NIST Cybersecurity Framework · 2.0

The NIST Cybersecurity Framework 2.0 organizes security into six functions: Govern, Identify, Protect, Detect, Respond, Recover. It is free, public-domain, and a superb on-ramp before a formal audit.

106

requirements tracked

Free

Access

Free on every plan

Start free with NIST Cybersecurity Framework See pricing

Scope

How much of the standard Keel models

Models its declared scope in full

Keel authors every leaf requirement in the scope declared below, all 106 of them, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.

Authored in Keel: 106 requirements
In Keel’s scored scope: 106 leaf requirements

Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework

Who it is for

Who needs NIST Cybersecurity Framework?

Teams that want a structured security baseline without a certification yet
Organizations mapping their program to a widely-recognized model
Anyone starting their compliance journey on a free framework

What Keel does

How Keel helps with NIST Cybersecurity Framework

All six NIST CSF 2.0 functions and their categories, free on every Keel plan
A launchpad: the controls you build here carry into SOC 2, ISO 27001, and more
Readiness scoring so you can see your baseline maturity at a glance

Collect once, comply everywhere

NIST Cybersecurity Framework shares canonical controls with ISO/IEC 27001, FedRAMP Rev5 Class D and FedRAMP Rev5 Class C and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding NIST Cybersecurity Framework rarely means starting from scratch.

Shares canonical controls with

ISO/IEC 27001 shares canonical controls
CIS Critical Security Controls shares canonical controls
PCI DSS shares canonical controls
SOC 2 shares canonical controls
SOX (Sarbanes-Oxley) Section 404 shares canonical controls
NIST SP 800-53 shares canonical controls
FedRAMP Rev5 Class B shares canonical controls
FedRAMP Rev5 Class C shares canonical controls
FedRAMP Rev5 Class D shares canonical controls
FedRAMP 20x shares canonical controls
FedRAMP Consolidated Rules shares canonical controls
NIST SP 800-171 shares canonical controls
HIPAA shares canonical controls
GDPR shares canonical controls
COPPA shares canonical controls
Google Play Families no shared canonical controls
Amazon Appstore Child-Directed Apps no shared canonical controls
Apple App Store Kids Category no shared canonical controls
PIPEDA shares canonical controls
ISO 9001 shares canonical controls
AI Governance Essentials shares canonical controls
ISO/IEC 42001 shares canonical controls
NIST AI Risk Management Framework shares canonical controls
EU AI Act no shared canonical controls
ESG Essentials shares canonical controls
US Employment Law - Federal Baseline shares canonical controls

A framework is lit when at least one canonical control satisfies both NIST Cybersecurity Framework and that framework. Unlit means none of them do, which is an absence rather than a judgment about that standard. 22 of 26 are lit here.

Features that help with NIST Cybersecurity Framework: Risk register

Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · SOX (Sarbanes-Oxley) Section 404 · NIST SP 800-53 · All frameworks