NIST Cybersecurity Framework 2.0
entityOS’s ISO/IEC 27001 & 27017-certified controls, mapped to the NIST Cybersecurity Framework 2.0 — Govern, Identify, Protect, Detect, Respond and Recover.
The NIST CSF is a voluntary framework; there is no “NIST CSF certification.” This page is a self-assessment that maps entityOS’s ISO/IEC 27001 / 27017-certified controls to the CSF 2.0 Functions and Categories, so US and government-aligned customers can locate our controls in the terms they use.
The NIST Cybersecurity Framework organises security outcomes into Functions, Categories and Subcategories, with Implementation Tiers describing rigour and Profiles describing current vs target state. Version 2.0 (2024) added Govern as a sixth Function, elevating governance alongside the operational five.
Establish and monitor the cybersecurity risk-management strategy, expectations and policy.
Understand the assets, risks and improvement opportunities to manage cybersecurity risk.
Use safeguards to prevent or reduce cybersecurity risk to the service.
Find and analyse possible cybersecurity attacks and compromises.
Take action regarding a detected cybersecurity incident.
Restore assets and operations affected by a cybersecurity incident.
Each CSF 2.0 Category, and the entityOS controls that deliver its outcomes — with the corresponding ISO 27001/17 references.
| ID | Category | How entityOS meets it | ISO 27001/17 |
|---|---|---|---|
| GVGovernEstablish and monitor the cybersecurity risk-management strategy, expectations and policy. | |||
| GV.OC | organisational Context | The ISMS defines the mission, stakeholders, and legal / regulatory requirements (Australian Privacy Act, data location), with a CRO-owned scope. | Cl.4 · A.5.31 |
| GV.RM | Risk Management Strategy | Risk appetite and methodology are set under ISO 27001; unacceptable risks are treated in priority order and recorded in the SOA (v3.0). | Cl.6.1 · A.5.1 |
| GV.RR | Roles, Responsibilities & Authorities | The CRO owns and allocates security roles; accountability is a condition of employment. | Cl.5.3 · A.5.2 |
| GV.PO | Policy | Information-security and topic-specific policies are defined, reviewed and communicated. | Cl.5.2 · A.5.1 |
| GV.OV | Oversight | Management review, external ISO 27001/17 audit and surveillance, and continuous testing evidence. | Cl.9.2–9.3 |
| GV.SC | Supply Chain Risk Management | Supplier risk is managed with AWS as the principal, monitored supplier and minimal third-party components. | A.5.19–5.22 |
| IDIdentifyUnderstand the assets, risks and improvement opportunities to manage cybersecurity risk. | |||
| ID.AM | Asset Management | Information and cloud-derived-data assets are inventoried with owners; assets used to access operations are registered. | A.5.9–5.10 |
| ID.RA | Risk Assessment | ISO 27001 risk assessment (assets → threats → treatment) with the CRO as risk owner. | Cl.8.2 · A.8.8 |
| ID.IM | Improvement | Plan-do-check-act; lessons from incidents and the testing service feed continuous improvement. | Cl.10.1 · A.5.27 |
| PRProtectUse safeguards to prevent or reduce cybersecurity risk to the service. | |||
| PR.AA | Identity, Authentication & Access Control | Role-based least-privilege across 700+ methods, TOTP/MFA and IP allowlisting; the identity life cycle is managed. | A.5.15–5.18 · A.8.2–8.5 |
| PR.AT | Awareness & Training | A small, tertiary-qualified team is continually trained; the “least number of humans” model reduces exposure. | A.6.3 |
| PR.DS | Data Security | Encryption in transit (2048/256 SSL, perfect forward secrecy) and at rest; tenant isolation; classification; integrity hashing with optional on-chain anchoring. | A.8.24, 5.12–5.14 · 27017 8.35 |
| PR.PS | Platform Security | A fixed, hardened kernel; secure configuration; 24-hour patching; application control; complete logging. | A.8.7–8.9, 8.19, 8.15 |
| PR.IR | Technology Infrastructure Resilience | AWS multi-AZ; real-time duplication and warm standby; network security (HTTPS on 80/443, WAF, Elastic Load Balancers). | A.8.14, 8.20–8.22 · A.5.30 |
| DEDetectFind and analyse possible cybersecurity attacks and compromises. | |||
| DE.CM | Continuous Monitoring | The continuous automated real-time testing service, plus monitoring and logging across networks, systems and applications. | A.8.16, 8.15 |
| DE.AE | Adverse Event Analysis | Exceptions from the testing service and monitoring are assessed and categorised, with real-time alerts to operations. | A.5.25, 8.16 |
| RSRespondTake action regarding a detected cybersecurity incident. | |||
| RS.MA | Incident Management | A documented incident-management process; reported issues are fixed within 24 hours. | A.5.24, 5.26 |
| RS.AN | Incident Analysis | Incidents are analysed; evidence is collected and preserved through logging. | A.5.27–5.28 |
| RS.CO | Reporting & Communication | A customer-notification process; issues affecting more than one tenant are reported to all affected. | A.5.24, 6.8 |
| RS.MI | Incident Mitigation | Containment and mitigation via the WAF, rapid patching and platform controls. | A.5.26, 8.7 |
| RCRecoverRestore assets and operations affected by a cybersecurity incident. | |||
| RC.RP | Recovery Plan Execution | Warm-standby duplication and daily test-restores via AWS RDS enable recovery to defined RTO/RPO. | A.8.13–8.14 · A.5.30 |
| RC.CO | Recovery Communication | Recovery status is communicated to customers through the incident and continuity process. | A.5.29, 6.8 |
The CSF describes four tiers of rigour. entityOS self-assesses at Tier 3, with characteristics of Tier 4 — an externally-audited, continuously-improving ISMS with automated, real-time testing.
Ad-hoc, reactive risk management with limited awareness.
Risk practices approved but not organisation-wide.
Formal, organisation-wide policy, regularly reviewed and audited.
Continuous improvement from lessons and real-time indicators.
The CSF describes outcomes; ISO 27001 certifies the management system that achieves them.