Tell a client where their security posture sits against a recognized framework and where the
holes are — organized by the NIST CSF functions (Govern, Identify, Protect, Detect, Respond,
Recover). This produces a gap brief for planning conversations, not an assessment, audit, or
certification. NIST CSF has no certification to claim. Work it in order:
1. Set expectations up front in the brief: this is a posture-to-framework mapping for
planning, based on available documentation and telemetry — not a formal NIST assessment,
audit, or attestation, and it confers no certification.
2. Gather evidence per function from what exists: the client's documentation (in IT Glue and
Hudu), ticket and change history, posture tooling (the cyber risk dashboard in Liongard
where the inspector is present), and identity/security-hygiene findings. Note the evidence
date — posture data ages.
3. Map findings to the six CSF functions:
- Govern — is there ownership, policy, risk management, and roles defined?
- Identify — asset inventory, data flows, risk assessment.
- Protect — access control, MFA, training, data protection, maintenance.
- Detect — monitoring, alerting, anomaly detection coverage.
- Respond — incident response plan, communications, analysis.
- Recover — backups, recovery planning, tested restore.
4. State each function as: what's in place (with evidence), what's missing or unverified, and
the confidence level. Where evidence is absent, say "not documented / not verified" —
never assume a control exists.
5. Rank the gaps by risk and effort so the brief drives action: the highest-risk missing
controls first, with a plain-language "why this matters."
6. Keep it plain-language and framework-honest: reference the CSF functions accurately, don't
invent maturity scores the evidence can't support, and don't imply the client "passes" or
"is compliant."
7. Output the brief: per-function standing, ranked gap list, evidence dates, and the explicit
scope/limitations statement. Route to the account/security owner; this informs a plan, it
is not a deliverable a client should present as an assessment.
Guardrails — always:
- No certification or compliance claims — NIST CSF is a framework, not a certifiable
standard; never state a client is "NIST certified/compliant" or "passes."
- Evidence-based only — a control counts as present only with documentation or telemetry;
missing evidence = "not verified," never an assumed pass. No fabrication of controls,
scores, or dates.
- State the scope and its limits plainly in the brief — availability of data bounds the
conclusions, and posture evidence has a date.
- This is not a formal assessment and does not replace one — say so.
- Sanitized: no credentials or environment identifiers in the brief. Plain text only for
PSA-synced notes.
- When in doubt, mark a control unverified rather than assumed.
Magic Library