mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
88 lines
3.5 KiB
Markdown
88 lines
3.5 KiB
Markdown
# NIST CSF 2.0 Standards Reference
|
|
|
|
## Primary Standard
|
|
### NIST Cybersecurity Framework (CSF) Version 2.0
|
|
- **Published**: February 26, 2024
|
|
- **Publisher**: National Institute of Standards and Technology (NIST)
|
|
- **Document**: NIST CSWP 29
|
|
- **Scope**: Applicable to all organizations regardless of size, sector, or maturity
|
|
- **Key Change**: Added Govern function as central pillar; expanded from 5 to 6 functions
|
|
|
|
## CSF 2.0 Core Structure
|
|
|
|
### GV - Govern
|
|
- GV.OC-01 to GV.OC-05: Organizational context understood
|
|
- GV.RM-01 to GV.RM-07: Risk management strategy established
|
|
- GV.RR-01 to GV.RR-04: Roles, responsibilities, and authorities
|
|
- GV.PO-01 to GV.PO-02: Cybersecurity policy established
|
|
- GV.OV-01 to GV.OV-03: Cybersecurity strategy oversight
|
|
- GV.SC-01 to GV.SC-10: Supply chain risk management
|
|
|
|
### ID - Identify
|
|
- ID.AM-01 to ID.AM-08: Asset management
|
|
- ID.RA-01 to ID.RA-10: Risk assessment
|
|
- ID.IM-01 to ID.IM-04: Improvement
|
|
- ID.BE (removed in 2.0, moved to GV)
|
|
|
|
### PR - Protect
|
|
- PR.AA-01 to PR.AA-06: Identity management, authentication, access control
|
|
- PR.AT-01 to PR.AT-02: Awareness and training
|
|
- PR.DS-01 to PR.DS-10: Data security
|
|
- PR.PS-01 to PR.PS-06: Platform security
|
|
- PR.IR-01 to PR.IR-02: Technology infrastructure resilience
|
|
|
|
### DE - Detect
|
|
- DE.CM-01 to DE.CM-09: Continuous monitoring
|
|
- DE.AE-01 to DE.AE-08: Adverse event analysis
|
|
|
|
### RS - Respond
|
|
- RS.MA-01 to RS.MA-05: Incident management
|
|
- RS.AN-01 to RS.AN-08: Incident analysis
|
|
- RS.CO-01 to RS.CO-03: Incident response reporting and communication
|
|
- RS.MI-01 to RS.MI-02: Incident mitigation
|
|
|
|
### RC - Recover
|
|
- RC.RP-01 to RC.RP-06: Incident recovery plan execution
|
|
|
|
## Implementation Tiers Detail
|
|
|
|
### Tier 1: Partial
|
|
- **Risk Management Process**: Ad hoc; not formalized
|
|
- **Integrated Risk Management**: Limited awareness; irregular risk practices
|
|
- **External Participation**: No formal collaboration with external entities
|
|
- **Governance**: Cybersecurity not integrated into enterprise risk management
|
|
|
|
### Tier 2: Risk-Informed
|
|
- **Risk Management Process**: Approved by management but may not be policy
|
|
- **Integrated Risk Management**: Awareness at organizational level; some sharing
|
|
- **External Participation**: Aware of ecosystem role; limited collaboration
|
|
- **Governance**: Some integration of cybersecurity into enterprise risk
|
|
|
|
### Tier 3: Repeatable
|
|
- **Risk Management Process**: Formally approved policies; regularly updated
|
|
- **Integrated Risk Management**: Organization-wide approach; consistent implementation
|
|
- **External Participation**: Regular collaboration with partners and ecosystem
|
|
- **Governance**: Cybersecurity fully integrated into enterprise risk management
|
|
|
|
### Tier 4: Adaptive
|
|
- **Risk Management Process**: Continuous improvement using advanced techniques
|
|
- **Integrated Risk Management**: Real-time shared awareness; dynamic risk response
|
|
- **External Participation**: Active leadership in ecosystem risk management
|
|
- **Governance**: Agile cybersecurity governance adapting to changes
|
|
|
|
## Related NIST Publications
|
|
- **SP 800-53 Rev 5**: Security and Privacy Controls (detailed control catalog)
|
|
- **SP 800-37 Rev 2**: Risk Management Framework (RMF)
|
|
- **SP 800-30 Rev 1**: Guide for Conducting Risk Assessments
|
|
- **SP 800-171 Rev 3**: Protecting CUI in Nonfederal Systems
|
|
- **SP 800-207**: Zero Trust Architecture
|
|
- **SP 800-218**: Secure Software Development Framework (SSDF)
|
|
|
|
## CSF 2.0 Informative References
|
|
The CSF references specific controls from:
|
|
- NIST SP 800-53 Rev 5
|
|
- ISO/IEC 27001:2022
|
|
- CIS Controls v8
|
|
- COBIT 2019
|
|
- ISA/IEC 62443 (Industrial Control Systems)
|