.
1. NIST Cybersecurity Framework 2.0 · PDF page 2
Narrow public claim
Abstract The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 2- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Abstract The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks.
2. NIST Cybersecurity Framework 2.0 · PDF page 2
Narrow public claim
It offers a taxonomy of highlevel cybersecurity outcomes that can be used by any organization — regardless of its size, sector, or maturity — to better understand, assess, prioritize, and communicate its cybersecurity efforts.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 2- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
It offers a taxonomy of highlevel cybersecurity outcomes that can be used by any organization — regardless of its size, sector, or maturity — to better understand, assess, prioritize, and communicate its cybersecurity efforts.
3. NIST Cybersecurity Framework 2.0 · PDF page 2
Narrow public claim
Rather, it links to online resources that provide additional guidance on practices and controls that could be used to achieve those outcomes.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 2- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Rather, it links to online resources that provide additional guidance on practices and controls that could be used to achieve those outcomes.
4. NIST Cybersecurity Framework 2.0 · PDF page 2
Narrow public claim
Before version 2.0, the Cybersecurity Framework was called the “Framework for Improving Critical Infrastructure Cybersecurity.” This title is not used for CSF 2.0.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 2- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Before version 2.0, the Cybersecurity Framework was called the “Framework for Improving Critical Infrastructure Cybersecurity.” This title is not used for CSF 2.0.
5. NIST Cybersecurity Framework 2.0 · PDF page 3
Narrow public claim
Acknowledgments The CSF is the result of a multi-year collaborative effort across industry, academia, and government in the United States and around the world.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 3- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Acknowledgments The CSF is the result of a multi-year collaborative effort across industry, academia, and government in the United States and around the world.
6. NIST Cybersecurity Framework 2.0 · PDF page 3
Narrow public claim
Lessons learned about the use of the CSF can always be shared with NIST at cyberframework@nist.gov.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 3- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Lessons learned about the use of the CSF can always be shared with NIST at cyberframework@nist.gov.
7. NIST Cybersecurity Framework 2.0 · PDF page 5
Narrow public claim
Preface The Cybersecurity Framework (CSF) 2.0 is designed to help organizations of all sizes and sectors — including industry, government, academia, and nonprofit — to manage and reduce their cybersecurity risks.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 5- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Preface The Cybersecurity Framework (CSF) 2.0 is designed to help organizations of all sizes and sectors — including industry, government, academia, and nonprofit — to manage and reduce their cybersecurity risks.
8. NIST Cybersecurity Framework 2.0 · PDF page 5
Narrow public claim
Each organization has both common and unique risks, as well as varying risk appetites and tolerances, specific missions, and objectives to achieve those missions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 5- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Each organization has both common and unique risks, as well as varying risk appetites and tolerances, specific missions, and objectives to achieve those missions.
9. NIST Cybersecurity Framework 2.0 · PDF page 5
Narrow public claim
Ideally, the CSF will be used to address cybersecurity risks alongside other risks of the enterprise, including those that are financial, privacy, supply chain, reputational, technological, or physical in nature.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 5- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Ideally, the CSF will be used to address cybersecurity risks alongside other risks of the enterprise, including those that are financial, privacy, supply chain, reputational, technological, or physical in nature.
10. NIST Cybersecurity Framework 2.0 · PDF page 5
Narrow public claim
The CSF describes desired outcomes that are intended to be understood by a broad audience, including executives, managers, and practitioners, regardless of their cybersecurity expertise.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 5- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The CSF describes desired outcomes that are intended to be understood by a broad audience, including executives, managers, and practitioners, regardless of their cybersecurity expertise.
11. NIST Cybersecurity Framework 2.0 · PDF page 6
Narrow public claim
It includes the following components: • CSF Core, the nucleus of the CSF, which is a taxonomy of high-level cybersecurity outcomes that can help any organization manage its cybersecurity risks.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 6- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
It includes the following components: • CSF Core, the nucleus of the CSF, which is a taxonomy of high-level cybersecurity outcomes that can help any organization manage its cybersecurity risks.
12. NIST Cybersecurity Framework 2.0 · PDF page 6
Narrow public claim
These outcomes can be understood by a broad audience, including executives, managers, and practitioners, regardless of their cybersecurity expertise.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 6- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
These outcomes can be understood by a broad audience, including executives, managers, and practitioners, regardless of their cybersecurity expertise.
13. NIST Cybersecurity Framework 2.0 · PDF page 6
Narrow public claim
Tiers can also provide context for how an organization views cybersecurity risks and the processes in place to manage those risks.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 6- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Tiers can also provide context for how an organization views cybersecurity risks and the processes in place to manage those risks.
14. NIST Cybersecurity Framework 2.0 · PDF page 6
Narrow public claim
Descriptions of how an organization can achieve those outcomes are provided in a suite of online resources that complement the CSF and are available through the NIST CSF website.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 6- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Descriptions of how an organization can achieve those outcomes are provided in a suite of online resources that complement the CSF and are available through the NIST CSF website.
15. NIST Cybersecurity Framework 2.0 · PDF page 7
Narrow public claim
The CSF is designed to be used by organizations of all sizes and sectors, including industry, government, academia, and nonprofit organizations, regardless of the maturity level of their cybersecurity programs.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 7- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The CSF is designed to be used by organizations of all sizes and sectors, including industry, government, academia, and nonprofit organizations, regardless of the maturity level of their cybersecurity programs.
16. NIST Cybersecurity Framework 2.0 · PDF page 7
Narrow public claim
The CSF should be used in conjunction with other resources (e.g., frameworks, standards, guidelines, leading practices) to better manage cybersecurity risks and inform the overall management of information and communications technology (ICT) risks at an enterprise level.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 7- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The CSF should be used in conjunction with other resources (e.g., frameworks, standards, guidelines, leading practices) to better manage cybersecurity risks and inform the overall management of information and communications technology (ICT) risks at an enterprise level.
17. NIST Cybersecurity Framework 2.0 · PDF page 7
Narrow public claim
Organizations will continue to have unique risks — including different threats and vulnerabilities — and risk tolerances, as well as unique mission objectives and requirements.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 7- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Organizations will continue to have unique risks — including different threats and vulnerabilities — and risk tolerances, as well as unique mission objectives and requirements.
18. NIST Cybersecurity Framework 2.0 · PDF page 8
Narrow public claim
The structure of the Core is intended to resonate most with those charged with operationalizing risk management within an organization.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 8- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The structure of the Core is intended to resonate most with those charged with operationalizing risk management within an organization.
19. NIST Cybersecurity Framework 2.0 · PDF page 8
Narrow public claim
CSF Core structure The CSF Core Functions — GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER — organize cybersecurity outcomes at their highest level. • GOVERN (GV) — The organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 8- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
CSF Core structure The CSF Core Functions — GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER — organize cybersecurity outcomes at their highest level. • GOVERN (GV) — The organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.
20. NIST Cybersecurity Framework 2.0 · PDF page 8
Narrow public claim
The GOVERN Function provides outcomes to inform what an organization may do to achieve and prioritize the outcomes of the other five Functions in the context of its mission and stakeholder expectations.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 8- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The GOVERN Function provides outcomes to inform what an organization may do to achieve and prioritize the outcomes of the other five Functions in the context of its mission and stakeholder expectations.
21. NIST Cybersecurity Framework 2.0 · PDF page 8
Narrow public claim
Governance activities are critical for incorporating cybersecurity into an organization’s broader enterprise risk management (ERM) strategy.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 8- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Governance activities are critical for incorporating cybersecurity into an organization’s broader enterprise risk management (ERM) strategy.
22. NIST Cybersecurity Framework 2.0 · PDF page 9
Narrow public claim
Once assets and risks are identified and prioritized, PROTECT supports the ability to secure those assets to prevent or lower the likelihood and impact of adverse cybersecurity events, as well as to increase the likelihood and impact of taking advantage of opportunities.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 9- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Once assets and risks are identified and prioritized, PROTECT supports the ability to secure those assets to prevent or lower the likelihood and impact of adverse cybersecurity events, as well as to increase the likelihood and impact of taking advantage of opportunities.
23. NIST Cybersecurity Framework 2.0 · PDF page 9
Narrow public claim
Outcomes covered by this Function include identity management, authentication, and access control; awareness and training; data security; platform security (i.e., securing the hardware, software, and services of physical and virtual platforms); and the resilience of technology infrastructure. • DETECT (DE) — Possible cybersecurity attacks and compromises are found and analyzed.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 9- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Outcomes covered by this Function include identity management, authentication, and access control; awareness and training; data security; platform security (i.e., securing the hardware, software, and services of physical and virtual platforms); and the resilience of technology infrastructure. • DETECT (DE) — Possible cybersecurity attacks and compromises are found and analyzed.
24. NIST Cybersecurity Framework 2.0 · PDF page 9
Narrow public claim
DETECT enables the timely discovery and analysis of anomalies, indicators of compromise, and other potentially adverse events that may indicate that cybersecurity attacks and incidents are occurring.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 9- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
DETECT enables the timely discovery and analysis of anomalies, indicators of compromise, and other potentially adverse events that may indicate that cybersecurity attacks and incidents are occurring.
25. NIST Cybersecurity Framework 2.0 · PDF page 9
Narrow public claim
This Function supports successful incident response and recovery activities. • RESPOND (RS) — Actions regarding a detected cybersecurity incident are taken.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 9- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This Function supports successful incident response and recovery activities. • RESPOND (RS) — Actions regarding a detected cybersecurity incident are taken.
26. NIST Cybersecurity Framework 2.0 · PDF page 10
Narrow public claim
Actions that support GOVERN, IDENTIFY, PROTECT, and DETECT should all happen continuously, and actions that support RESPOND and RECOVER should be ready at all times and happen when cybersecurity incidents occur.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 10- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Actions that support GOVERN, IDENTIFY, PROTECT, and DETECT should all happen continuously, and actions that support RESPOND and RECOVER should be ready at all times and happen when cybersecurity incidents occur.
27. NIST Cybersecurity Framework 2.0 · PDF page 10
Narrow public claim
Each Function is divided into Categories, which are related cybersecurity outcomes that collectively comprise the Function.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 10- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Each Function is divided into Categories, which are related cybersecurity outcomes that collectively comprise the Function.
28. NIST Cybersecurity Framework 2.0 · PDF page 11
Narrow public claim
CSF Profiles A CSF Organizational Profile describes an organization’s current and/or target cybersecurity posture in terms of the Core’s outcomes.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 11- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
CSF Profiles A CSF Organizational Profile describes an organization’s current and/or target cybersecurity posture in terms of the Core’s outcomes.
29. NIST Cybersecurity Framework 2.0 · PDF page 11
Narrow public claim
Organizational Profiles are used to understand, tailor, assess, prioritize, and communicate the Core’s outcomes by considering an organization’s mission objectives, stakeholder expectations, threat landscape, and requirements.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 11- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Organizational Profiles are used to understand, tailor, assess, prioritize, and communicate the Core’s outcomes by considering an organization’s mission objectives, stakeholder expectations, threat landscape, and requirements.
30. NIST Cybersecurity Framework 2.0 · PDF page 11
Narrow public claim
An organization can then prioritize its actions to achieve specific outcomes and communicate that information to stakeholders.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 11- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
An organization can then prioritize its actions to achieve specific outcomes and communicate that information to stakeholders.
31. NIST Cybersecurity Framework 2.0 · PDF page 11
Narrow public claim
3 and summarized below illustrate one way that an organization could use an Organizational Profile to help inform continuous improvement of its cybersecurity.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 11- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
3 and summarized below illustrate one way that an organization could use an Organizational Profile to help inform continuous improvement of its cybersecurity.
32. NIST Cybersecurity Framework 2.0 · PDF page 12
Narrow public claim
For example, a Profile could address an entire organization or be scoped to an organization’s financial systems or to countering ransomware threats and handling ransomware incidents involving those financial systems.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 12- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For example, a Profile could address an entire organization or be scoped to an organization’s financial systems or to countering ransomware threats and handling ransomware incidents involving those financial systems.
33. NIST Cybersecurity Framework 2.0 · PDF page 12
Narrow public claim
Examples of information may include organizational policies, risk management priorities and resources, enterprise risk profiles, business impact analysis (BIA) registers, cybersecurity requirements and standards followed by the organization, practices and tools (e.g., procedures and safeguards), and work roles.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 12- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Examples of information may include organizational policies, risk management priorities and resources, enterprise risk profiles, business impact analysis (BIA) registers, cybersecurity requirements and standards followed by the organization, practices and tools (e.g., procedures and safeguards), and work roles.
34. NIST Cybersecurity Framework 2.0 · PDF page 12
Narrow public claim
Determine what types of information the Profile should include for the selected CSF outcomes, and document the needed information.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 12- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Determine what types of information the Profile should include for the selected CSF outcomes, and document the needed information.
35. NIST Cybersecurity Framework 2.0 · PDF page 12
Narrow public claim
Conduct a gap analysis to identify and analyze the differences between the Current and Target Profiles, and develop a prioritized action plan (e.g., risk register, risk detail report, Plan of Action and Milestones [POA&M]) to address those gaps.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 12- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Conduct a gap analysis to identify and analyze the differences between the Current and Target Profiles, and develop a prioritized action plan (e.g., risk register, risk detail report, Plan of Action and Milestones [POA&M]) to address those gaps.
36. NIST Cybersecurity Framework 2.0 · PDF page 13
Narrow public claim
CSF Tiers for cybersecurity risk governance and management Tiers should complement an organization’s cybersecurity risk management methodology rather than replace it.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 13- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
CSF Tiers for cybersecurity risk governance and management Tiers should complement an organization’s cybersecurity risk management methodology rather than replace it.
37. NIST Cybersecurity Framework 2.0 · PDF page 13
Narrow public claim
For example, an organization can use the Tiers to communicate internally as a benchmark for an organization-wide1 approach to managing cybersecurity risks.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 13- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For example, an organization can use the Tiers to communicate internally as a benchmark for an organization-wide1 approach to managing cybersecurity risks.
38. NIST Cybersecurity Framework 2.0 · PDF page 13
Narrow public claim
Progression to higher Tiers is encouraged when risks or mandates are greater or when a cost-benefit analysis indicates a feasible and cost-effective reduction of negative cybersecurity risks.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 13- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Progression to higher Tiers is encouraged when risks or mandates are greater or when a cost-benefit analysis indicates a feasible and cost-effective reduction of negative cybersecurity risks.
39. NIST Cybersecurity Framework 2.0 · PDF page 14
Narrow public claim
Since they are hosted online, these additional resources can be updated more frequently than this document, which is updated infrequently to provide stability to its users, and be available in machine-readable formats.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 14- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Since they are hosted online, these additional resources can be updated more frequently than this document, which is updated infrequently to provide stability to its users, and be available in machine-readable formats.
40. NIST Cybersecurity Framework 2.0 · PDF page 14
Narrow public claim
This section provides an overview of three types of online resources: Informative References, Implementation Examples, and Quick Start Guides.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 14- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This section provides an overview of three types of online resources: Informative References, Implementation Examples, and Quick Start Guides.
41. NIST Cybersecurity Framework 2.0 · PDF page 14
Narrow public claim
For example, a particular control from SP 800-53, Security and Privacy Controls for Information Systems and Organizations, may be one of many references needed to achieve the outcome described in one Subcategory.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 14- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For example, a particular control from SP 800-53, Security and Privacy Controls for Information Systems and Organizations, may be one of many references needed to achieve the outcome described in one Subcategory.
42. NIST Cybersecurity Framework 2.0 · PDF page 14
Narrow public claim
Other Informative References may be higher-level, such as a requirement from a policy that partially addresses numerous Subcategories.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 14- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Other Informative References may be higher-level, such as a requirement from a policy that partially addresses numerous Subcategories.
43. NIST Cybersecurity Framework 2.0 · PDF page 15
Narrow public claim
With an understanding of stakeholder expectations and risk appetite and tolerance (as outlined in GOVERN), an organization can prioritize cybersecurity activities to make informed decisions about cybersecurity expenditures and actions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 15- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
With an understanding of stakeholder expectations and risk appetite and tolerance (as outlined in GOVERN), an organization can prioritize cybersecurity activities to make informed decisions about cybersecurity expenditures and actions.
44. NIST Cybersecurity Framework 2.0 · PDF page 15
Narrow public claim
An organization may choose to handle risk in one or more ways — including mitigating, transferring, avoiding, or accepting negative risks and realizing, sharing, enhancing, or accepting positive risks — depending on the potential impacts and likelihoods.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 15- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
An organization may choose to handle risk in one or more ways — including mitigating, transferring, avoiding, or accepting negative risks and realizing, sharing, enhancing, or accepting positive risks — depending on the potential impacts and likelihoods.
45. NIST Cybersecurity Framework 2.0 · PDF page 15
Narrow public claim
Importantly, an organization can use the CSF both internally to manage its cybersecurity capabilities and externally to oversee or communicate with third parties.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 15- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Importantly, an organization can use the CSF both internally to manage its cybersecurity capabilities and externally to oversee or communicate with third parties.
46. NIST Cybersecurity Framework 2.0 · PDF page 15
Narrow public claim
5) between executives who focus on the organization’s priorities and strategic direction and managers who manage specific cybersecurity risks that could affect the achievement of those priorities.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 15- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
5) between executives who focus on the organization’s priorities and strategic direction and managers who manage specific cybersecurity risks that could affect the achievement of those priorities.
47. NIST Cybersecurity Framework 2.0 · PDF page 16
Narrow public claim
Preparing to create and use Organizational Profiles involves gathering information about organizational priorities, resources, and risk direction from executives.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 16- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Preparing to create and use Organizational Profiles involves gathering information about organizational priorities, resources, and risk direction from executives.
48. NIST Cybersecurity Framework 2.0 · PDF page 16
Narrow public claim
Actions to close any gaps identified between the Current and Target Profiles will be implemented by managers and practitioners and will provide key inputs into system-level plans.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 16- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Actions to close any gaps identified between the Current and Target Profiles will be implemented by managers and practitioners and will provide key inputs into system-level plans.
49. NIST Cybersecurity Framework 2.0 · PDF page 16
Narrow public claim
As the target state is achieved throughout the organization — including through controls and monitoring applied at the system level — the updated results can be shared through risk registers and progress reports.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 16- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As the target state is achieved throughout the organization — including through controls and monitoring applied at the system level — the updated results can be shared through risk registers and progress reports.
50. NIST Cybersecurity Framework 2.0 · PDF page 16
Narrow public claim
Executives’ discussions involve strategy, particularly how cybersecurity-related uncertainties might affect the achievement of organizational objectives.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 16- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Executives’ discussions involve strategy, particularly how cybersecurity-related uncertainties might affect the achievement of organizational objectives.
51. NIST Cybersecurity Framework 2.0 · PDF page 17
Narrow public claim
Organizations can employ an ERM approach to balance a portfolio of risk considerations, including cybersecurity, and make informed decisions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 17- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Organizations can employ an ERM approach to balance a portfolio of risk considerations, including cybersecurity, and make informed decisions.
52. NIST Cybersecurity Framework 2.0 · PDF page 17
Narrow public claim
Executives receive significant input about current and planned risk activities as they integrate governance and risk strategies with results from previous uses of the CSF.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 17- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Executives receive significant input about current and planned risk activities as they integrate governance and risk strategies with results from previous uses of the CSF.
53. NIST Cybersecurity Framework 2.0 · PDF page 17
Narrow public claim
The CSF helps organizations to translate their terminology for cybersecurity and cybersecurity risk management into general risk management language that executives will understand.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 17- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The CSF helps organizations to translate their terminology for cybersecurity and cybersecurity risk management into general risk management language that executives will understand.
54. NIST Cybersecurity Framework 2.0 · PDF page 17
Narrow public claim
For an organization using the NIST RMF and its suite of publications, the CSF can be used to complement the RMF’s approach to selecting and prioritizing controls from SP 800-53, Security and Privacy Controls for Information Systems and Organizations. • Privacy risks: While cybersecurity and privacy are independent disciplines, their objectives overlap in certain circumstances, as illustrated in Fig.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 17- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For an organization using the NIST RMF and its suite of publications, the CSF can be used to complement the RMF’s approach to selecting and prioritizing controls from SP 800-53, Security and Privacy Controls for Information Systems and Organizations. • Privacy risks: While cybersecurity and privacy are independent disciplines, their objectives overlap in certain circumstances, as illustrated in Fig.
55. NIST Cybersecurity Framework 2.0 · PDF page 18
Narrow public claim
Cybersecurity and privacy risk relationship Cybersecurity risk management is essential for addressing privacy risks related to the loss of the confidentiality, integrity, and availability of individuals’ data.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 18- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Cybersecurity and privacy risk relationship Cybersecurity risk management is essential for addressing privacy risks related to the loss of the confidentiality, integrity, and availability of individuals’ data.
56. NIST Cybersecurity Framework 2.0 · PDF page 18
Narrow public claim
An organization processes data to achieve mission or business purposes, which can sometimes give rise to privacy events whereby individuals may experience problems as a result of the data processing.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 18- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
An organization processes data to achieve mission or business purposes, which can sometimes give rise to privacy events whereby individuals may experience problems as a result of the data processing.
57. NIST Cybersecurity Framework 2.0 · PDF page 18
Narrow public claim
These problems can be expressed in various ways, but NIST describes them as ranging from dignity-type effects (e.g., embarrassment or stigma) to more tangible harms (e.g., discrimination, economic loss, or physical harm).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 18- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
These problems can be expressed in various ways, but NIST describes them as ranging from dignity-type effects (e.g., embarrassment or stigma) to more tangible harms (e.g., discrimination, economic loss, or physical harm).
58. NIST Cybersecurity Framework 2.0 · PDF page 19
Narrow public claim
SP 800-161r1 (Revision 1), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, provides in-depth information on C-SCRM. • Risks from emerging technologies: As new technologies and new applications of technology become available, new risks become clear.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 19- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
SP 800-161r1 (Revision 1), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, provides in-depth information on C-SCRM. • Risks from emerging technologies: As new technologies and new applications of technology become available, new risks become clear.
59. NIST Cybersecurity Framework 2.0 · PDF page 19
Narrow public claim
A contemporary example is artificial intelligence (AI), which has cybersecurity and privacy risks, as well as many other types of risk.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 19- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
A contemporary example is artificial intelligence (AI), which has cybersecurity and privacy risks, as well as many other types of risk.
60. NIST Cybersecurity Framework 2.0 · PDF page 20
Narrow public claim
The order of Functions, Categories, and Subcategories of the Core is not alphabetical; it is intended to resonate most with those charged with operationalizing risk management within an organization.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 20- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The order of Functions, Categories, and Subcategories of the Core is not alphabetical; it is intended to resonate most with those charged with operationalizing risk management within an organization.
61. NIST Cybersecurity Framework 2.0 · PDF page 20
Narrow public claim
The numbering of the Subcategories is intentionally not sequential; gaps in numbering indicate CSF 1.1 Subcategories that were relocated in CSF 2.0.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 20- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The numbering of the Subcategories is intentionally not sequential; gaps in numbering indicate CSF 1.1 Subcategories that were relocated in CSF 2.0.
62. NIST Cybersecurity Framework 2.0 · PDF page 29
Narrow public claim
Notional Illustration of the CSF Tiers Tier Cybersecurity Risk Governance Cybersecurity Risk Management Tier 1: Application of the organizational There is limited awareness of cybersecurity risks at the Partial cybersecurity risk strategy is managed organizational level. in an ad hoc manner.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 29- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Notional Illustration of the CSF Tiers Tier Cybersecurity Risk Governance Cybersecurity Risk Management Tier 1: Application of the organizational There is limited awareness of cybersecurity risks at the Partial cybersecurity risk strategy is managed organizational level. in an ad hoc manner.
63. NIST Cybersecurity Framework 2.0 · PDF page 29
Narrow public claim
Tier 2: Risk Risk management practices are There is an awareness of cybersecurity risks at the Informed approved by management but may organizational level, but an organization-wide approach not be established as organization- to managing cybersecurity risks has not been wide policy. established.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 29- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Tier 2: Risk Risk management practices are There is an awareness of cybersecurity risks at the Informed approved by management but may organizational level, but an organization-wide approach not be established as organization- to managing cybersecurity risks has not been wide policy. established.
64. NIST Cybersecurity Framework 2.0 · PDF page 29
Narrow public claim
Tier 3: The organization’s risk management There is an organization-wide approach to managing Repeatable practices are formally approved and cybersecurity risks.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 29- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Tier 3: The organization’s risk management There is an organization-wide approach to managing Repeatable practices are formally approved and cybersecurity risks.
65. NIST Cybersecurity Framework 2.0 · PDF page 30
Narrow public claim
Tier Cybersecurity Risk Governance Cybersecurity Risk Management The organization risk strategy is informed by the cybersecurity risks associated with its suppliers and the products and services it acquires and uses.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 30- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Tier Cybersecurity Risk Governance Cybersecurity Risk Management The organization risk strategy is informed by the cybersecurity risks associated with its suppliers and the products and services it acquires and uses.
66. NIST Cybersecurity Framework 2.0 · PDF page 30
Narrow public claim
Tier 4: There is an organization-wide The organization adapts its cybersecurity practices Adaptive approach to managing cybersecurity based on previous and current cybersecurity activities, risks that uses risk-informed policies, including lessons learned and predictive indicators. processes, and procedures to address Through a process of continuous improvement that potential cybersecurity events.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 30- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Tier 4: There is an organization-wide The organization adapts its cybersecurity practices Adaptive approach to managing cybersecurity based on previous and current cybersecurity activities, risks that uses risk-informed policies, including lessons learned and predictive indicators. processes, and procedures to address Through a process of continuous improvement that potential cybersecurity events.
67. NIST Cybersecurity Framework 2.0 · PDF page 31
Narrow public claim
CSF Target Profile A part of an Organizational Profile that specifies the desired Core outcomes that an organization has selected and prioritized for achieving its cybersecurity risk management objectives.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 31- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
CSF Target Profile A part of an Organizational Profile that specifies the desired Core outcomes that an organization has selected and prioritized for achieving its cybersecurity risk management objectives.
68. NIST Cybersecurity Framework 2.0 · PDF page 31
Narrow public claim
There are four Tiers: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 31- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
There are four Tiers: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4).
69. NIST Cybersecurity Framework 2.0 · PDF page 32
Narrow public claim
Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 32- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately.
70. NIST Cybersecurity Framework 2.0 · PDF page 32
Narrow public claim
Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST Cybersecurity Framework 2.0
- Section locator
PDF page 32- Captured
- 2026-08-04
- Source SHA-256
3c31f46fee98cac0c4323453e5109291a213b4de7fef8c058af9bf67f717433c- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom010_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose.