NIST CSF 2.0

NIST Cybersecurity Framework Vulnerability Scanning

NIST CSF 2.0 expanded the framework from 5 to 6 core functions, with vulnerability management spanning Identify, Protect, and the new Govern function. KENSAI maps directly to CSF subcategories to support federal agencies and private organizations aligning to NIST.

Map KENSAI to NIST CSF → See NIST Dashboard

NIST CSF 2.0 Core Functions & Vulnerability Management

Released in February 2024, NIST CSF 2.0 adds a sixth function (Govern) and reorganizes subcategories. Vulnerability management touches multiple functions:

GOVERN (GV) — New in CSF 2.0

GV.RM-07: Strategic-level vulnerability risk management — ensuring vulnerability management is part of enterprise risk decisions and has executive visibility.

IDENTIFY (ID)

ID.RA-01: Asset vulnerabilities are identified and documented. ID.RA-02: Cyber threat intelligence is received from information sharing forums. ID.AM-02: Inventories of software, services, and systems. These are the foundation for any vulnerability management program.

PROTECT (PR)

PR.PS-02: Software is maintained to reduce exploitability. PR.PS-04: Log records are generated and made available. PR.MA-01/02: Maintenance and repairs performed, authorized, and logged.

DETECT (DE)

DE.CM-01/02/09: Networks and systems are monitored to find anomalies and potential cybersecurity events. Continuous scanning supports continuous detection.

RESPOND (RS)

RS.MI-02: Incidents are mitigated. Vulnerability remediation workflows support rapid incident response when vulnerabilities are actively exploited.

KENSAI Mapping to NIST CSF 2.0 Subcategories

CSF Subcategory	Description	KENSAI Capability
ID.RA-01	Asset vulnerabilities identified	Automated vulnerability scanning
ID.RA-02	Threat intelligence received	CVE threat intel integration
ID.AM-02	Software/service inventory	Asset discovery and inventory
PR.PS-02	Software maintained	Patch compliance monitoring
DE.CM-01	Networks monitored	Continuous network scanning
DE.CM-09	Computing hardware monitored	Endpoint vulnerability assessment
RS.MI-02	Incidents mitigated	Remediation workflow and tracking

NIST CSF Implementation Tiers and Vulnerability Management

NIST CSF defines four Implementation Tiers that describe the degree of sophistication in cybersecurity practices:

Tier 1 (Partial): Ad hoc, reactive vulnerability management — no formal process
Tier 2 (Risk Informed): Formal vulnerability management process exists but isn't organization-wide
Tier 3 (Repeatable): Documented, consistently applied vulnerability management with risk-based prioritization
Tier 4 (Adaptive): Continuous, automated vulnerability management integrated with threat intelligence and executive reporting

Most organizations should target Tier 3. KENSAI's automation enables Tier 4 capabilities without the complexity typically associated with enterprise security programs.

How KENSAI Supports NIST CSF Implementation

✓ Asset-Centric Scanning

Discover and continuously scan all assets to support ID.AM and ID.RA requirements for comprehensive inventory and vulnerability identification.

✓ Threat Intelligence Integration

Integrates with threat feeds to prioritize vulnerabilities being actively exploited (ID.RA-02) — focus on what matters most.

✓ Risk-Based Prioritization

CVSS + exploitability + asset criticality scoring enables the risk-informed decisions required at Tier 2 and above.

✓ NIST CSF Dashboard

Visualize your security posture mapped to CSF functions. Track progress toward higher implementation tiers over time.

✓ Executive Reporting

GV (Govern) function reporting gives leadership the vulnerability risk visibility required for strategic security decisions.

✓ Remediation Metrics

Track MTTR (Mean Time to Remediate) by severity and asset class — key metrics for demonstrating CSF tier progression.

NIST SP 800-53 Integration

For federal agencies and organizations following NIST SP 800-53, KENSAI maps to the RA (Risk Assessment) and SI (System and Information Integrity) control families:

RA-5: Vulnerability Monitoring and Scanning — Direct mapping; automated scanning satisfies core requirements
RA-5(2): Update Vulnerabilities Scanned — KENSAI uses current CVE databases
RA-5(5): Privileged Access — Authenticated scanning for deeper vulnerability discovery
SI-2: Flaw Remediation — Patch tracking and verification
SI-3: Malicious Code Protection — Integration with endpoint security for coordinated defense

Align Your Security Program to NIST CSF 2.0

KENSAI provides vulnerability scanning and management capabilities that directly implement NIST CSF 2.0 subcategories. Generate compliance reports mapped to the framework and demonstrate progress toward higher implementation tiers.

Start NIST CSF Assessment → Talk to a NIST Expert