Products / Frameworks / 4.1.0

NIST CSF 2.0

Maps reusable evidence to Govern, Identify, Protect, Detect, Respond and Recover outcomes.

All frameworks Download control list (CSV)

This is the MSP 4.1.0 catalog snapshot, not the full publisher standard and not an assertion of Free/Professional parity. All conclusions require scope, adequate evidence and an authorized reviewer. This profile uses clause, family, criteria-group or locally authored readiness entries. It does not enumerate every official subcontrol or assessment objective.

22 catalog entries0 with exact test mappings9 family-support entries13 manual / unmapped

Search controls or testsCoverage

Control / requirement	Packaged guidance & evidence	Coverage
`GV.OC`Organizational Context	Organizational Context Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`GV.RM`Risk Management Strategy	Risk Management Strategy Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`GV.RR`Roles, Responsibilities and Authorities	Roles, Responsibilities and Authorities Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`GV.PO`Policy	Policy Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`GV.OV`Oversight	Oversight Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`GV.SC`Cybersecurity Supply Chain Risk Management	Cybersecurity Supply Chain Risk Management Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`ID.AM`Asset Management	Asset Management Evidence and test details Applicable supporting collectors: ASSETREC, NETWORK, STORAGE, VMWARE, WINDOWS. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`ID.RA`Risk Assessment	Risk Assessment Evidence and test details Applicable supporting collectors: VULN. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`ID.IM`Improvement	Improvement Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`PR.AA`Identity Management, Authentication and Access Control	Identity Management, Authentication and Access Control Evidence and test details Applicable supporting collectors: ADSEC, ENTRA. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`PR.AT`Awareness and Training	Awareness and Training Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`PR.DS`Data Security	Data Security Evidence and test details Applicable supporting collectors: BACKUP, CERTTLS, STORAGE. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`PR.PS`Platform Security	Platform Security Evidence and test details Applicable supporting collectors: GPO, VMWARE, WINDOWS. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`PR.IR`Technology Infrastructure Resilience	Technology Infrastructure Resilience Evidence and test details Applicable supporting collectors: BACKUP, NETWORK, STORAGE. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`DE.CM`Continuous Monitoring	Continuous Monitoring Evidence and test details Applicable supporting collectors: ENTRA, NETWORK, VULN, WINDOWS. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`DE.AE`Adverse Event Analysis	Adverse Event Analysis Evidence and test details Applicable supporting collectors: ENTRA, NETWORK, VULN, WINDOWS. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`RS.MA`Incident Management	Incident Management Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`RS.AN`Incident Analysis	Incident Analysis Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`RS.CO`Incident Response Reporting and Communication	Incident Response Reporting and Communication Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`RS.MI`Incident Mitigation	Incident Mitigation Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`RC.RP`Incident Recovery Plan Execution	Incident Recovery Plan Execution Evidence and test details Applicable supporting collectors: BACKUP, NETWORK, STORAGE. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`RC.CO`Incident Recovery Communication	Incident Recovery Communication Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping