Framework · NIST CSFCSF 2.0 · six functions

NIST CSF as a live posture, not a spreadsheet.

Name: Compyl NIST CSF Compliance
Brand: Compyl
Availability: InStock

The CSF is voluntary, which is exactly why it drifts, a self-scored spreadsheet that’s stale by the next board meeting. Compyl’s NIST CSF 2.0 compliance software makes the framework operational: all six functions mapped to live evidence, Tiers and Profiles tracked continuously, and posture you can defend in real time.

Request a demo See how it works →

6 CSF functions125+ integrationsContinuous posture

NIST CSF 2.0 · postureBoard pack · refreshed today

86%ready

Subcategories with live evidence92 / 106

Current Profile → Target ProfileTier 3 → 4

Evidence Health90

GovernIdentifyProtectDetect · 1 driftingRespondRecover

GV.OC-01 · Organizational contextCybersecurity strategy approved by the board · policy evidence current

Passing

DE.CM-01 · Network monitoringFlow logs disabled in one VPC · task assigned to Cloud team

Drift → task

Gap to Target Profile · 14 subcategories · 6 in progressRoadmap live

The problem

A self-scored framework drifts the moment you close the file

The CSF’s flexibility is its trap: with no auditor and no certificate, your Profile is only as current as the last person who updated the spreadsheet, and the board can’t tell the difference.

The maturity score goes stale

A Profile scored in a workshop is out of date within a quarter as systems and controls change, but it keeps getting reported as if it were live.

Govern is new and unevenly adopted

CSF 2.0 added the Govern function. Many programs bolted it on without the evidence to back it, leaving the most board-relevant function the weakest.

Tiers become opinions, not evidence

Without continuous proof, your Implementation Tier is a self-assessment. That’s a hard thing to defend to a board, an insurer, or a customer.

How it works

One continuous loop, from connected systems to board-ready

Compyl runs your CSF program as an always-on cycle, functions, evidence, and Profile stay in sync automatically.

Connect

Integrate cloud, identity, code, endpoint, and HR systems.

Collect evidence

Pull audit evidence automatically, in real time.

Map to functions

Link every artifact to its CSF function and subcategory.

Monitor

Watch controls continuously and flag drift early.

Stay board-ready

Show a current, evidence-backed Profile on demand.

The framework

Six functions, one operating model

CSF 2.0 organizes cybersecurity outcomes into six functions. Compyl maps live evidence to each, so your Profile is backed by proof.

Govern

New in 2.0

Set and monitor cybersecurity strategy, roles, policy, and oversight, the board-facing function.

Strategy · roles · oversight

Identify

Function

Understand your assets, data, suppliers, and risks so you know what you’re protecting.

Assets · risk · improvement

Protect

Function

Access control, awareness, data security, and the safeguards that limit impact.

Access · data · resilience

Detect

Function

Continuous monitoring that finds anomalies and events as they happen.

Monitoring · event analysis

Respond & Recover

Functions

RS / RC

Contain and manage incidents, then restore operations and learn from them.

Incidents · recovery

Automated evidence

Stop assembling CSF evidence by hand

A CSF Profile is only credible if it’s backed by evidence. Compyl collects that proof continuously from the systems you already run and maps it to every function and subcategory.

Pull evidence automatically from cloud, identity, code, and endpoint tools
Every artifact mapped to the CSF function and subcategory it supports
No more screenshots, spreadsheets, or last-minute requests
Export a complete, board-ready evidence pack on demand

Function evidence · collected automatically1,148 artifacts · live

AWS · config, CloudTrail, GuardDuty396 artifacts · mapped to PR.PS, DE.CM, PR.DS

Synced 2m

Okta · users, MFA, groups212 artifacts · mapped to PR.AA-01 – PR.AA-05

Synced 6m

Datadog · monitoring, alerts174 artifacts · mapped to DE.CM, DE.AE

Synced 11m

Policy library · strategy, roles48 artifacts · mapped to GV.OC, GV.RR, GV.PO

Synced 1h

Every artifact mapped to the CSF function and subcategory it supportsBoard-ready pack

Evidence Health · New in 26.2

Know your Profile is evidence-backed, automatically

Collecting evidence is only half the battle; stale or incomplete proof is where a Tier claim falls apart. Evidence Health continuously scores every artifact the moment it changes, so weak evidence surfaces before the board pack, not during the meeting.

Every artifact scored on relevance, freshness, and completeness
An AI summary spells out exactly what’s missing and why
Re-scores automatically whenever the underlying evidence changes
Gaps surface with time to fix, not in front of the board

Evidence HealthNew in 26.2 · re-scores on change

ArtifactSupply-chain risk review · GV.SC-06

Score59 / 100

RelevanceHigh

FreshnessStale · 10 months

AI summary · what’s missingThe last supplier review covers 31 of 38 critical vendors. Seven onboarded since March have no due-diligence record, so the Govern function’s supply-chain outcome is claimed at Tier 3 without evidence. Run the review for the seven before the board pack.

Create taskOpen vendor register

Your Profile stays backed by current proof, not a workshop scoreScored continuously

Continuous monitoring

Catch control drift before the board does

A board doesn’t want last quarter’s maturity score. Compyl monitors every function continuously, scores your posture in real time, and turns the moment a control slips into a tracked task.

Live posture across all six CSF functions
Automatic alerts the moment a control drifts out of compliance
Remediation tasks auto-assigned with owners and deadlines
A defensible, time-stamped trail behind every Tier and Profile claim

Continuous monitoring106 subcategories · checked hourly

Detected09:14 · VPC flow logs disabled

AlertedOwner: Cloud team

Task openINFRA-2331 · due in 2 days

Verifiedauto re-check

DE.CM-01 · Networks are monitoredDrifted 09:14 · remediation in progress

Drifting

PR.AA-03 · Users are authenticatedMFA enforced org-wide · last check 08:00

Passing

A defensible, time-stamped trail behind every Tier and Profile claimAudit trail

Collect once, reuse everywhere

Your NIST CSF work becomes a head start on every other framework

The CSF maps cleanly onto SOC 2, ISO 27001, and NIST 800-53, they largely describe the same controls. Compyl cross-maps each one so a single piece of evidence satisfies every framework it touches.

One control mapped to its equivalent across 70+ frameworks
Collect evidence once and reuse it across every report
See instantly how CSF readiness translates to SOC 2 or ISO 27001
Add the next framework without starting the program over

One NIST CSF controlPR.AA-03 · Users are authenticatedMFA enforced for every user and service · evidence from Okta and AWS IAM1 piece of evidence

Also satisfies

SOC 2CC6.1 Logical access controls

Satisfied

ISO 27001A.8.5 Secure authentication · A.5.15 Access control

Satisfied

NIST SP 800-53IA-2 Identification and authentication · IA-2(1) MFA

Satisfied

PCI DSS v4.0.1Req 8.4 Multi-factor authentication

Satisfied

+ 70 more frameworks cross-mapped automatically

How you measure it

Tiers and Profiles, not pass/fail

The CSF isn’t certified, you express posture through Implementation Tiers and Profiles. Compyl keeps both backed by evidence.

Tiers

How rigorous your program is

Tiers 1–4 (Partial to Adaptive) describe how repeatable and risk-informed your practices are.

Tier 1–2: Partial / risk-informed practices
Tier 3–4: Repeatable / adaptive practices
With Compyl: Evidence to substantiate the Tier you claim

Profiles Current → Target

Where you are vs where you’re going

A Current Profile describes today; a Target Profile sets the goal. The gap between them is your roadmap.

Current Profile: Your posture today, evidence-backed
Target Profile: The outcomes you’re driving toward
With Compyl: Live gap tracking between the two

Why Compyl for NIST CSF

Not a checkbox tool, a continuous compliance engine

Plenty of tools hold a CSF spreadsheet. Compyl keeps your posture true every day, evidence-backed Tiers and Profiles you can put in front of a board.

Continuous, not point-in-time

Functions, evidence, and Profile stay live year-round, so your posture is defensible on any day.

One connected system

Controls, evidence, risks, and policies in one platform, not a stack of disconnected tools.

125+ integrations

Pulls live data from the stack you already run, so posture reflects reality, not snapshots.

Agentic AI

AI maps controls, drafts remediations, and offloads busywork, your team stays in control.

Multi-framework by design

CSF evidence carries over to SOC 2, ISO 27001, and NIST 800-53 without redoing the work.

Beyond NIST CSF

Build the CSF once, extend to every framework that follows

Compyl cross-maps controls so the work you do for the CSF carries straight into the next framework on your roadmap.

SOC 2 ISO 27001 ISO 42001 HIPAA GDPR PCI DSS NIST SP 800-53 MAS CCPA NIS2 70+ frameworks

Energy & Utilities Higher Education Risk Management IT Asset Management

Recognized by users on G2 · Rated a leader by the teams who use it G2 Momentum Leader, Summer 2026

CSF 2.0 functions mapped to live evidence

125+

Native integrations feeding evidence automatically

Real-time

Evidence collection, no manual screenshots

Year-round

Board readiness instead of a quarterly rescore

“It has brought a sense of relief to my life because, for the first time, we have a real solution in place that is proactively keeping us protected.”

JSJon SeniorCTO · via G2

What is NIST CSF, and how does Compyl help?

The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary framework from NIST, organized into six functions, Govern (new in 2.0), Identify, Protect, Detect, Respond, and Recover. It isn’t a certification; organizations express where they stand and where they’re headed using Implementation Tiers and Current and Target Profiles, then close the gap between them. Compyl makes the CSF operational. It connects to your systems, maps every function and subcategory to live evidence, monitors controls continuously, tracks your Tier and Profile over time, and flags drift, so your cybersecurity posture is something you can show the board on any day, not a spreadsheet you rescore once a year.

Six functions

How do the six NIST CSF 2.0 functions map to software?

CSF 2.0 added Govern to the original five functions and kept the Tier and Profile model. Because the framework is self-assessed, the risk is drift; the fix is live evidence behind each outcome.

Function	What it asks	With Compyl
Govern	Strategy, roles, policy, supply-chain risk oversight	Policy lifecycle, vendor risk and board reporting
Identify	Asset, risk and improvement management	Asset inventory and quantified risk register
Protect	Access, awareness, data security, platform and infrastructure resilience	Identity, cloud and endpoint integrations as evidence
Detect	Continuous monitoring and adverse-event analysis	Logging and security-tool integrations mapped to controls
Respond	Incident management, analysis, reporting, mitigation	Incident workflow with timelines and records
Recover	Recovery planning and communication	Business continuity and disaster recovery evidence

FAQ

NIST CSF questions, answered

What is the NIST CSF 2.0?

The NIST Cybersecurity Framework 2.0 is a voluntary framework organized into six functions, Govern, Identify, Protect, Detect, Respond, and Recover. Govern was added in version 2.0. It is not a certification; organizations use Implementation Tiers and Current and Target Profiles to describe and improve their cybersecurity posture.

What changed in CSF 2.0?

The biggest change is the new Govern function, which elevates cybersecurity governance, strategy, roles, and oversight to a top-level outcome. CSF 2.0 also broadened the framework’s scope beyond critical infrastructure to organizations of all sizes and sectors.

What are Tiers and Profiles?

Implementation Tiers (1–4, Partial to Adaptive) describe how rigorous and risk-informed your practices are. Profiles describe your posture: a Current Profile is where you are today, and a Target Profile is where you want to be. The gap between them is your improvement roadmap.

How does Compyl automate NIST CSF?

Compyl connects to your stack, maps every function and subcategory to live evidence, monitors controls continuously, tracks your Tier and Profile over time, and flags drift, so your posture is board-ready on any day instead of a spreadsheet you rescore once a year.

How does Compyl score evidence quality?

Compyl 26.2 introduced Evidence Health, which continuously scores every piece of evidence on relevance, freshness, and completeness, with an AI summary of gaps, so your Profile stays backed by current proof.

Can CSF work satisfy other frameworks?

Yes. Compyl cross-maps each control so a single control and its evidence can satisfy NIST CSF alongside SOC 2, ISO 27001, NIST 800-53, and 70+ other frameworks. Collect once, reuse everywhere it applies.

Who is Compyl’s NIST CSF solution designed for?

Security leaders and GRC teams, CISOs and risk officers, who use the CSF to communicate posture to boards, insurers, and customers, and need that posture backed by continuous evidence.

Is there a NIST CSF 2.1 or 3.0?

No. CSF 2.0, released in February 2024, is still the current version. NIST is adding supporting resources rather than revising it, including Quick Start Guides, Community Profiles and the draft Cyber AI Profile (NIST IR 8596).

What is the NIST Cyber AI Profile?

NIST IR 8596 is a draft CSF 2.0 Community Profile released in December 2025. It covers securing AI systems, using AI for cyber defense and thwarting AI-enabled attacks, mapped onto CSF outcomes. Public comments closed in January 2026 and NIST is revising the draft.

How do NIST CSF and the NIST AI RMF relate?

The CSF manages cybersecurity risk, while the AI RMF 1.0 manages broader AI risks such as validity, fairness and transparency. The Cyber AI Profile connects the two for AI-related cybersecurity, and many teams map both to one control library.

GRC your way

Give your board a cybersecurity posture, not a spreadsheet

See how Compyl maps every CSF function to live evidence, tracks your Tier and Profile, and keeps your posture board-ready year-round.

Request a demo See all frameworks →

Last reviewed September 2026 by the Compyl GRC team