NIST CSF 2.0 // 89% COMPLIANT
GOVERN
1P 1A 0F
IDENTIFY
5P 1A 0F
PROTECT
5P 0A 1F
DETECT
1P 0A 0F
RESPOND
2P 0A 0F
RECOVER
1P 0A 0F
CONTROL DETAILS
| ID | CONTROL | STATUS | SOC 2 | ISO 27001 |
|---|---|---|---|---|
| GV.PO-01 | Governance and security policy documents exist | [OK] PASS | CC1.1, CC1.2, CC5.3 | A.5.1 |
| GV.SC-01 | Third-party dependencies and services are inventoried and tracked | [!!] PARTIAL | CC9.2 | A.5.19, A.5.20, A.5.21, A.5.22 |
| ID.AM-01 | Infrastructure hosting is documented | [OK] PASS | CC6.1 | A.5.9 |
| ID.AM-02 | Dependencies and third-party services are tracked | [OK] PASS | CC6.1 | A.5.9, A.8.19 |
| ID.RA-01 | Dependency vulnerabilities are scanned | [!!] PARTIAL | CC3.2, CC7.1 | A.8.8 |
| ID.RA-02 | Known vulnerability databases are checked (npm audit, GitHub Advisory Database) | [OK] PASS | CC3.2 | A.5.6 |
| ID.RA-08 | Vulnerability disclosure process + security contact published | [OK] PASS | CC7.3 | A.5.24, A.6.8 |
| ID.IM-02 | Automated scanning runs on code changes | [OK] PASS | CC4.1, CC8.1 | A.8.8 |
| PR.AA-01 | No secrets/credentials in source code | [OK] PASS | CC6.1, CC6.2 | A.5.16, A.5.17 |
| PR.AA-05 | Branch protection and code review requirements | [OK] PASS | CC6.1, CC6.3 | A.5.15, A.8.3 |
| PR.DS-01 | Data collection points are documented with retention policies | [XX] FAIL | CC6.1, CC6.7 | A.5.10, A.8.24 |
| PR.DS-02 | HTTPS enforced with valid certificate and HSTS | [OK] PASS | CC6.1, CC6.7 | A.8.24, A.8.20 |
| PR.DS-10 | Security headers mitigate in-browser data leakage and tampering | [OK] PASS | CC6.1 | A.8.20, A.8.22, A.8.23 |
| PR.PS-01 | Security configuration baseline is documented and scannable | [OK] PASS | CC7.1, CC8.1 | A.8.9 |
| DE.CM-09 | Secrets scanning + dependency monitoring on every push/PR | [OK] PASS | CC7.1 | A.8.7, A.8.16 |
| RS.MA-01 | Incident Response Plan exists | [OK] PASS | CC7.3, CC7.4 | A.5.24, A.5.26 |
| RS.CO-02 | Vulnerability disclosure and security contact are published | [OK] PASS | CC7.3 | A.5.25, A.6.8 |
| RC.RP-01 | IRP includes recovery procedures | [OK] PASS | CC7.5 | A.5.29, A.5.30 |
GAPS // 3 CONTROLS
| ID | STATUS | EVIDENCE |
|---|---|---|
| GV.SC-01 | [!!] PARTIAL | 2 third-party services identified, 0 open advisories tracked. A supply-chain program additionally requires supplier agreements, risk tiering, and periodic review (not scanner-verifiable). |
| ID.RA-01 | [!!] PARTIAL | Critical: 1, High: 3, Medium: 1 |
| PR.DS-01 | [XX] FAIL | 10 data collection points. 10 with undefined retention. |