NIST CSF 2.0 Controls List With Digital Asset Mappings
Quick answer. NIST CSF 2.0 lists outcomes, not controls: 6 functions, 22 categories and 106 subcategories. For digital assets, map key custody and signing to Protect, contract upgrades to ID.RA-07, onchain monitoring to Detect and emergency pauses to Respond.
Video transcript
NIST CSF 2.0 has no controls list. It lists outcomes, and mapping them to keys, contracts and onchain alerts is up to you.
The Core has six functions, twenty two categories and 106 subcategories. NIST says they are not a checklist, and it does not prescribe how to achieve them.
The functions run from Govern through Identify, Protect, Detect and Respond, to Recover. Tiers rate your rigor, from Partial to Adaptive.
No subcategory names keys, wallets or smart contracts. The framework is technology neutral, so these mappings are Guardian's, not NIST's.
Key custody and signing map to Protect, using multisig thresholds and timelocks. Contract upgrades fall under change risk in Identify. Onchain alerts belong in Detect, and a rehearsed pause belongs in Respond.
NIST's Reference Tool exports the Core to Excel. To make it a working list, add your control, its owner, dated evidence, your current tier and your target tier.
NIST offers no certification. You show alignment with current and target profiles, backed by evidence.
Guardian's Cybersecurity Maturity Assessment scores tiers down to the subcategory level, using evidence and its own tests. A control written down but not enforced scores as absent.
Start with the Digital Asset Assurance Pilot, which maps the framework onto your real key ceremony and change control. Read the full list, or talk to Guardian at guardian.security.
Ask for a NIST CSF 2.0 controls list and you get 106 subcategories. Those are outcomes, not controls. NIST leaves the controls to you.
For a bank or fintech adding digital assets, the hard part is the mapping. Which outcome covers a signing key, a contract upgrade or an onchain alert?
This page lists every category and subcategory, then maps the ones that matter to crypto controls. For how digital assets change a bank's security program, see digital asset security for banks.
How CSF 2.0 Is Structured
NIST published CSF 2.0 on February 26, 2024, and it is still the current version. Its Core has three levels:
- Functions: six, from Govern to Recover.
- Categories: 22 groups of related outcomes.
- Subcategories: 106 specific outcomes, such as PR.AA-05.
NIST is explicit that these "are not a checklist of actions to perform." The CSF "does not prescribe how outcomes should be achieved."
NIST's online resources fill that gap. They include:
- Informative References: mappings to standards such as SP 800-53 controls.
- Implementation Examples: notional, action-oriented steps for each subcategory.
- Quick Start Guides: short guides to first steps.
You describe where you stand in a Current Profile and where you are going in a Target Profile. Tiers rate the rigor of your practices: Partial, Risk Informed, Repeatable and Adaptive.
Gaps in numbering are deliberate. They mark CSF 1.1 subcategories that NIST relocated in 2.0.
For how the CSF sits beside SOC 2, ISO 27001 and CCSS, see our security standards comparison.
Full Category and Subcategory List
| Function | Category (ID) | Subcategories (count) |
|---|---|---|
| Govern | Organizational Context (GV.OC) | 01 to 05 (5) |
| Govern | Risk Management Strategy (GV.RM) | 01 to 07 (7) |
| Govern | Roles, Responsibilities, and Authorities (GV.RR) | 01 to 04 (4) |
| Govern | Policy (GV.PO) | 01, 02 (2) |
| Govern | Oversight (GV.OV) | 01 to 03 (3) |
| Govern | Cybersecurity Supply Chain Risk Management (GV.SC) | 01 to 10 (10) |
| Identify | Asset Management (ID.AM) | 01 to 05, 07, 08 (7) |
| Identify | Risk Assessment (ID.RA) | 01 to 10 (10) |
| Identify | Improvement (ID.IM) | 01 to 04 (4) |
| Protect | Identity Management, Authentication, and Access Control (PR.AA) | 01 to 06 (6) |
| Protect | Awareness and Training (PR.AT) | 01, 02 (2) |
| Protect | Data Security (PR.DS) | 01, 02, 10, 11 (4) |
| Protect | Platform Security (PR.PS) | 01 to 06 (6) |
| Protect | Technology Infrastructure Resilience (PR.IR) | 01 to 04 (4) |
| Detect | Continuous Monitoring (DE.CM) | 01, 02, 03, 06, 09 (5) |
| Detect | Adverse Event Analysis (DE.AE) | 02, 03, 04, 06, 07, 08 (6) |
| Respond | Incident Management (RS.MA) | 01 to 05 (5) |
| Respond | Incident Analysis (RS.AN) | 03, 06, 07, 08 (4) |
| Respond | Incident Response Reporting and Communication (RS.CO) | 02, 03 (2) |
| Respond | Incident Mitigation (RS.MI) | 01, 02 (2) |
| Recover | Incident Recovery Plan Execution (RC.RP) | 01 to 06 (6) |
| Recover | Incident Recovery Communication (RC.CO) | 03, 04 (2) |
| Total | 22 categories | 106 |
Read a subcategory ID as category plus number: GV.SC-04 is outcome 04 under supply chain risk management.
Digital Asset Mappings
No subcategory names keys, wallets or smart contracts. The CSF is technology-neutral, so the mapping is yours to make.
The mappings below are Guardian's, not NIST's. The subcategory labels are shortened from NIST's text.
Govern
| Subcategory | Digital asset control |
|---|---|
| GV.RR-01 Leadership accountable for cyber risk | Named leaders own digital asset risk; the board gets a regular report |
| GV.RM-02 Risk appetite and tolerance set | Hot wallet caps and per-chain exposure limits |
| GV.SC-04 Suppliers prioritized by criticality | Custodians, RPCs, oracles and bridges ranked |
For the board report itself, see our board report template.
Identify
| Subcategory | Digital asset control |
|---|---|
| ID.AM-02 Software, services and systems inventoried | Every deployed contract, address and chain, with an owner |
| ID.RA-01 Vulnerabilities identified and recorded | Smart contract audits and offchain pentests |
| ID.RA-07 Changes assessed for risk | Each contract upgrade or parameter change reviewed before signing |
| ID.RA-08 Vulnerability disclosures handled | A bug bounty and a published disclosure contact |
Protect
| Subcategory | Digital asset control |
|---|---|
| PR.AA-01 Identities and credentials managed | An inventory of signers, keys and the HSM or MPC holding each |
| PR.AA-05 Least privilege, separation of duties | Multisig thresholds, separate roles and timelocks on upgrades |
| PR.AT-02 Specialized roles trained | Signers trained to decode and verify each transaction |
| PR.DS-11 Backups created and tested | Key share backups with a dated recovery test |
| PR.PS-06 Secure software development | Audits, invariant tests and CI gates for every contract change |
Detect
| Subcategory | Digital asset control |
|---|---|
| DE.CM-06 Service provider activity monitored | Watch oracles, bridges and custodians you depend on |
| DE.CM-09 Software and runtime monitored | Onchain alerts on privileged calls, upgrades and large flows |
| DE.AE-07 Threat intelligence integrated | Advisories and live exploits matched to your stack |
Respond
| Subcategory | Digital asset control |
|---|---|
| RS.MA-01 Plan executed with third parties | Pre-agreed contacts at exchanges, issuers and bridges |
| RS.AN-07 Incident data preserved | Transaction traces and signer logs kept intact |
| RS.MI-01 Incidents contained | A rehearsed pause, role revocation or freeze path |
Recover
| Subcategory | Digital asset control |
|---|---|
| RC.RP-03 Backup integrity verified first | Key material and deployment configs checked before reuse |
| RC.CO-04 Public updates shared | Updates on official, verified channels only |
Get the Spreadsheet
NIST's CSF 2.0 Reference Tool exports the Core as an Excel file. Our download on November 6, 2026 included the Implementation Examples and Informative References.
Its references include SP 800-53, ISO/IEC 27001:2022, CIS Controls, PCI DSS and the CRI Profile v2.0.
Two cautions. NIST calls the export "a user generated version of the Core versus an official NIST publication." It also lists withdrawn CSF 1.1 subcategories, so a raw row count runs above 106.
To turn it into a working list, add five columns:
- Your control for the outcome.
- Its owner.
- The evidence, with a date.
- Your current tier.
- Your target tier.
Then add Guardian's digital asset rows beside the subcategories above.
How Guardian Helps
Guardian's Cybersecurity Maturity Assessment, part of Regulatory & Compliance, scores current and target tiers for all six functions, "at the level of the subcategories beneath them."
Scores come from evidence and Guardian's own tests. A control that is written down but not enforced scores as absent.
Guardian's Technical Evidence maps artifacts to the provisions they answer, CSF IDs included. A privileged role and upgrade path map answers PR.AA-05; an invariant and fuzzing suite answers PR.PS-06.
The Digital Asset Assurance Pilot maps NIST CSF onto your actual key ceremony and change control. It is a low-commitment place to start.
Guardian applies the framework to itself: its site lists NIST CSF 2.0 as aligned.
Frequently Asked Questions
How many controls are in NIST CSF 2.0?
Strictly, none: CSF 2.0 lists outcomes. Its Core has 6 functions, 22 categories and 106 subcategories. NIST links them to control catalogs, such as SP 800-53, through Informative References.
Is there an official NIST CSF 2.0 spreadsheet?
The CSF 2.0 Reference Tool exports the Core to Excel, with Implementation Examples and Informative References. NIST calls the export user generated rather than an official publication, and it includes withdrawn CSF 1.1 rows.
Can a company be certified against NIST CSF 2.0?
No. NIST does not offer certifications or endorsements of CSF implementations and has no plans for a conformity assessment program. Show alignment with current and target profiles backed by evidence.
Where do smart contracts fit in NIST CSF 2.0?
No subcategory names them. Contract code fits secure development (PR.PS-06) and vulnerability identification (ID.RA-01). Upgrades fit change risk (ID.RA-07), and onchain monitoring fits DE.CM-09.
Sources
- NIST: The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (February 26, 2024)
- NIST: CSF 2.0 Informative References (accessed November 6, 2026)
- NIST: CSF 2.0 Reference Tool, Excel export of the Core with references (downloaded November 6, 2026)
- NIST: Cybersecurity Framework FAQs (accessed November 6, 2026)
- NIST: Cybersecurity Framework home page (accessed November 6, 2026)
- Guardian: Regulatory & Compliance
- Guardian: Digital Asset Assurance Pilot
Score your program against CSF 2.0
Guardian scores your current and target CSF 2.0 profile from evidence, then maps it onto your actual key ceremony and change control.