Free Download · Cyber Security Risk Assessment
The complete cyber security risk assessment checklist
Every NIST CSF 2.0 function, Govern, Identify, Protect, Detect, Respond, Recover, cross-mapped to ISO/IEC 27001:2022 Annex A and the 18 CIS Controls v8 implementation groups. Built for CISOs, GRC leads, and security engineers running enterprise risk reviews, board reporting, or vendor cybersecurity questionnaires without spinning up a Big-Four engagement.
No credit card · No call required · Instant link
What's inside
Every NIST CSF 2.0 function, cross-mapped and ready to assess
The Cybersecurity Framework 2.0 (Feb 2024) organizes outcomes across six functions. The checklist follows that structure exactly so what you complete maps 1:1 to the framework an SEC filer, board audit committee, vendor questionnaire, or insurance carrier expects to see.
Govern
GV · Govern
- GV.OC · Organizational context (mission, stakeholders, legal + regulatory obligations)
- GV.RM · Risk management strategy (risk appetite, tolerance, acceptance criteria)
- GV.RR · Roles, responsibilities, authorities (RACI for cybersecurity decisions)
- GV.PO · Policy (cybersecurity policy approved + communicated + enforced)
- GV.OV · Oversight (board + executive review of cyber risk performance)
Identify
ID · Identify
- ID.AM · Asset management (hardware, software, data, services, suppliers inventoried + classified)
- ID.BE · Business environment (mission-critical functions + dependencies mapped)
- ID.GV · Cybersecurity governance (policies + legal + regulatory requirements managed)
- ID.RA · Risk assessment (threats, vulnerabilities, likelihood, impact documented)
- ID.SC · Supply chain risk (third-party + vendor + SBOM risk identified + monitored)
Protect
PR · Protect
- PR.AA · Identity, authentication, access control (MFA, privileged access, IAM lifecycle)
- PR.AT · Awareness + training (workforce + privileged-user role-based curriculum)
- PR.DS · Data security (encryption at rest + in transit, DLP, data destruction)
- PR.IP · Information protection processes (baseline configs, change control, SDLC)
- PR.MA · Maintenance (patch + vulnerability mgmt, remote maintenance approvals)
- PR.PT · Protective technology (audit logs, removable media, network segmentation)
Detect
DE · Detect
- DE.AE · Anomalies + events (baselines, event correlation, impact analysis)
- DE.CM · Continuous monitoring (network, endpoint, cloud, identity telemetry)
- DE.DP · Detection processes (roles, testing, communication, continuous improvement)
- DE.SO · Security operations (SOC, MDR, XDR, threat hunting, IR triage)
Respond
RS · Respond
- RS.RP · Response planning (IR plan + playbooks + tabletop exercises)
- RS.CO · Communications (internal, regulator, customer, public, law enforcement)
- RS.AN · Analysis (forensics, scope, root cause, evidence preservation)
- RS.MI · Mitigation + improvements (containment, eradication, lessons learned)
Recover
RC · Recover
- RC.RP · Recovery planning (RTO + RPO, backup integrity, DR testing)
- RC.IM · Improvements (post-incident review, plan + control updates)
- RC.CO · Communications (recovery status to stakeholders + media + regulators)
The PDF appendix cross-references all 18 CIS Controls v8 (Implementation Groups IG1, IG2, IG3) to the matching CSF subcategories, plus a one-page ISO/IEC 27001:2022 Annex A (93-control) mapping so a single completed line satisfies multiple framework asks. 28 pages total.
Why use this checklist
Built for the regulator, the board, and the vendor questionnaire, not for slideware
NIST CSF 2.0 is the new baseline. Released February 26, 2024, the NIST Cybersecurity Framework 2.0 is the first major revision since 2018. It adds a sixth function, Govern (GV), to elevate enterprise risk + executive oversight to the same tier as the technical functions. It expands beyond critical infrastructure to all sectors, all sizes, all geographies. And it formalizes cross-mapping to ISO/IEC 27001:2022, NIST SP 800-53 Rev 5, and the SEC cybersecurity disclosure rule (Item 1.05 of Form 8-K, effective December 2023). The checklist follows CSF 2.0's six-function structure exactly.
CIS Controls v8 covers the implementation gap. The Center for Internet Security's Critical Security Controls v8 (May 2021) translate framework outcomes into 18 prioritized, prescriptive controls grouped into three Implementation Groups. IG1 is the SMB-essentials baseline (~56 safeguards). IG2 covers the mid-market enterprise (~74 additional safeguards). IG3 covers high-risk targets in regulated industries. The checklist cross-maps each NIST CSF 2.0 subcategory to the corresponding CIS v8 control and IG tier so a 50-person SaaS and a 50,000-person hospital system can both use one document scoped to their size.
The threat data says 'fix the basics first.' The 2024 Verizon Data Breach Investigations Report (DBIR) analyzed 30,458 incidents and 10,626 confirmed breaches across 94 countries. Two findings drive the structure of this checklist. First, 68% of breaches involve a non-malicious human element, phishing, social engineering, or error, which makes PR.AT (awareness + training) and PR.AA (IAM) the highest-leverage controls. Second, ransomware and extortion are present in roughly one-third of breaches, with median losses tracking ~$46K but tail-risk losses reaching the eight-figure range, which makes RC.RP (recovery planning + tested backups) and DE.CM (continuous monitoring) the highest-leverage detection + response investments. The checklist is ordered to surface those controls first.
Who is it for
Three roles, one checklist
CISO + Director of Information Security
Owns the cybersecurity program, board reporting, SEC 8-K cyber-disclosure readiness, and cross-framework attestation (NIST CSF, ISO 27001, SOC 2, PCI DSS, HIPAA, FedRAMP). Reports up to the CIO, CTO, or directly to the board.
Outcome · Walk into the audit committee with one document that maps board-level governance (GV) outcomes to operating-level Identify–Recover controls, and to the ISO 27001 + CIS v8 frameworks the rest of the business already references.
Risk Manager + Head of GRC
Owns the integrated risk register, third-party risk, vendor security questionnaires, regulatory mapping, and the cross-framework crosswalk between cyber, privacy (GDPR, HIPAA, CCPA), and operational frameworks (SOC 2, ISO 22301).
Outcome · Use the checklist as the readiness diagnostic that gates a full ISO 27001:2022 certification, SOC 2 Type II audit, or CMMC Level 2 assessment, without rebuilding the same control library three times.
Security Engineer + Security Analyst
Implements, monitors, and tunes the controls. Runs the SOC, vulnerability management, IAM, endpoint, and cloud-security stack. Often the only deeply technical person in a small or mid-sized organization.
Outcome · Get a prescriptive control list, CIS v8 IG1/IG2/IG3 tiered, that converts directly into Jira epics, sprint backlogs, and architecture review tickets without translating from policy English first.
Common questions, answered
What's in the checklist, NIST CSF 2.0 vs 1.1 alignment, CIS Controls v8 cross-mapping, ISO 27001:2022 Annex A coverage, and SMB vs enterprise scope.
Related
Keep going
Beyond the checklist
Run NIST CSF + ISO 27001 + CIS on one platform?
The PDF is the readiness diagnostic. The platform runs continuous NIST CSF 2.0 scoring across all six functions, ISO/IEC 27001:2022 ISMS evidence, CIS Controls v8 implementation tracking by IG tier, and 36 other framework libraries (SOC 2, PCI DSS, HIPAA, GDPR, NIST 800-53 Rev 5, NIST 800-171, CMMC, FedRAMP), with one shared control library, one evidence pool, and the audit-grade reporting your board, regulators, and customers already accept.
Or call US: +1 941-500-4525